I have a semi theoretical question regarding ntfs partitions.

Assume we create a ntfs partition inside a file

    dd if=/dev/zero of=test.img count=40960
    mkfs.ntfs -F test.img

for testing purposes i've added some files

    sudo mount -o loop test.img mnt
    mkdir -p mnt/test_dir/doc
    echo "this is a test file" > mnt/test_dir/doc/README.txt
    sudo umount mnt

so here comes my question. Assume i have just one part of my partition

    dd if=test.img of=test_part.img count=40952

is it possible to repair this part, in order to mount it again.

In my understanding in the test_part.img one cluster is missing, since the count parameter is 40952, which is 8 less than the original size. And with a sector size of 512, 8*512=4096 is one ntfs cluster.

I've tried the ntfsfix utility which did not work.

I've also looked into the documentation of testdisk and it seems you can change the partition geometry manually with this tool. However i had no success.

So please help me. Is there a way to repair test_part.img so that i can mount it again and get the README.txt file.

  • AFAIR CloneZilla uses ntfsresize for similar cases, you could give it a try. – gronostaj Mar 21 '16 at 2:22
  • Yey! Thank you it worked. I hope this will also work for my real problem. – MechaTheo Mar 21 '16 at 2:34

(reposting my comment as an answer

As far as I remember CloneZilla uses ntfsresize for similar cases, you could give it a try.

It's as simple as running:

ntfsresize /dev/sda1

Where sda1 is the partition you want to fix. You'll need root privileges.

  • After further investigation, i've found out that ntfsresize does not completely fix the problem. When running ntfsresize -s 6709248 test_part.img i'm able to mount the partition and the test file is still there. However ntfsinfo -m test_part.img returns that the volume size is clusters is 5119, which is the same as of the original non damaged image. After running ntfsfix on test_part.img, the volume size in clusters is displayed correctly, however parted still reports a size of 21.0 MB. – MechaTheo Mar 21 '16 at 11:08
  • Ok, i think it's correct though. I've doublechecked the size in bytes and it seems all right. – MechaTheo Mar 21 '16 at 11:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.