5

My Mom's PC's hard drive won't boot. So I took it out, plugged it to my PC and ran the GParted Live CD. The physical drive is found, but there are the yellow warning triangle beside the logical partition of the 2 ntfs partitions.

The "Information" tab didn't actually provide much answers, so I tried mounting both logical partitions. Here's what I got:

sudo mount /dev/sdc1/ mnt/c

Windows is hibernated, refused to mount.
The disk contains an unclean file system (0,0).
Metadata kept in Windows cache, refused to mount.
Falling back to read-only mount because the NTFS partition is in an
unsafe state. Please resume and shutdown Windows fully (no hibernation
or fast restarting.)
ntfs-3g-mount: failed to access mountpoint /mnt/c: No such file or directory

I get the same error message for both partition. Kinda very weird as, boot error flags are only applied to the designated boot drive (C:). I've set up my Mom's User folder to be in (D:), so whatever happens we can always pull out the files. Now both drives are locked out with hibernation.

My Mom needs her files. How do I safely remove the hibernation flag?

12
  • As usual, the people that did this would rather attack my family as a means of getting to me and then they're so dumb at justifying themselves.
    – kozner
    Jul 20, 2017 at 4:08
  • /mnt/c doesn't exist when you're in GParted. /mtn/c is just a convention Windows 10 uses to mount the C drive to be accessible in the Linux Subsystem. See if it'll let you mount with sudo mount /dev/sdc1/ /mnt/
    – n8te
    Jul 20, 2017 at 4:42
  • Oh wait, you're right, I need to create the directory first. I should be able to, right? Linux's file structure doesn't need physical storage mediums. Plus I've mounted dozens of times with Live CDs. I tend to forget one or two things if I don't do it in a very regular basis. Anyways, question still stands, I need to remove the hibernation flag.
    – kozner
    Jul 20, 2017 at 4:48
  • You can just mount it directly to /mtn/ and then delete the file called hiberfil.sys; you will lose anything that was open when it hibernated, but it should be good otherwise. Or does it not even let you mount it still?
    – n8te
    Jul 20, 2017 at 4:50
  • I just stopped trying to mount it when I found out the issue was hibernation. So I didn't bother remembering to create the directory. Hmmm... So I just need to delete hiberfil.sys? But the message already says that I can only mount it as read only anyways.
    – kozner
    Jul 20, 2017 at 4:55

1 Answer 1

4

You don't say what version of Windows is involved, but if it's Windows 8 or later, what you're seeing is most likely the result of the Windows Fast Startup and/or Hibernate features. These features turn a Windows shutdown operation into a suspend-to-disk operation. The point of this is to reduce startup times, since it's faster to resume from a suspend-to-disk than it is to fully start the OS. The problem is that this leaves the filesystems in an inconsistent state, and that's what the message you see in GParted Live is telling you when you attempt to mount the partitions.

The best solution is to boot the disk into Windows (on the original computer, using the original Windows installation) and disable these two features. Doing so is described here for Fast Startup and here for Hibernate. I realize you say that the computer has stopped booting, but it might be best to tackle that problem rather than do anything else, at least initially. (OTOH, if you've done anything to write to those partitions, then you've already eliminated the value of this approach over the next one....) You might want to ask about such repairs on a Windows-specific forum.

If you really can't get the original computer to boot the original OS, then the next-best approach is to connect the disk to another Windows computer and use it to repair the filesystems. Note that, if that computer uses Fast Startup, you should either use a "safe eject" type feature (if one is available) or disable Fast Startup and Hibernate on it before moving the disk anywhere else. If you just shut down with Fast Startup active, you'll end up with the same inconsistent state for the disk. (I'm not a Windows expert, so I can't say how you'd "safely eject" the disk. This is fairly easy with USB flash drives, but I don't know about hard disks.)

If you have no other Windows computer at hand, you might be able to use a Windows emergency disk for this task. I don't have pointers to these offhand, but I know they exist, floating around on the Web from reputable sources (even Microsoft, IIRC). Be sure to use something from a reputable source, though; if you download it from a site called "Sergei's Super Honest Not-a-Computer-Criminal Get Good Stuff Cheap," you may find your computer infected with malware when you're done.

As a final last-ditch effort, you could try using the recover option when mounting the partition in Linux, as in:

sudo mount -o recover,ro /dev/sdb2 /mnt/foo

This might mount the disk. Note that in my example, I've also specified ro (read-only), to minimize the risk of this approach. With any luck, you'll at least be able to copy files off the disk. I can't guarantee that this will work, though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .