1 Topic by asatbluesboy

  • asatbluesboy
  • New member
  • Offline
  • Registered: 2010-01-15
  • Posts: 6

Topic: Shrunk NTFS now without a label or UUID

Well, I tried to shrink my single NTFS Windows XP partition earlier today, and to create a second NTFS partition. I got the read disk error and, following mostly advice found here, managed to get it up and running. I ran fixboot, then fixmbr, then burnt FreeDOS to a CD, erased and rewrote the MBR, and could only get it fixed when I finally erased the second partition and grew the first partition to fit the rest of the HD. Ah, yes, I'm running GParted from Puppy Linux 4.3.1 installed on a flash drive.

What did I think, then? That it was the fix, of course! So I tried to shrink the single partition again, WITHOUT running fdisk /f (though my XP CD only has the /p and /r options). I know, I know, but it's kind of late. And my hard drive is acting crazy now. GParted (0.4.5) is telling me that its file system is ntfs, the size is 189.98GiB and it's got the "boot" flag. So far, so good, but get a load of this: it's got no label or UUID whatsoever. GParted says it's screwed ($MFT has invalid magic and NTFS is inconsistent). I tried to use TestDisk to recover the MFT, but both are screwed. Also tried to use it to write a new MBR, but it didn't help.

First sector is 63, last is 398283479. Total 398283417.

fdisk -l -u reads:
Disk /dev/sda: 203.9 GB, 203928109056 bytes
1 heads, 63 sectors/track, 6322176 cylinders, total 398297088 sectors

   Device Boot         Start               End           Blocks     Id   System
/dev/sda1  *                63     398283479     199141708+    7   HPFS/NTFS
Partition 1 does not end on cylinder boundary.

Might the latter be the problem? I'm pretty new to all this stuff. If I knew the risks, I don't know if I would have messed with it again... sad

sda.MBR and sda1.PBR.

Thanks in advance,
-Gustavo

2 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: Shrunk NTFS now without a label or UUID

There is no recognizable NTFS partition boot record in the sda1.PBR file.  If your capture command included sector 63 then it would appear that the NTFS file system is indeed in an inconsistent state.

If you do not have a backup of your data, you might consider using PhotoRec to try to recover individual files.

3 Reply by asatbluesboy (edited by asatbluesboy 2010-01-18 22:07:13)

  • asatbluesboy
  • New member
  • Offline
  • Registered: 2010-01-15
  • Posts: 6

Re: Shrunk NTFS now without a label or UUID

The command for the sda.MBR file was:

dd if=/dev/sda of=/root/sda.MBR bs=512 count=100

For sda1.PBR:

dd if=/dev/sda of=/root/sda1.PBR bs=512 skip=16065 count=100

Have I lost my HD file system for good?

4 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: Shrunk NTFS now without a label or UUID

Now that I know the commands you ran, I can see that the NTFS PBR is actually included in the large sda.MBR file along with the MBR.

From the large sda.MBR file I have been able to determine the following:
398,283,417 sectors in length for the size of the first partition (sda1)
106,735,859 sectors in length for the NTFS volume beginning at sector 63.

This should not cause a problem because the NTFS volume is smaller than the partition size.  The only concern with this would be the wasted space.

However, I did discover a problem with the number of "Hidden Sectors".
291,574,620 is the number of "Hidden Sectors" from the large sda.MBR file
63 is the value this should have to be a valid NTFS Partition Boot Record.

This situation should be recoverable.  smile


The change I have made to the new NTFS PBR file is from a "Hidden Sector" value of 291,574,620 sectors:
00000010   00 00 00 00  00 F8 00 00  3F 00 FF 00  E4 A9 60 11
To a new value of 63 sectors:
00000010   00 00 00 00  00 F8 00 00  3F 00 FF 00  3F 00 00 00

To apply this change:

1) Download the new NTFS PBR: sda1-asatbluesboy_new.pbr

2) Load the new NTFS PBR on your hard disk.
NOTE:  Be extra careful when entering the commands.  Data loss could result otherwise.

dd if=sda1-asatbluesboy_new.pbr of=/dev/sda bs=512 count=1 seek=63

3) Reboot the computer

4) Check that the file system is recognized in GParted

5) If all seems fine then I would advise booting into Windows and running "chkdsk /f /r" multiple times, until there are no more faults.

6) To increase the size of the NTFS volume to fill the partition, boot back into GPArted, select the partition, choose the menu option "Partition --> Check", and then click apply.

5 Reply by asatbluesboy (edited by asatbluesboy 2010-01-19 03:09:49)

  • asatbluesboy
  • New member
  • Offline
  • Registered: 2010-01-15
  • Posts: 6

Re: Shrunk NTFS now without a label or UUID

I thank you deeply, but most unfortunately GParted still can't recognize it. Any other thoughts?

Some screenshots:
http://img18.imageshack.us/img18/6900/gpartedu.png

http://img18.imageshack.us/img18/9638/gparted2.png

6 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: Shrunk NTFS now without a label or UUID

From the error message in the picture, it would appear that you need to boot into Windows and then run ckhdsk /f /r on the affected drive.

Can you try to boot into Windows?

7 Reply by asatbluesboy (edited by asatbluesboy 2010-01-19 03:23:03)

  • asatbluesboy
  • New member
  • Offline
  • Registered: 2010-01-15
  • Posts: 6

Re: Shrunk NTFS now without a label or UUID

I used the Windows CD and chkdsk tells me my HDD might have undergone unrecoverable damage.

Edit: my chkdsk also doesn't have the "f" opfion, only "p".

8 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: Shrunk NTFS now without a label or UUID

Unfortunately I don't have many more ideas on how to restore your NTFS file system.  sad

If you do not have a backup of your data, you might consider using PhotoRec to try to recover individual files.

9 Reply by asatbluesboy

  • asatbluesboy
  • New member
  • Offline
  • Registered: 2010-01-15
  • Posts: 6

Re: Shrunk NTFS now without a label or UUID

Well, at least I've got a great excuse to buy a new hard drive! wink

Thanks a lot for the support.