📜 ⬆️ ⬇️

Repair a damaged NTFS partition if it has been reduced to the minimum size (0 bytes free)

When redistributing hard disk partitions on a laptop, by inattention, I did not leave any free space for the partition with the NTFS file system. The system at that time was Linux Mint 18, although, in fact, it does not matter. After the redistribution of the place, I was horrified. When I tried to mount this section, I got an error:

Failed to attach Volume 101 GB


Error mounting / dev / sda4 at / media / dashka / B490E48B90E45600: command line `mount -t" ntfs "-o" uhelper = udisks2, nodev, nosuid, uid = 1000, gid = 1000 "" / dev / sda4 "" " / media / dashka / B490E48B90E45600 "'exited with non-zero exit status 13: Failed to load runlist for $ MFT / $ DATA.
highest_vcn = 0x204f, last_vcn - 1 = 0x263f
Failed to load $ MFT: I / O Error
Failed to mount '/ dev / sda4': I / O Error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID / FakeRAID hardware. In the first case run chkdsk / f on Windows
then reboot into Windows twice. The usage of the / f parameter is very
important! If the device is a SoftRAID / FakeRAID then first activate
/ dev / mapper / directory, (eg
/ dev / mapper / nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

Putting the Windows was completely reluctant, there was practically no free memory on the laptop. I suffered a lot for a long time, I tried a lot, but, nevertheless, I found a way out. So, first we need another PC with free space, which is enough for a full backup of the damaged partition, or we need as much space on the affected computer. The latter, of course, is much simpler than the first.

If there is enough space on the affected computer.


In this case, download the testdisk utility.

Next, it is advisable to make an exact backup of the damaged partition to the external media, how to do it correctly, I will describe in more detail in the second method, when we do not have enough space. Everything is clear with this utility, I didn’t even have to compile it. I just ran the testdisk_static executable. Then you can figure it out yourself. If it did not work, then you should use the photorec utility. It also runs, and comes bundled with the testdisk utility, in the same folder. The cons of the photorec utility is incomplete recovery, that is, all files will be interspersed and the creation date, changes, name, and so on will be lost. The maximum that you can - is to sort that where.
')
mv /////*.{jpg,png} ./Photo mv /////*.mov ./\  mv /////*.mp4 ./ 

Etc.

If there is not enough space on the affected computer.


In general, everything is similar to the first option, BUT: first, you need to make an exact copy of the broken partition from the affected computer to the computer, where there is enough memory to perform the operations above. This can be done by connecting computers with USB-to-USB, over a local network, or via the Internet. I'm not a special craftsman, so for the second option, I thought of just using ssh.

How to make this backup


 sudo dd if=/dev/sdaX bs=8192 | ssh hostname 'dd of=/home/user/backup.img bs=8192' && echo 'all right' > ~/DD.log || echo '' > ~/DD.log; ssh hostname poweroff; sudo shutdown 

X - the number of the damaged section, look in programs like GParted or in the description of the error itself. ssh hostname - is replaced with your ssh configuration (in my case, this is 'ssh -p 31182 -i .ssh / id_rsa nikitosios@192.168.1.10'). Backup 100 GB I took all night, about 10-11 hours.

Explanation of the code above and some usefulness
The most important thing to say is: to keep track of the backup process, you need:

1) Start another terminal.

2) Register ps -a and find the PID of the dd utility.

3) Register while true; do sudo kill -USR1 [PID dd] ; sleep 10; done while true; do sudo kill -USR1 [PID dd] ; sleep 10; done while true; do sudo kill -USR1 [PID dd] ; sleep 10; done and enter the password.

4) Look at the execution process in the terminal where the dd utility is running.

&& echo 'all right' > ~/DD.log || echo '' > ~/DD.log && echo 'all right' > ~/DD.log || echo '' > ~/DD.log is a command to look in the morning whether everything was copied normally or not. The result will be recorded in the DD.log file in your home folder.

ssh hostname poweroff; sudo shutdown ssh hostname poweroff; sudo shutdown - turn off computers.

Well, we have an exact copy of the section. What next to do with it? And then I had to make a rather cunning move. Since testdisk and photorec are only looking for devices connected to a PC, you need to set our image as a device. For this, I created a symbolic link like this:

  ln -s /dev/sdv /home/user/backup.img 

Sly, is not it? Now you can safely restore our / dev / sdv using the example described under the heading "If there is enough space on the affected computer."

First, I advise you to try the S-trace user method:
Put VirtualBox, put windows into it (discard the ideological side - the question is purely technical), then (after installing windows) forward the physical disk to the virtual machine using the command vboxmanage internalcommands createrawvmdk -filename ~ / sda.vmdk -rawdisk / dev / sda (maybe you will have to wrestle a little with the carrier system for the right of direct access to / dev / sda).
a) From under windows try to run chkdsk this section.
b) Or expand it back with standard disk tools.
c) If the partition is mounted but not writable, you can copy data through the VirtualBox “shared folder” or over the network between the virtual machine and the system.

PS With a testdisk you have to dance, so for a start it is better to restore everything with a photorec, and if the result does not suit you, then you can dance with a testdisk.

Well that's all. I hope someone will help this post.

Source: https://habr.com/ru/post/315246/


All Articles