1 Topic by kr (edited by kr 2011-10-25 09:34:35)

  • kr
  • New member
  • Offline
  • Registered: 2011-10-21
  • Posts: 6

Topic: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

Hi good people!

I need some help please:  I tried to install Fedora 15 LXDE from the live disk and it corrupted my sda2 NTFS partition (windows D drive).  The installer failed on trying to rewrite the partition table leaving the (now logical) ntfs smaller than it's original size and unreadable by windows.

Tricky bit (not covered by the post 'tutorial for the NTFS size bug') is the installer rewrote sda2 from a simple primary ntfs partition into an extended partition with sub-partitions (presumably to accommodate the old shrunken ntfs partition + new Linux + new swap).

Is it better in this situation to:
a) Try to get back to the original state (rewrite partition tables so sda2 is a primary partition identical to original config)?
b) Or, is it possible/safer/more advisable to leave sda2 as extended and make the enclosed logical drive work within it's new confines?

I don't mind either way: just want to get the ntfs files back and working in windows with the least risk.



CURRENT STATE:

# fdisk -l -u /dev/sda

Disk /dev/sda: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xf16af16a

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63    81802979    40901458+   7  HPFS/NTFS/exFAT
/dev/sda2        81802980   488375999   203286510    5  Extended
/dev/sda5        81803043   389001215   153599086+   7  HPFS/NTFS/exFAT

Disk /dev/sda: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xf16af16a

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63    81802979    40901458+   7  HPFS/NTFS/exFAT
/dev/sda2        81802980   488375999   203286510    5  Extended
/dev/sda5        81803043   389001215   153599086+   7  HPFS/NTFS/exFAT


# parted /dev/sda unit s print

Model: ATA WDC WD2500BEVE-0 (scsi)
Disk /dev/sda: 488397168s
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start      End         Size        Type      File system  Flags
1      63s        81802979s   81802917s   primary   ntfs         boot
2      81802980s  488375999s  406573020s  extended
5      81803043s  389001215s  307198173s  logical   ntfs

-------


OTHER NOTES:
  1) sda1 has not changed and is fine (lucky as this where windows NT is installed) - no prob there.
  3) During install, I opted to shrink sda2 from the right (so start
for sda2 should not have moved, yes?).
  4) Original config was 2 NTSF primary partitions (sda1 and sda2)
  5) NOTE: above was and is still followed by an unallocated 21168 sector space at end of physical disk (not concerned about reclaiming it right now - just mentioned as probably important in calculating where things should now end ;-).

Thanks in advance for any help!

Kr

2 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

To determine the problem, could you try booting a live CD, like GParted Live and looking at the "Partition --> Information" menu option?

This will tell us if the problem is a discrepancy between file system size and the partition size.

If you see a message indicating something like "ERROR: Current NTFS volume size is bigger than the device size!"
then we will need copies of the Master Boot Record and the NTFS Partition Boot Record.

You can capture the Master Boot Record in a file with the following command:

NOTE:  Be extra careful to type this command in properly, otherwise loss of data could result.

dd if=/dev/sda of=sda-kr.mbr bs=512 count=1

where sda-kr.mbr is the name of the file that will need to be uploaded.


You can capture the NTFS Partition Boot Record in a file with the following command:

NOTE:  Be extra careful to type this command in properly, otherwise loss of data could result.

dd if=/dev/sda of=sda5-kr.pbr bs=512 count=1 skip=81803043

where sda5-kr.pbr is the name of the file that will need to be uploaded.


Then upload these files to a media sharing site, such as mediafire or filefactory, and post the link to these files in this forum post.

3 Reply by kr

  • kr
  • New member
  • Offline
  • Registered: 2011-10-21
  • Posts: 6

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

Hi gedakc:

Yes, I should have said up front the Information on sda5 from gparted shows:

"ERROR: Current NTFS volume size is bigger than the device size!"

I will get the mbr dumps as requested and upload shortly.

ALSO:
Not sure if it's a symptom/side effect of above but I've just checked gparted Information on sda1 and it shows errors in Accounting clusters:

Cluster accounting failed at 1465428(0x165c54):extra cluster in $Bitmap
...
[followed by several similar "Cluster accounting failed at..." messages]
...
Filesystem check failed! Totally 38 cluster accounting mismatches.
ERROR:NTFS is inconsistent. Run chkdisk /f on on Windows then reboot it TWICE!
The useage of the /f parameter is very IMPORTANT! No modification was and will be made to NTFS by this software until it gets repaired.

Unable to read the contents of this file system!
Because of this some oerations may be unavailable
...
[note: the last few lines of the error messages in the Information dialog runs off the bottom of my screen (as the gparted window does not allow resize and there is too much text to display) the bottom of the dialog is off the screen (so I also can't see the close button).]

4 Reply by kr

  • kr
  • New member
  • Offline
  • Registered: 2011-10-21
  • Posts: 6

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

Hi gedakc,

Here are the files you asked me to upload:

http://www.mediafire.com/file/thdlmfx6v … sda-kr.mbr
http://www.mediafire.com/file/v2ibfyn51 … da5-kr.pbr

5 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

Since you were trying to shrink the partition, we will decrease the NTFS volume size to fit within the partition.

The change I have made to the file is from a length of 406,572,956 sectors:
00000020   00 00 00 00  80 00 80 00  9C CF 3B 18  00 00 00 00
To a new length of 307,198,172 sectors:
00000020   00 00 00 00  80 00 80 00  DC 78 4F 12  00 00 00 00

Note:  The NTFS volume size is always 1 sector less than the total number of sectors in the partition table entry because the NTFS backup sector is not considered part of the NTFS volume.

To apply this change:

1) Download the new NTFS PBR: sda5-kr_new.pbr

2) Load the new NTFS PBR on your hard disk.
NOTE:  Be extra careful when entering the commands.  Data loss could result otherwise.

dd if=sda5-kr_new.pbr of=/dev/sda bs=512 count=1 seek=81803043

3) Reboot the computer

4) Check that the file system is recognized in GParted

5) If all seems fine then I would advise booting into Windows and running "chkdsk /f /r" multiple times, until there are no more faults.

6 Reply by kr

  • kr
  • New member
  • Offline
  • Registered: 2011-10-21
  • Posts: 6

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

Thanks greatly for that help with that calculation! 

But just double checking for my own understanding before I go ahead:

If I set the end of sda5 to that new, smaller length of 307,198,172 sectors (less than the original size of the windows D drive that used to be all the way to the end of sda2)... will that cause me to lose all the files that exist(ed) beyond that length?

Reason I ask is:  I don't think the installer (gparted) actually moved any files before it failed because it failed nearly instantly when I clicked the button to start the resize. And then immediately displayed the "ERROR: Current NTFS volume size is bigger than the device size!" message before saying it couldn't continue the install.

Given the above, I was thinking that all gparted had time to do was to (attempt to) re-write the partition table but not actually move any data.  So I wonder, would I not be better to set the end of sda5 to something on the order of 406,573,020 - 1 = 406,573,019 sectors? (I don't know if that's correct.)

Or have I misunderstood and it is just too late to late to save those files?

7 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

My assumption is that the file system was shrunk, and then the partition was shrunk but libparted was unable to inform the kernel of the change.  Hence when the grow to fill partition operation happened next, the ntfs partition was regrown to fill the old partition space.  In this case no files would be moved into the new area.

If you wish, you can also fix this problem by restoring the original partition size.

8 Reply by kr

  • kr
  • New member
  • Offline
  • Registered: 2011-10-21
  • Posts: 6

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

gedakc wrote:

My assumption is that the file system was shrunk, and then the partition was shrunk but libparted was unable to inform the kernel of the change.  Hence when the grow to fill partition operation happened next, the ntfs partition was regrown to fill the old partition space.  In this case no files would be moved into the new area.

If you wish, you can also fix this problem by restoring the original partition size.


Thanks, I'm relatively new to linux and trying to learn as much as I can from this.  Are you able to provide the pbr file and instructions to restore the original partition size? 

Also, so I know for future, what tools can be used to create the pbr file?

9 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

The PBR file has already been modified to shrink the NTFS partition and is available in post #5.

If you wish instead to increase the size of the logical partition, then you can use a command line tool, such as fdisk.  Alternatively you could try testdisk to see if it would restore the larger partition size.

10 Reply by kr (edited by kr 2011-10-25 09:33:32)

  • kr
  • New member
  • Offline
  • Registered: 2011-10-21
  • Posts: 6

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

gedakc wrote:

The PBR file has already been modified to shrink the NTFS partition and is available in post #5.

If you wish instead to increase the size of the logical partition, then you can use a command line tool, such as fdisk.  Alternatively you could try testdisk to see if it would restore the larger partition size.

Hi gedakc,

Yes! Thank you for your all your help and advice:  This is now solved with no data loss! 

In the end tried testdisk and it did it's magic to recover the backup boot record for the second partition though it found it only after a "Deeper Search".  In my case I also had to manually tell it to make the restored sda2 = Primary (which I believe I only got away with as I knew the original configuration, size, etc.).  Followed this up by running chkdsk and it found no errors or problems.

I would not have been able to work out sector lengths and theory to confirm what I was trying to restore without your help and the tutorials on the gparted forum.  So thanks once again!

Still curious though, what tools do you use to create the replacement pbr records?  Or are you using a hex editor, mandrolically?  (I'm trying to up-skill as much as I can from this experience.)

Kr

(You never learn as much as when you inadvertently break something and have to fix it!)

11 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: [SOLVED] NTFS left unreadable after attempted Fedora 15 LXDE install

kr wrote:

Still curious though, what tools do you use to create the replacement pbr records?  Or are you using a hex editor, mandrolically?  (I'm trying to up-skill as much as I can from this experience.)

I manually edit the PBR with hexedit (a hexadecimal editor).  The format of the NTFS Partition Boot Record is outlined in one of the links that can be found at the bottom of the GParted documentation page.