I am having troubles on mounting my NTFS hard drive on Linux. I am running Ophcrack live CD.

fdisk shows me the hard drive I have installed on my computer.

fdisk -l

Disk /dev/hdc: 30.0 GB, 30005821440 bytes
255 heads, 63 sectors/track, 3648 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks  Id System
/dev/hdc1   *           1        3647    29294496   7 HPFS/NTFS

but I don't have that device on my /dev directory, so I cannot mount it.

ls /dev/hd*
/dev/hda   /dev/hda4  /dev/hda8  /dev/hdb2  /dev/hdb6  /dev/hdc
/dev/hda1  /dev/hda5  /dev/hda9  /dev/hdb3  /dev/hdb7  /dev/hdd
/dev/hda2  /dev/hda6  /dev/hdb   /dev/hdb4  /dev/hdb8
/dev/hda3  /dev/hda7  /dev/hdb1  /dev/hdb5  /dev/hdb9

What could be going on?

  • /* Requested tags: linux partitions */
    – Vi.
    Mar 19 '10 at 23:45
  • @Vi: Your wish is my command
    – Josh
    Mar 19 '10 at 23:50

You may create this node manually: mknod /dev/hdc1 b 22 1

Then you should check if can be read cat /dev/hdc1 > /dev/null

Either kernel can't find a partition, or udev doesn't create this node automatically. udev is responsible of creation of this files

If manual creation of /dev/hdc1 will fail, you can mount the partition manually specifying the offset:

losetup /dev/loop0 /dev/hdc -o $((63*512))
mount /dev/loop0 /mnt/hdc1

You should use fdisk -l -u /dev/hdc to rectify 63.

  • what is "b 22 1" for? How do I know which numbers to use there?
    – Cam
    May 3 '13 at 5:10
  • Several methods apply: 1. Remember which number /dev/hd* typically have; 2. Look at /sys/block/*/dev and into /proc/partitions.
    – Vi.
    May 3 '13 at 8:57

Sometimes people experience this problem when they're dealing with removable media, or they've freshly partitioned a hard-drive and the kernel hasn't updated the dev nodes yet.

Perhaps there are other ways of reaching this condition, maybe the Kernel needs a special module to decode the partition table, but that module wasn't available till way too late in the boot process?

So before you reach for mknod, it can be sometimes beneficial to trigger the Kernel to re-read the partition table with hdparm

hdparm -z /dev/hdc

Here's the related man hdparm excerpt:

-z     Force a kernel re-read of the partition table of the specified device(s).

The first method Vi suggested worked for me. Note that cat /dev/hdc1 > /dev/null will no produce any output but you can check it is working watching the green bars (down and right) in the desktop bottom panel. Also you don't need to wait till the end, because it will take a while, simply close the terminal and that will stop cat. Proceed to mount hdc1.

I didn't tried the second method because I didn't need it.

Also remember, if you have two computers, you can copy (/hdxX/)Windows/System32/Config (where encrypted SAM file is) to a pendrive, using Ophcrak live or some other Linux live CD, and then crack the passwords in your other computer using the installed version of ophcrack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.