FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Wed Aug 04, 2021 00:45



Post new topic Reply to topic  [ 6 posts ] 
"NTFS signature" problem -- ntfs-3g and Windows 7 weirdness 
Author Message

Joined: Tue Apr 26, 2011 00:18
Posts: 4
Post "NTFS signature" problem -- ntfs-3g and Windows 7 weirdness
Hi folks --

I am having a problem with the NTFS-3g version packaged with Debian "squeeze" (this is ntfs-3g 2010.3.6), and some related tools.

I have a number of large NTFS volumes, created on a Windows 7 system, and was initially able to mount these via an eSATA connector to my Linux host, where I did some work with the data. The drives were then moved back to the Windows 7 system, more work was done, and I have found subsequently that they will now not mount on the Linux system.

The initial symptoms are, "mount -t ntfs-3g /dev/sdb1 /mnt" reports that the NTFS signature is not present, and asks if I maybe got the devices backwards (I did not, although this is a good question to ask..). Also, "fdisk -l" and "parted" can read the partition table on the device /dev/sdb, but "cfdisk" complains that "Partition ends in the final partial cylinder".


fdisk reports:
Code:
Disk /dev/sdb: 2000.4 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xc4ecfac4

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1      243202  1953512448    7  HPFS/NTFS


My first line of attack was to put the system back on Windows, and run a file-system check using the standard GUI tools. I don't know if this is equivalent to "chkdisk /f", but in any case, it reported no errors, the file system appeared to be fine.

Back on the Linux side, I tried the "ntfsfix" program (from ntfsprogs, version 2.0.0, packaged for Debian "squeeze"), but it just complained about not being able to mount the partition.

I next tried the "testdisk" program (version 6.11, again packaged for Debian "squeeze"), which reported an inconsistency in the boot sector of the device, but said the back-up boot sector was fine. I used testdisk to overwrite the boot sector with the back-up, but this made things worse -- my "mount" command now gives:

Code:
ntfs_mst_post_read_fixup: magic: 0xca979e8d  size: 1024  usa_ofs: 15493  usa_count: 8747: Invalid argument
Record 0 has no FILE magic (0xca979e8d)
Failed to load $MFT: Input/output error
Failed to mount '/dev/sdb1': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.


I am now in the process of rebuilding (as opposed to overwriting) the boot sector of the device with the testdisk tool, in the hopes that this will allow it to mount.

Of course I'd be grateful for any hints about how to proceed, but ultimately I'd be interested in preventing this from happening again.

Is there a known incompatibility of some kind between Windows 7 and ntfs-3g version 2010.3.6? Was there something else I could have done earlier in the process to mount the partition? Obviously *something* was wrong...


Tue Apr 26, 2011 00:39
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: "NTFS signature" problem -- ntfs-3g and Windows 7 weirdness
Hi,

Quote:
Also, "fdisk -l" and "parted" can read the partition table on the device /dev/sdb, but "cfdisk" complains that "Partition ends in the final partial cylinder".

Sometimes the ntfs file system appears bigger than the containing partition. This may be caused by a wrong formatting or resizing.
Quote:
I am now in the process of rebuilding (as opposed to overwriting) the boot sector of the device with the testdisk tool, in the hopes that this will allow it to mount.

Can you save the original bootsector first for examination ?

The log you posted mentions a problem in reading the MFT which apparently Windows can read. Which CPU are you using for Linux ? Some compilers have difficulties accessing the bootsector data on CPUs which require aligned data.

Quote:
Back on the Linux side, I tried the "ntfsfix" program (from ntfsprogs, version 2.0.0, packaged for Debian "squeeze"), but it just complained about not being able to mount the partition.

The ntfsfix included in the latest ntfs-3g release can fix the bootsector if the file system is bigger than the partition. There is an option "-n" for just testing without actually fixing.
Quote:
Is there a known incompatibility of some kind between Windows 7 and ntfs-3g version 2010.3.6?

I do not know of any incompatibility, but bugs have been found in the 64-bit version of Windows 7.
Quote:
Was there something else I could have done earlier in the process to mount the partition?

At least dump the original bootsector, something appears to be wrong there. If you still can please compress it and post it.
Code:
dd if=/dev/sdb1 of=some-file bs=512 count=1


Regards

Jean-Pierre


Tue Apr 26, 2011 11:13
Profile

Joined: Tue Apr 26, 2011 00:18
Posts: 4
Post Re: "NTFS signature" problem -- ntfs-3g and Windows 7 weirdness
Hi Jean-Pierre, thanks for your reply -- the logistics are actually slightly complicated, because it is in fact my colleague who has the Windows system, and I am the guy with the Linux system.

But, one of your questions is easy to answer --
Quote:
The log you posted mentions a problem in reading the MFT which apparently Windows can read. Which CPU are you using for Linux ? Some compilers have difficulties accessing the bootsector data on CPUs which require aligned data.


The "Unable to read $MFT" message came after I had overwritten the boot sector with the back-up boot sector, via testdisk, and we do not yet know if this can be read by Windows, we haven't moved this disk back to Windows since the testdisk operations completed.

The Linux system has an Intel Xeon E5530 CPU, and is running stock Debian "squeeze" amd64, which is to say, Linux kernel version 2.6.32, and other versions as in the original post.


Quote:
Can you save the original bootsector first for examination ?


On the current device, this info is no longer available, but we believe we have some other disks with the same symptoms, so it should be possible to get one of their boot sectors in a day or so.


Tue Apr 26, 2011 14:54
Profile

Joined: Tue Apr 26, 2011 00:18
Posts: 4
Post Re: "NTFS signature" problem -- ntfs-3g and Windows 7 weirdness
Hi again --

So we have been able to do another iteration, and it turns out that the testdisk-modified disk, with the rebuilt boot sector, could *not* be mounted by Windows, so testdisk is messing something up.

Subsequent to that discovery, my colleague reformatted the drive in Windows, as NTFS, put a bit of data on it, and plugged it back in to the Linux system. It again will not mount, and we are seeing the same initial symptoms we saw before -- ntfs-3g complains:

Code:
NTFS signature is missing.
Failed to mount '/dev/sdb1': Invalid argument
The device '/dev/sdb1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?


We believe we have several drives in this condition, so this is the important problem.

I have dumped the boot sector, a gzip is attached -- this is the output of
Code:
dd if=/dev/sdb1 of=sdb1_512.dd bs=512 count=1
gzip sdb1_512.dd


(I also tried to upload a hex dump of the file, obtained by "od -t x1", but the forum tool didn't accept the ".txt" extension, and when I tried ".dat" it seemed to silently fail. I mention this in case extra attachments show up in some suprising place.)

I look forward to any clues.

It appears that the Debian-packaged ntfs-3g does not include the "ntfsfix" tool, but of course I can always build a newer ntfs-3g from source, if necessary/useful.

Thanks in advance.


Attachments:
File comment: Gzipped data of the problem boot sector
sdb1_512.dd.gz [547 Bytes]
Downloaded 1048 times
Wed Apr 27, 2011 16:05
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: "NTFS signature" problem -- ntfs-3g and Windows 7 weirdness
Hi,

Quote:
I have dumped the boot sector, a gzip is attached -- this is the output of

This is definitely not a valid bootsector. It looks like random bytes.

My guess is that this is an encrypted partition, which of course cannot be read without proper knowledge of the encryption method and keys... This is just a guess, but, if correct, most tools will fail. Can the partition be read on a Windows system totally different (not connected to the same AD, etc.) from the one on which it was formatted ?

Quote:
I also tried to upload a hex dump of the file, obtained by "od -t x1", but the forum tool didn't accept the ".txt" extension

This forum only accepts compressed attachments (zip, gz, rar, bz2...)

Regards

Jean-Pierre


Wed Apr 27, 2011 17:01
Profile

Joined: Tue Apr 26, 2011 00:18
Posts: 4
Post Re: "NTFS signature" problem -- ntfs-3g and Windows 7 weirdness
Quote:
My guess is that this is an encrypted partition...


This appears to be the case -- we did the test you proposed, and indeed, the volume cannot be mounted on an unrelated Windows system either.

The system causing the trouble is a laptop which we knew was configured with an encrypted local disk, but is apparently also configured to automatically encrypt all the filesystems it encounters, even ones that it did not create.

Thanks so much for the clues. We will take this up with our Windows support team.


Thu Apr 28, 2011 15:13
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.