Knoppix to recover data from corrupt ntfs

Sherm

Sherm

Sherm

Associate
Joined
4 Jun 2003
Posts
903
Location
UK, Dorset
I have a thread going on about the issue i have with a corrupt ntfs.sys on my windows drive. Here is the link. http://forums.overclockers.co.uk/showthread.php?t=17782561

Anyway been reading that a few people have fixed the problem by using Knoppix. I am downloading the iso now, but wondered if anyone had had any success with this or can give me any pointers or re-assurance that this would work?

Thanks
 
Yeah it should work. Although I tend to use a dedicated rescue CD like TRK rather than Knoppix, but go ahead and try it. Anyway, Linux will often read corrupted NTFS filesystems that will actually BSOD windows. I once recovered a system with the exact same symptoms you describe with some flavour of Linux rescue disk, essentially performing a FAT cloning
 
Mr_Vengeance said:
SuperWinPE 2004 or the 2005 DVD Version > ALL ;)
Click to expand...

Well, in many cases yes, but in this instance the problem appears to be that NTFS.sys crashes due to the corrupted NTFS filesystem (as I read the thread/problem anyway), BSOD'ing the Windows kernel, so that any Windows based system, whether installed or PE CD/DVD based is likely to be slightly less than helpful here (if that's the actual problem, of course.)
 
My only issue here, is that i have never used anything like this before, so not that sure what i am doing. Although i did find a walkthrough that a guy had written, so i will follow that.

The only thing that i need to check is that i will be looking to repair the drive and not get the files off until i can boot into windows again.....is this doable via knoppix?

And yes, it's just the ntfs file system that is borked.
 
Hmm, I never read this topic correctly when it was new up, you have messed up HDD and you want to recover data ?.

If so and you aint ran too many other apps to try to recover it and it aint totaled use File Scavenger, it saved my bacon when a mobo fried leaving my HDD messed up as RAW and not even formatable in XP.

Got 100% my files back for that week (do weekly back ups).

http://www.quetek.com/prod02.htm
 
Last edited:
My machine was runnig fine one minute, went to have dinner and when i came back the machine had blue screened and not been able to start up since. I have ordered another drive that i will use as my boot disk from now on, but i would like some data back off the drive that went down if i can. My main idea is to try and fix the ntfs file system so i can run the drive as a slave and get the files off that way.

thanks guys again for all ya help.
 
Sherm said:
My only issue here, is that i have never used anything like this before, so not that sure what i am doing. Although i did find a walkthrough that a guy had written, so i will follow that.

The only thing that i need to check is that i will be looking to repair the drive and not get the files off until i can boot into windows again.....is this doable via knoppix?

And yes, it's just the ntfs file system that is borked.
Click to expand...

Well, it depends on exactly what's ailing the filesystem. In the case of the system I repaired some years ago with a similar problem, I could not convicince Windows to repair the filesystem. Linux's tools doesn't really attempt to fix NTFS filesystems, although it's pretty good at reading reading (and these days writing) to them. Anyway, I ended up copying everyting to a new disk (FAT32 partition) then I reformatted the original disk FAT32 as well, copied all the files back, after which the disk booted fine again. Finally I used Windows to convert the partition back to NTFS. (Yes, all that bother because Windows couldn't fix its own filesystem... :) )

If you have a spare disk, then providing the dodgy disk mounts automatically under Knoppix, it should be pretty simple to copy then entire disk onto the spare disk etc.)

You can try running e.g. "ntfsfix" from Knoppix or whatever Linux disk you're using, and then see if you can boot into the Recovery console, from which a "chkdsk /f" should fix the filesystem properly. (But if your problem is the same as the one I had, then you will also BSOD before getting to the recovery console and "ntfsfix" won't perturb the filesystem enough to allow Windows to boot to the recovery console. If so your options are, backup/copy all the files for backup using Knoppix/TRK or whatever, and then reinstall or only reformat and copy everything back again using Linux. ) I'll try and help if you want to try this route, I'm on MSN etc if you want to message me online.
 
Last edited:
helmutcheese said:
You will get them back with the above APP, you boot PC to another HDD with Windows and it installed. :)
Click to expand...

Yeah, if he can get booted. :-) The problem here is apparently that NTFS.sys crashes on the dodgy disks's filesystem, which means he likely won't get it booted. (The fact that the drive is slave may not help, it did not in one or 2 similar cases I had to fix in the past. I even tried hot-plugging the disk inside a USB caddy, but that just crashed Windows the moment it tried to mount the new disk.)
 
helmutcheese said:
You will get booted as you will be on another HDD with XP on it, even if it means SAFE Mode if other HDD stops it booting.
Click to expand...

Well hopefully you're right. At the risk of belaboring the point, however bear in mind that Windows always uses the NTFS.sys driver to mount/read an NTFS filesystem. (There is nothing else, it IS the interface to the filesystem for the rest of the system.) Consequently if the problem is that this driver is crashing (in kernel space, hence the BSOD) due to corruption in the filesystem, then you'll have a crash no matter if the drive is the system drive or not, directly connected via SATA or USB or whatever, since the same sequence of crashing events will take place whenever you try to access the filesystem in any way, in which case there's precious little you can do using any type of Windows base to recover files or fix the filesystem. Aside: This is not just idle opinion I'm recounting by the way, I've actually had to recover 2 systems in the past that had been somehow corrupted exactly like this. I tried everything you could think of, but because of the trouble with Windows automatically mounting the disk as soon as it was connected to the system thus crashing it, I had no opportunity to even try the Windows based recovery programs I would normally try.

Anyway, I hope the OP's problem is more straightformward and that your suggestion works... :-)
 
Well how did I recover a HDD that was so messed up Windows could not see any file system, it reported it as RAW, when I clicked on it in "MY COMP", the only option was "This Drive is not formated, do you want to format now". ;)

P.S, also plugged it here and a few others got data back and even asked for a sticky.
 
helmutcheese said:
Well how did I recover a HDD that was so messed up Windows could not see any file system, it reported it as RAW, when I clicked on it in "MY COMP", the only option was "This Drive is not formated, do you want to format now". ;)

P.S, also plugged it here and a few others got data back and even asked for a sticky.
Click to expand...

Yeah I'm not knocking the app you're suggesting, at all. What I'm pointing out however is that it depends on Windows, and in some situations (such as what I describe above) that might preclude one from using the app you're suggesting, good as it is in most cases. I in fact agree with you that in general it's one of the best data recovery apps there is.
 
Hiya guys, thanks a lot for you help on this one.

The way that i am hoping that i can resolve this is by using Knoppix and booting from a live cd. From what i understand this is self enclosed on the cd and does not use any windows based software to see drives and hardware etc.
If this is the case then i should be able to boot from this cd and see the corrupt drive, from what i understand linux does not use the ntfs file system to see the drive, hence i should be able to see the files on the drive. If i can see the files i should be able to copy them to a FAT formatted drive (was thinking of using a usb key as i do not need to copy that much off).

Once i have copied everything off that i need, from reading above posts i may need to then format the drive within knoppix to a FAT structure, so that i can then format it again to ntfs within windows.

Does this seem ok?
 
Sherm said:
Hiya guys, thanks a lot for you help on this one.

The way that i am hoping that i can resolve this is by using Knoppix and booting from a live cd. From what i understand this is self enclosed on the cd and does not use any windows based software to see drives and hardware etc.
If this is the case then i should be able to boot from this cd and see the corrupt drive, from what i understand linux does not use the ntfs file system to see the drive, hence i should be able to see the files on the drive. If i can see the files i should be able to copy them to a FAT formatted drive (was thinking of using a usb key as i do not need to copy that much off).

Once i have copied everything off that i need, from reading above posts i may need to then format the drive within knoppix to a FAT structure, so that i can then format it again to ntfs within windows.

Does this seem ok?
Click to expand...

Yes, Linux uses its own NTFS driver which is unlikely to crash in the same place as Window's NTFS.sys driver. (However: You could/should probably try Helmutcheese's idea of installing Windows on the spare drive first, while the broken drive is disconnected, then see if you can view the broken drive as a slave drive after reconnecting it. If it then still BSOD's you have to proceed with Knoppix as above otherwise its far simpler to copy the files over to the new installation direct, or to use the recovery app he's suggested.)

But yeah, for using Knoppix, your idea is basically correct: Boot with Knoppix, see if it can successfully mount your partition and see the files you're after, and if so, then copy it to another (likely FAT32) disk. You can take 2 strategies:

1.) Copy the entire disk (including Windows folder) etc. onto a backup FAT32 disk, then from Linux format the original disk FAT32, then copy then entire disk contents back. This has the benefit of having a chance of retaining your existing installation and booting again, avoiding a reinstallation.

2.) Only copy the files you want to keep onto a backup FAT32 disk, then simply delete the broken NTFS partition using Linux's FDISK, and then reinstall Windows in the normal way, copying the files you want to keep back from the backup disk once Windows is back up and running.

In either case I can try and assist if you choose to go the Linux route. (Best would probably be MSN while you're working.)

Good luck! :)
 
Last edited:
I have actually tried installing the drive as a slave to see if i could copy the files over that way, with no luck. I just got blue screens when the machine was starting up and hot swapping did not seem to work either. I ahve not tried any windows utils to see if that could solve it though, but as Knoppix is free, then i thought i might aswell go down that route.

So it would seem that the way i intend on doing this stands a good chance of letting me get my files off. The only thing that i do not have to hand is a spare drive that i could copy the entire contents of the corrupt drive over to. All i actualy want however is my BioShock save games and my .pst file from Outlook. Once i have that, then the rest can be formatted.

Thanks ByteJuggler for you offer of msn help, and i may yet take you up on the offer, all depends on how well i get on navigating and doing what i need to do in Knoppix. Thats if the drive can be seen. one glimmer of hope though is the fact that when i was trying to do the slave drive route, i could see the drive in the bios etc, so hopefuly would mean that its not hardware but software (ntfs)

Going to see if i can get a bigger usb key on the way home, a 2 or 4gb one should be enought to get off what i need.

Thanks again, this kinda stuff is good to know anyway. Just a shame i have to try it out on my own drive!:p
 
Just went to startup using knoppix cd, came up with boot screen for knoppix, hit enter and now just a black screen.....


Any ideas?
 
Same boat as you mate,

RAW HDD full of data, ran Filescavenger which looked like it was working, BSOD :(
Came back to a few files partially returned, tried running it again BSOD.

Just tried Ubuntu and that wont recognise it either :/
 
You cant recover with most apps to same HDD, you need use a 2nd HDD with Windows.

Same as some use CD/DVD media to recover missing or deleted files to as they cant recover to same drive thats in use for example "Recover my files" App.

I would try booting into SAFE mode with a 2nd HDD with XP on it and connect the bad drive and run Hardware Wizard in Control Panel and hope no BSOD.
 
You must log in or register to reply here.
Back
Top Bottom