2

I asked this on Ask Ubuntu without success and they recommend to repost it on superuser, so here i am!

It was time, after 5 years my 1tb external drive with all of my family photos and all my music crashed. Stupidly enough, i did not have two drives in raid, which i just invested in so it won't happen again.

I successfully rescued the files with dd_rescue to my other 2tb movie drive on my server, however i cannot seem to understand how to mount this .img file.

I am using GNU ddrescue.

I also tried to run chkdsk \f on Windows 7 but it gave me the error "Insufficient disk space to fix volume bitmap. CHKDSK aborted.". according to microsofts website about this error message: "Delete some unneeded files from the NTFS volume, if you can, and then retry the Chkdsk command. If you cannot delete any files, you will have to reformat the NTFS volume and restore data from backup.". Since i'm not able to free space from the image i have no idea what to do. And only 400gb of the 1tb was used before anyway, so the error message doesn't make any sense really. A guy on Ask Ubuntu said that it could also be because of a very big corruption, but accodring to ddrescue the errsize was on only 31mb so that does not make any sense either.

Here's how i have executed my ddrescue command

sudo ddrescue /dev/sdh1 /media/external/rescue/rescue.img /media/external/rescue/rescuelog

Initial status (read from logfile)
rescued:        1 TB,  errsize:  30944 kB,  errors:     345
Finished

Here are my test commands

file image.img

image.img: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ", sectors/cluster 8, reserved sectors 0, Media descriptor 0xf8, heads 255, hidden sectors 2048, dos < 4.0 BootSector (0x80)

fdisk -l image.img

Disk image.img: 1000.2 GB, 1000203091968 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953521664 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x2052474d

This doesn't look like a partition table
Probably you selected the wrong device.

    Device Boot      Start         End      Blocks   Id  System
image.img1   ?     6579571  1924427647   958924038+  70  DiskSecure Multi-Boot
image.img2   ?  1953251627  3771827541   909287957+  43  Unknown
image.img3   ?   225735265   225735274           5   72  Unknown
image.img4      2642411520  2642463409       25945    0  Empty

Partition table entries are not in disk order

I have absolutely no idea why fdisk shows all these wierd partitions such as 'DiskSecure Multi-Boot' and two 'Unknown' partitions, the parted command gave me information that seemed correct though

parted image.img print

WARNING: You are not superuser.  Watch out for permissions.
Model:  (file)
Disk /media/external/Rescue/image.img: 1000GB
Sector size (logical/physical): 512B/512B
Partition Table: loop

Number  Start  End     Size    File system  Flags
 1      0.00B  1000GB  1000GB  ntfs

I am not sure if i have the correct flags and such, but here i'm trying to mount the drive

sudo mount -r -o loop image.img /mnt

ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 4096   usa_ofs: 0  usa_count: 65535: Invalid argument
Index buffer (VCN 0x0) of directory inode 0x5 has a size (24) differing from the directory specified size (4096).
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 4096   usa_ofs: 0  usa_count: 65535: Invalid argument
Index buffer (VCN 0x0) of directory inode 0x5 has a size (24) differing from the directory specified size (4096).
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 4096   usa_ofs: 0  usa_count: 65535: Invalid argument
Index buffer (VCN 0x0) of directory inode 0x5 has a size (24) differing from the directory specified size (4096).

Now it is actually mounted on /mnt, but when doing ls /mnt it returns "reading directory /mnt/: Input/output error"

Any help is appreciated, even speculations are very welcome.

Thanks in advance!

  • Could it be a MBR issue? Would cleaning the MBR perhaps be the solution? I would then have to get another harddrive to save my recovery in case that doesn't fix it. – Johan Bjäreholt Mar 30 '14 at 16:47
  • I just tried using testdisk on the image to try to repair the partitiontable, but it showed the same partition setup as fdisk and that's totaly wrong, and i did not find a way to configure it. – Johan Bjäreholt Apr 12 '14 at 13:09
2

I think I've experienced the same issue (corrupted partition table from a failing ddrescue'd NTFS drive (messed up "fdisk -l" but correct "parted", mount command would fail with

Failed to read last sector (1953520001): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

I managed to mount the rescued image with the command

sudo ntfs-3g -o force imagefile /mountpoint

which I think is equivalent to

sudo mount -t ntfs-3g imagefile /mountpoint

(found here http://www.makeuseof.com/tag/fix-corrupted-windows-ntfs-filesystem-ubuntu/ (and in the man page if I had bothered to read it... stupid.))

  • Sadly, it didn't work for me. ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 4096 usa_ofs: 0 usa_count: 65535: Invalid argument Index buffer (VCN 0x0) of directory inode 0x5 has a size (24) differing from the directory specified size (4096). The error message was longer, but didn't fit in the comments. Thanks for the help atleast! I'm going to send the image to a professional for an analysis. Expensive, but it's my only choice currently. – Johan Bjäreholt Apr 7 '15 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.