1 (edited by hyness 2009-12-08 04:58:00)

Topic: SOLVED-Another Current NTFS volume size is bigger than the device size

I used the 0.5.0-3 live cd to resize an NTFS partition to create space for installing another linux distro.  I wanted to create 40 GB (40960) of space by resizing my sda2 NTFS partiton (created by Windows XP) and move the remaining 4 partitions (sda3-6) to the left of the newly freed space so the freed space would be on the end.  I also tried to resize the swap to 4gb from the ~2gb it was.  Unfortunately, I did all of this in one session of GParted instead of doing the NTFS resize in isolation.  I've been using Linux as a desktop for about 4 years off and on.  During that time I've used GParted to resize partitions several times without issue. It seemed to go ok, but at the I noticed the dreaded warning symbol on my NTFS drive with the all too familar warning message that is the subject of this post.  I found it strange since the GParted website mentioned this error for fixed in the latest buids.  However, I'm to blame for not reading that you should do NTFS resizing in isolation or risk doing what I did to my partition table.

Anyway, after rebooting my NTFS partition could not be mounted and was not accessible in Windows, reported as RAW.  I've done some research and found testdisk and used the quick scan to fix the partition table so that the partition is now accessible.  However, when I run GParted now, the whole drive shows up as unallocated.  After further research, it looks like its not totally fixed.  I've done a deep scan using testdisk as well as fdisk -l -u.  If anyone with a deeper understanding of partition tables (probably most users here) could help me figure out what is wrong and if its fixable, I'd greatly appreciate it.  TIA

My partitions

sda1 - NTFS - label:xp-sp3
sda2 - NTFS - label:data
sda3 - ext4 - label:root
sda4 - extended
sda5 - ext4 - label:home
sda6 - swap

parted output

# parted /dev/sda unit s print
Error: Can't have a partition outside the disk!                           

testdisk output

TestDisk 6.11.3, Data Recovery Utility, May 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 750 GB / 698 GiB - CHS 91202 255 63
     Partition               Start        End    Size in sectors
D HPFS - NTFS              0   1  1 10198 254 63  163846872 [xp-sp3]
D HPFS - NTFS          10076   0  1 85978 254 63 1219381695
D HPFS - NTFS          10198 254 63 20397 254 63  163846936
D HPFS - NTFS          10199   0  1 86101 254 63 1219381695 [data]
D HPFS - NTFS          10199   0  1 86101 254 63 1219381695 [data]
D HPFS - NTFS          15298   0  1 91200 254 63 1219381695
D Linux                80880   0  1 83067 254 63   35150220 [root]
D Linux                83068   1  1 85712 254 63   42491862 [home]
D Linux Swap           85713   1  1 86234 254 63    8385867
D Linux                86102   0  1 88289 254 63   35150220 [root]
D Linux                88290   1  1 90934 254 63   42491862 [home]
D Linux Swap           90935   1  1 91200 254 63    4273227
Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue

fdisk -l -u output

Disk /dev/sda: 750.2 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders, total 1465149168 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0xc9d8c9d8

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63   163846934    81923436    7  HPFS/NTFS
/dev/sda2       163846935  1383228629   609690847+   7  HPFS/NTFS
/dev/sda3      1383228630  1418378849    17575110   83  Linux
/dev/sda4      1418378850  1465160129    23390640    f  W95 Ext'd (LBA)
/dev/sda5      1418378913  1460870774    21245931   83  Linux
/dev/sda6      1460870838  1465144064     2136613+  82  Linux swap / Solaris

2

Re: SOLVED-Another Current NTFS volume size is bigger than the device size

Good sleuth work on this problem.  With the information you provided, it appears that only the Extended partition is larger than the outside of the disk.  The fix should be relatively simple.  Determining the cause is much more difficult.

If you saved the gparted_details.htm log file then please post it here so we can examine the steps that occurred.  Since you also used test disk, I really don't know what the partition table looked like prior to this "Error: Can't have a partition outside the disk!".


The problem can be clearly seen in the following numbers:

1,465,144,064 End of /dev/sda6 (This is okay)
1,465,160,129 End of Extended Partition
1,465,149,168 Total Disk Sectors

Obviously, the extended partition cannot go beyond the total number of disk sectors.  smile


To fix this problem you can use a hex editor to change the size of the extended partition.  If you are not comfortable with this then we will need a copy of the MBR to perform the necessary changes.

You can capture the Master Boot Record in a file with the following command:

NOTE:  Be extra careful to type this command in properly, otherwise loss of data could result.

dd if=/dev/sda of=sda-hyness.mbr bs=512 count=1

where sda-hyness.mbr is the name of the file that will need to be uploaded.

Upload this file to a media sharing site, such as mediafire, and post the link to this file in this forum post.

3

Re: SOLVED-Another Current NTFS volume size is bigger than the device size

Unfortunately, I don't have the log.  It wasn't until I exited GParted that I knew anything was wrong.  Here is my sda-hyness.mbr file.  I'd rather defer to your expert knowledge than trust myself with any kind of editing on my own if you don't mind. smile

Thanks for your quick and very helpful attention to my issue.

4

Re: SOLVED-Another Current NTFS volume size is bigger than the device size

In this situation we are going to reduce the size of the extended partition (/dev/sda4) to end at one less than the total sectors on the drive.

The change I have made to the file is from a length of 46,781,280 sectors:
000001F0   FF FF 0F FE  FF FF 62 BE  8A 54 60 D3  C9 02 55 AA
To a new length of 46,770,318 sectors:
000001F0   FF FF 0F FE  FF FF 62 BE  8A 54 8E A8  C9 02 55 AA

To apply this change:

1) Download the new MBR: sda-hyness_new.mbr

2) Load the new MBR on your hard disk.
NOTE:  Be extra careful when entering the commands.  Data loss could result otherwise.

dd if=sda-hyness_new.mbr of=/dev/sda bs=512 count=1

3) Reboot the computer

4) Check that the partition table is recognized in parted and / or GParted

5

Re: SOLVED-Another Current NTFS volume size is bigger than the device size

Thanks gedakc.  After loading the new MBR, GParted recognizes the partitions on my drive.  According to GParted now, it looks like nothing was done as far as resizing my partitions, which is strange since it seemed to be doing so for the while GParted was working.  The GUI reports 2.49 MiB of unallocated space at the end of my drive, which I don't believe was there when I started screwing all of this up smile

Here is my update partition info...

$ parted /dev/sda unit s print
Model: ATA ST3750640AS (scsi)
Disk /dev/sda: 1465149168s
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start        End          Size         Type      File system     Flags
 1      63s          163846934s   163846872s   primary   ntfs            boot
 2      163846935s   1383228629s  1219381695s  primary   ntfs
 3      1383228630s  1418378849s  35150220s    primary   ext4
 4      1418378850s  1465149167s  46770318s    extended                  lba
 5      1418378913s  1460870774s  42491862s    logical   ext4
 6      1460870838s  1465144064s  4273227s     logical   linux-swap(v1)

$ fdisk -l -u

Disk /dev/sdb: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x518fe117

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1              63  1953520064   976760001    7  HPFS/NTFS

Disk /dev/sda: 750.2 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders, total 1465149168 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0xc9d8c9d8

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63   163846934    81923436    7  HPFS/NTFS
/dev/sda2       163846935  1383228629   609690847+   7  HPFS/NTFS
/dev/sda3      1383228630  1418378849    17575110   83  Linux
/dev/sda4      1418378850  1465149167    23385159    f  W95 Ext'd (LBA)
/dev/sda5      1418378913  1460870774    21245931   83  Linux
/dev/sda6      1460870838  1465144064     2136613+  82  Linux swap / Solaris

So, in my haste to fix the issue on my own, by running testdisk without saving the partition info or consulting people who actually know what they're doing (i.e. not me), have I screwed things up to a point where I will never know what the correct partition table should look like?  Also, should I be worried that fdisk is now showing sdb info before sda? Do you think this partition info is correct?  Can I safely try to resize that NTFS partition and add new partitions on this disk?

Thanks again for all of your help!

6

Re: SOLVED-Another Current NTFS volume size is bigger than the device size

The 2.49 MiB of unallocated space is likely just because the extended partition now goes to the end of the drive and is not rounded to disk cylinder values.  If you want to make this space "disappear", you can selected the extended partition in GParted and slide the right edge to the left so that it butts up against the last logical partition.  Be sure to leave the "Round to cylinders" check box enabled / selected.

Without knowing exactly what happened, I cannot say with 100% accuracy that all is well.  Still my thoughts are that your data is okay and intact.  Before resizing your NTFS partition, I suggest that you run "chkdsk /f /r" on the drive and reboot into windows a few times to ensure that Windows is happy with the file system.

As always, we recommend that you have a backup of your data before moving/resizing partitions.

To my knowledge, the ordering of the drives within fdisk is not tied to changes in the partition table.  Perhaps sda will be before sdb on the next boot???

7

Re: SOLVED-Another Current NTFS volume size is bigger than the device size

All is well with my partitions according to chkdsk in windows.  It ran chkdsk without me asking before I booted to windows.  It ran a 3 step check that ended up deleting a bunch of indexes.  Once into windows, I ran chkdsk /f /r and all 5 steps found no issues.  And as you suspected, fdisk is now listing the disks in correct order in linux after rebooting.  I think we can consider this issue.  Once I have a good backup of that partition, I will try this all over again, and I think I will not have any problems after the lessons I've learned, and if something goes wrong I'll have logs smile

Again, thanks for all of your help, it is very much appreciated.

8

Re: SOLVED-Another Current NTFS volume size is bigger than the device size

It is good to hear that everything is fine now.  smile

Thank you also for marking this post as SOLVED.  This can be of help to other users searching these forums.