FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Sat Jul 24, 2021 07:53



Post new topic Reply to topic  [ 27 posts ]  Go to page 1, 2  Next
endless loop in libntfs!!! 
Author Message

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post endless loop in libntfs!!!
Hi,
i've got a disk with corrupted NTFS filesystem (guess the MFT is broken). So far I didn't managed to fix it, because all linux utils (ntfs*,testdisk,...) fail because libntfs-3g has a sever bug.
The problem is, that there is the possibility of getting into an endless recursion loop.
Here is the output of nfsck (with debug flag set) as an example.
The forum doesn't allow txt or log files as attachment, so i posted it here
http://pastebin.com/XKDTbKdS

The important part is the following:
Code:
ntfs_attr_lookup(): Entering for attribute type 0x80
ntfs_external_attr_find(): Entering for inode 0, attribute type 0x80.
ntfs_extent_inode_open(): Opening extent inode 18 (base mft record 0).
  ntfs_mft_record_read(): Entering for inode 18
   ntfs_mft_records_read(): inode 18
   ntfs_attr_mst_pread(): Entering for inode 0x0, attr type 0x80, pos 0x4800.
   ntfs_attr_pread(): Entering for inode 0 attr 0x80 pos 18432 count 1024
    ntfs_attr_find_vcn(): Entering for inode 0x0, attr 0x80, vcn 4
    ntfs_attr_map_runlist(): Entering for inode 0x0, attr 0x80, vcn 0x4.
    ntfs_attr_lookup(): Entering for attribute type 0x80
    [...]


As you can see after some function calls the function ntfs_attr_lookup() gets called again. From there on the whole process starts again until the backtrace is about 80k lines long :) and libntfs seg'faults.

I tried it with the latest stable version 2011.4.12 and with the latest version build from git, but the problem seems to exists since along time:
Code:
http://www.gentooforum.de/artikel/17283/segmentation-fault-ntfs-3g.html


Hopefully this problem can be fixed. If nothing can be done to the broken disk ok, but a seg'fault is definitely not the right answer to an unexpected error.


Fri Jul 29, 2011 21:29
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
The forum doesn't allow txt or log files as attachment, so i posted it here

Actually it does allow, provided the attachments are compressed (gzip, bzip2, zip, ...). Anyway I have collected your trace output.
Code:
NTFS-fs DEBUG: Dumping runlist (values in hex):
VCN              LCN               Run length
0                786432            4
4                LCN_RL_NOT_MAPPED 42724
42728            LCN_ENOENT        0                (runlist end)

This is a big corruption : your MFT is only 4 clusters long (only the 16 metadata files). This is probably the result of an attempt to repair. I can just hope that the MFT was not relocated and some part of it is recoverable at cluster 786432.
Code:
NTFS-fs DEBUG: Dumping runlist (values in hex):
VCN              LCN               Run length
0                786431            1
1                794624            1

This shows that the first part of the MFT did not go beyond cluster 794623.
Quote:
I tried it with the latest stable version 2011.4.12 and with the latest version build from git, but the problem seems to exists since along time:

Similar indeed, (my ability to read German is limited, but I can get the idea). In this example the partition was encrypted, was yours also encrypted ?
Quote:
Hopefully this problem can be fixed. If nothing can be done to the broken disk ok, but a seg'fault is definitely not the right answer to an unexpected error.

First, please do not wipe out the partition until the issue is solved or declared not solvable.

If you have some spare space elsewhere, save a full image of the partition, but do not use a tool which relies on the ntfs metadata to determine what clusters are in use, as the allocation tables have probably also been wiped out. My best advice is to simply use dd :
Code:
dd if=PARTITION of=partition.copy bs=512 count=83888056


For a first attempt to recover your data, maybe you can make a copy of a possible MFT segment (32768 files out of 196608) :
Code:
dd if=PARTITION of=mft.copy bs=4096 skip=786432 count=8192

Also copy the MFT mirror, which hopefully contains the full location of the MFT (unless wiped out) :
Code:
dd if=PARTITION of=mftmirror.copy bs=4096 skip=9769524 count=4

Compress the results (34MB), and send them to me as an attachment to a PM (or to a public server if it compresses poorly). They hopefully contain file names and locations, but could also contain confidential data, so have a look at them first.

Now, my main interest is to prevent this from happening again. Do you have an idea of the circumstances where the corruption occurred ?

Regards

Jean-Pierre

* edit *

From the forum you quoted :
Quote:
Gestern habe ich als letzten Zugriff ein paar Dateien (ca. 2GB) auf die Festplatte kopiert und dann unter Windows normal via Free OTFE geunmountet. Schien alles problemlos zu funktionieren.
Doch als ich dann heute nochmal auf meine externe Festplatte zugreifen wollte, meldete Windows, nach dem mappen der verschlüsselten Partition auf einen Laufwerksbuchstaben

I tend to understand that 2GB were written by Windows and the partition unmounted normally (what is OTFE ?) and the next day the data could not be read by Windows. Is this correct ? No mention of ntfs-3g ?


Sat Jul 30, 2011 10:58
Profile

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post Re: endless loop in libntfs!!!
Hi jpa,

Quote:
Do you have an idea of the circumstances where the corruption occurred ?

No, actually not, the system is a WinXP+Archlinux System with Grub2 (burg) bootloader. After using WinXP one evening I turned the PC off (normal shutdown, no errors). The next day Windows refused to boot, the Linux system and the data partition are perfectly ok, just the Windows partition is broken.
Immediately I plugged the HDD into another Linux PC and grabbed a dd image. I did all my testing with a copy of this dd image. The original partition got 'destroyed' by a chkdsk call from the Windows Recovery disc :) Now the partition is working again, but empty.

I'm pretty sure that ntfs-3g doesn't cause the corruption, except when grub2 does use this library too, then it might be possible. But i think grub uses its own ntfs drivers.

Quote:
First, please do not wipe out the partition until the issue is solved or declared not solvable.

I keep the dd images save. I guess it is not an hardware problem, since the other partitions are ok and the smartmontools don't show any problems.

Quote:
In this example the partition was encrypted, was yours also encrypted ?

No encryption was used.

Quote:
Compress the results (34MB), and send them to me as an attachment to a PM (or to a public server if it compresses poorly). They hopefully contain file names and locations, but could also contain confidential data, so have a look at them first.

I'll PM you the file (~2.1MB), 'strings' doesn't tell any extremely sensitive data, but i nevertheless don't want to attach it here. I don't know if you gave me the correct sector number for the MFT Mirror, since the file is full of some python code. But maybe this is exactly the problem.

By contrast the mft.copy contains many filenames etc. I can restore very many files with filename using scrounge-ntfs. But i cannot find a MFT to restore the directory structure. The program exits with something like "invalid mft record" or "invalid mft. no data attribute".

The data on the hdd is not so terrible important, there are only some files i'd like to get back if possible. And i'm pretty sure I can restore them with photorec or scrounge-ntfs.

Quote:
I tend to understand that 2GB were written by Windows and the partition unmounted normally (what is OTFE ?) and the next day the data could not be read by Windows. Is this correct ? No mention of ntfs-3g ?

Yes correct, FreeOTFE (freeotfe.org) is an on-the-fly encryption program for windows, i do not use it.
Again, ntfs-3g it not responsible for the corruption, but it seg'faults when mounting the already corrupted partition.

Thanks for your help.

Regards,
buergi


Sat Jul 30, 2011 12:03
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi again,

Quote:
I don't know if you gave me the correct sector number for the MFT Mirror

The log you sent says "MFTMirr LCN = 9769524", but who knows...
Quote:
I keep the dd images save.
[...]
The data on the hdd is not so terrible important, there are only some files i'd like to get back if possible. And i'm pretty sure I can restore them with photorec or scrounge-ntfs.

So, what would be really useful, is I get a copy of the metadata (from the saved image) :
Code:
#  SAVEDPARTITION is your dd copy (read-only, you can chmod 444 for safety)
# replace -tm by -m if you have an old ntfsclone
ntfsclone -tm -O metadata SAVEDPARTITION
tar -Scvzf metadata.tgz metadata

With that information, I should be able to prevent ntfs-3g from looping, and hopefully to understand what happened and possibly to repair your partition.

Regards

Jean-Pierre


Sat Jul 30, 2011 12:36
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
So, what would be really useful, is I get a copy of the metadata (from the saved image)

Please disregard that for now : as the MFT is corrupt, you will not be able to get useful information this way. The MFT mirror has the same corrupt information.

I have analyzed the data you sent, and I can locate about 5000 undeleted files or directories which were described in the first segment of the MFT. However I have no clue about where the other segments of the MFT are. There is a possibility that the location of the old table is described in cluster 3816728, as there is an MFT extent there. This information is needed because files are accessed through directories which are missing.

I suggest you send me the said cluster. If it is usable, I will need another cluster to get the location, if not I will have to stop there.
Code:
dd if=PARTITION of=mft-extent.copy skip=3816728 bs=4096 count=1

I will of course fix the loop in the library, but that will not help you : mounting will be rejected as a consequence of the corruption (it is not the job of the library to recover from an MFT corruption).

Regards

Jean-Pierre

** edit **

I have located the missing parts (but I do not have them). Recovery should be possible. Contents of cluster 3816728 would really be useful. More later.


Sun Jul 31, 2011 10:40
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

First a description of the corruption : the MFT is very fragmented, and most of it had to be put into an extent. Only 16 entries are in the base record, and the remaining parts are described in entries 16, 17, 18, but to know where they are, you have to read them to know where they are.... hence the infinite recursion.

With which Windows version did this happen ?

I cannot fix that in tools relying on knowing where the data is to read them. Apparently Windows is no better...

However I can fix your specific partition, by putting 32 entries in the main MFT entry.
These are the required patches to the partition (first the location, then the contents, all in hex). I am not fully sure, because I had to make assumptions, so be careful, do not overwrite your backup.

c0000120 3108
c00000f8 0700
c0004878 32 f81f 08000c 22 b813 f82f
c0004848 08000000

The attached file contains a binary patcher (source and binary), and the patches to apply. It has to be applied to a partition image, not to the actual partition.

You would be helpful to other people having the issue, by sending a metadata image, so that I can design a specific tool to fix the corruption. You will have to apply the patches before making the metadata image.

Regards

Jean-Pierre

** edit **

The patcher I attached was buggy in 32-bit mode, use the updated loop2.tar.gz sorry about it.


Attachments:
loop2.tar.gz [2.74 KiB]
Downloaded 1292 times
loop.tar.gz [2.74 KiB]
Downloaded 1330 times
Mon Aug 01, 2011 11:24
Profile

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post Re: endless loop in libntfs!!!
Hey Jean-Pierre,

thanks for all the help. Sorry for not posting for such a long time, i was not at home over the weekend.

Quote:
Please disregard that for now : as the MFT is corrupt, you will not be able to get useful information this way. The MFT mirror has the same corrupt information.

Exactly ntfsclone does also seg'fault. I'll try it again after applying your patch.

Quote:
Contents of cluster 3816728 would really be useful

I post the cluster here, since it's almost completely zero :)
Code:
echo "QlpoOTFBWSZTWVaT4cQAAFf6yP4QcBBAAEAAEAAQAEAAQAAAKCAAUK \ ZMTIMjBEpNBkDI3tbzjbmOtH5Xmwvl8ZhUVwMFLxZAQxQhQbxDrOM76g9z6l \ YcVV/F3JFOFCQVpPhxAA==" | base64 -d | bunzip2 | tee mft-extend.copy | md5sum

For reference: I used the following dd command
Code:
> sudo dd if=system.dd of=mft-extent.copy skip=3816728 bs=4096 count=1
> md5sum mft-extent.copy
a82e8be72367ada304c7f6cdfc0cba24  mft-extent.copy


Quote:
You would be helpful to other people having the issue, by sending a metadata image, so that I can design a specific tool to fix the corruption.

Ok i did so, created new copy of the image, patched it. BTW here is a patch for your patcher :) The version you send me does not work.
Code:
diff b/bpatch.c a/bpatch.c
18c18
<       in = fopen64(argv[2],"r");
---
>       in = fopen(argv[2],"r");
21c21
<          out = fopen(argv[1],"r+b");
---
>          out = fopen64(argv[1],"r+b");
58c58
<          else fprintf(stderr,"Could not open %s\n",argv[2]);
---
>          else fprintf(stderr,"Could not open %s\n",argv[1]);


Then the patcher worked but the patched image is also not working:
Code:
> ntfsclone -tm -o ~/metadata system_patched.dd
ntfsclone v2011.4.12 (libntfs-3g)
ERROR(22): Opening 'system_patched.dd' as NTFS failed: Invalid argument
Apparently device 'system_patched.dd' doesn't have a valid NTFS. Maybe you selected
the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)?
> ntfsck system_patched.dd
ntfs_pread(): pos 0, count 512
Boot sector: Bad jump.
Boot sector: Bad NTFS magic.
Boot sector: Bytes per sector is not a multiple of 512.
SectorSize = 0x13b8
SectorSizeBits = 3
SectorsPerCluster = 0xf8
sectors_per_cluster (248) is not a power of 2.
verify_mft_preliminary(): Entering verify_mft_preliminary().
ntfs_pread(): pos 6110640543175968832, count 1024
Failed to read file record at offset 6110640543175968832 (0x54cd5b32ce1a8840).
Loading $MFT runlist failed. Trying $MFTMirr.
ntfs_pread(): pos 0, count 1024
file record corrupted at offset 0 (0x0).
Loading $MFTMirr runlist failed too. Aborting.
ntfs_pread(): pos 0, count 512
Beginning bootsector check.
Checking OEMid, NTFS signature.
NTFS signature is missing.


Quote:
With which Windows version did this happen ?

Windows XP Home, i'm pretty sure it was SP3 but it might also have been SP2.

Thanks again Jean-Pierre for all your effort.

Regards
buergi


Mon Aug 01, 2011 13:28
Profile

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post Re: endless loop in libntfs!!!
Ah ok I saw your new version and i realised i didn't fix the seek command.
Perhaps thats why it doesn't worked. I'll try it again. Just a view minutes (takes some time to copy 40GB) :)

(I'd loved to post this earlier, but the forum software didn't allow me to :( Wouldn't a captcha be the better spam prevention than such a long waiting time?)


Mon Aug 01, 2011 13:40
Profile

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post Re: endless loop in libntfs!!!
Ok this time it worked better, but ntfs* still gives an input/output error. I appended the quiet long output of ntfsck. ntfsclone doesn't work either, same error. Hopefully the output is useful for you.


Attachments:
File comment: Output of ntfsclone and ntfsck after applying the patch by jba.
post_patch_ntfsck.log.gz [4.57 KiB]
Downloaded 1097 times
Mon Aug 01, 2011 14:15
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,
Quote:
ntfsclone doesn't work either, same error. Hopefully the output is useful for you

It is indeed, mounting went further, and it failed because I forgot to patch the MFT mirror,
just add the following to the patch file :
Code:
* increase size of first chunk of mftmirr
c0000520 3108
c00004f8 0700

No need to copy the image again, just apply the patches to the current copy.

And no need to do the ntfsck on Linux : it does not repair anything useful.
Just try ntfsclone to get an image as close as possible to the original.

Regards

Jean-Pierre


Mon Aug 01, 2011 14:33
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi again,

Quote:
just add the following to the patch file :

Sorry, my fault, wrong location.
Code:
* increase size of first chunk of mftmirr
e83c2120 3108
e83c20f8 0700
* revert the wrong patch
c0000520 0000
c00004f8 5400


Quote:
Wouldn't a captcha be the better spam prevention than such a long waiting time?

It surely would, but I cannot do that : I rely on Tuxera which relies on an external provider.

jean-Pierre


Mon Aug 01, 2011 14:46
Profile

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post Re: endless loop in libntfs!!!
Hm so i patched now this
Code:
> ./bpatch system_patched.dd ./loop2.patch
patching at 0xe83c2120
patching at 0xe83c20f8

where loop2.patch is
Code:
* increase size of first chunk of mftmirr
e83c2120 3108
e83c20f8 0700

I left the "revert wrong patch" out, because i hadn't applied it before.

But the output of the command stays exactly the same. Nothing changed, i compared it to the output from before.
Did I made something wrong or could it be that this isn't the correct position too?


Mon Aug 01, 2011 15:02
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
could it be that this isn't the correct position too?

Computing again, I now find a different location :
Code:
951234120 3108
9512340f8 0700

My brain must be wearing out, so do the check 9769524 (the cluster I requested earlier), times 4096 and add 0x120 or 0xf8.
I cannot revert the wrong patch any more, so first try with only this patch applied, and if you get a better result, make a new copy from the original.

Sorry for the repeated errors.

Jean-Pierre


Mon Aug 01, 2011 15:23
Profile

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post Re: endless loop in libntfs!!!
Yeaaaa man you did it!! Congratulations, i'm very impressed, how did you do that! Now i can even mount the file again (read-only of course)!

I reverted the old patch by grabbing the corresponding bytes from the original image.
Code:
* increase size of first chunk of mftmirr
951234120 3108
9512340f8 0700
* revert the wrong patch
e83c2120 1CC5
e83c20f8 3400


This is absolutely awesome. Can you tell me how you found the right bytes to change, seems incredible to me as a novice. Especially because you had only such a small part of the whole diskddump image.

Now I got the metadata, I'm just watching over the content. What should i do than with it? Is it ok when i just PM it to you, or do you think there are others who like to have it. I mean there is no incredible sensitiv information in it as far as I saw, but i'd nevertheless prefer to not post it here directly.


Mon Aug 01, 2011 15:59
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
Yeaaaa man you did it!! Congratulations, i'm very impressed, how did you do that! Now i can even mount the file again (read-only of course)!

Good news !
Quote:
This is absolutely awesome. Can you tell me how you found the right bytes to change, seems incredible to me as a novice. Especially because you had only such a small part of the whole diskddump image.

I had to format a new image of the same size, then plug your data into it... and guess the missing important information. Guessing where the missing data could be was the trickiest part. From that I could identify the source of the problem, and fix it (well, after several tries).
Quote:
Now I got the metadata, I'm just watching over the content. What should i do than with it?

It is a sparse file (150-200MB, with apparent size 40GB), so first "tar" it with option -S, and compress (xz is ok).
Quote:
Is it ok when i just PM it to you, or do you think there are others who like to have it.

It must be too big to be put as an attachment. Put it on a public server and send the URL as a PM. If you agree, I will forward to experts at Tuxera, they must be interested. Apparently this bug was not known at Tuxera either. You may delete the file after a few days.

Even, if you can now mount the image, you should format a new partition and copy the files : the image is highly fragmented and the bug is likely to happen again.

Regards

Jean-Pierre


Mon Aug 01, 2011 16:23
Profile

Joined: Fri Jul 29, 2011 21:07
Posts: 8
Post Re: endless loop in libntfs!!!
Quote:
I had to format a new image of the same size, then plug your data into it... and guess the missing important information. Guessing where the missing data could be was the trickiest part. From that I could identify the source of the problem, and fix it (well, after several tries).

Really incredible, I guessed that the problem were just a few bytes, but guessing x out of 42950689280 Bytes it seemed very unlikely to be to win :)
It's really incredible that there are people like you who but so much time and effort in fixing other peoples problems. Thanks again million times!

Quote:
It is a sparse file (150-200MB, with apparent size 40GB), so first "tar" it with option -S, and compress (xz is ok).

Yeah I guessed to be a spare file, since it was 41 GB on my 30 GB home drive. But du shows the correct size.
I'll PM it to you in a minute.

Quote:
Even, if you can now mount the image, you should format a new partition and copy the files : the image is highly fragmented and the bug is likely to happen again.

Good you say so, i would have just dd it back onto the drive :) But I'll follow the masters advice and copy it there filewise :)
But anyway I used this chance to scrap this old machine and get a new one. Regarding the speed of this old thing I'm sure there are still some gears or tubes working inside it :)

Regards,
buergi


Mon Aug 01, 2011 16:48
Profile

Joined: Thu Dec 01, 2011 18:21
Posts: 6
Post Re: endless loop in libntfs!!!
Hi,

I also had this problem. A few days ago, I booted into Windows (Vista home premium, 32-bit) and started a defrag (jkdefrag). I let that go for a while, then decided I wanted back on Linux (Gentoo), so I hit control+c (the manual says you can do this safely, several times). I rebooted and tried to mount my ntfs partition in Linux, but it instantly segfaulted. It wouldn't boot back into Windows either. So, I tried emerging ntfs-3g with debugging symbols, even setting the debug use flag. It seems to be doing the same thing described in post #1. Is there some program to fix it? Or should I attach the first few lines of a backtrace or something?

Thanks for any help on this,
KJ4UFX
{.i doi .tcikoritys. mi cuxna ba'e do}


Thu Dec 01, 2011 19:20
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
I also had this problem. A few days ago, I booted into Windows (Vista home premium, 32-bit) and started a defrag (jkdefrag).
[...]
It seems to be doing the same thing described in post #1. Is there some program to fix it?

Hmm, interesting. So far we have never been able to find the culprit. Now we have at least a suspect.

This a a very bad corruption, but normally no data should be lost. I have inserted a specific detection and repair procedure in ntfsfix, based on the single case I know. You must use a recent ntfsfix, such as the one in http://tuxera.com/opensource/ntfs-3g_nt ... 0.9-RC.tgz AFAIK no other tool can do it.

Above all, do not try chkdsk, it will delete everything.

First do a test run :
Code:
ntfsfix -n unmounted-partition

and post the output, so that I can check the self-referenced entry is detected in the file table.

You might want to make a backup of your partition before starting a real repair, and only "dd" can do it. I might also be interested in some parts if ntfsfix fails.

Regards

Jean-Pierre


Thu Dec 01, 2011 22:31
Profile

Joined: Thu Dec 01, 2011 18:21
Posts: 6
Post Re: endless loop in libntfs!!!
Hi,

I've got dd on it right now, will check on ntfsfix when that's done (though it could take a while, it's a 230gb partition). Anyway, will reply again with teh results of ntfsfix.

Thanks again,
KJ4UFX
{.i doi .tcikoritys. mi cuxna ba'e do}


Thu Dec 01, 2011 23:49
Profile

Joined: Thu Dec 01, 2011 18:21
Posts: 6
Post Re: endless loop in libntfs!!!
Hi,

Thanks for that! After dd finished, I ran
ntfsfix /dev/sda3
...Forgot to add the -n. Anyway, here's its output
Mounting volume... MFT is corrupt, cannot read its unmapped extent record 22
Note : chkdsk cannot fix this, try ntfsfix
Inode is corrupt (0): Input/output error
Failed to load runlist for $MFT/$DATA.
highest_vcn = 0x3, last_vcn - 1 = 0x7628f
Failed to load $MFT: Input/output error
FAILED
Attempting to correct errors... MFT is corrupt, cannot read its unmapped extent record 22
Note : chkdsk cannot fix this, try ntfsfix
Inode is corrupt (0): Input/output error
Failed to load runlist for $MFT/$DATA.
highest_vcn = 0x3, last_vcn - 1 = 0x7628f
Failed to load $MFT: Input/output error
FAILED
Failed to startup volume: Input/output error
Checking for self-located MFT segment... FOUND
Fixing the self-located MFT segment... OK

Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Going to empty the journal ($LogFile)... OK
NTFS volume version is 3.1.
NTFS partition /dev/sda3 was processed successfully.

Woot!!! SO, I mounted it, and everything seems to be here. I'll prob copy all this off somewhere and make an ext4 partition or something, but it works! You rock!

Thanks,
KJ4UFX
{.i doi .tcikoritys. mi cuxna ba'e do}


Fri Dec 02, 2011 03:53
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
Woot!!! SO, I mounted it, and everything seems to be here

Good news !
Quote:
I'll prob copy all this off somewhere and make an ext4 partition or something, but it works!

I indeed recommend you save all your files and reformat the partition, it is probably fragmented at an unreasonable level. If you mount on Windows, a chkdsk will start automatically as requested by ntfsfix (should not be a problem).

Before you do that, I am interested in getting some data to feed into my validation suite. This has to be done in two steps, first the boot sector, then the beginning of the file table (whose location is described in the boot sector). There will be no user data in them (you may post them as a PM, though), and you will have to compress them to post them to the forum.

To get and compress the boot sector (either from the backup or from the fixed device)
Quote:
dd if=/dev/xxx of=bootsector bs=512 count=1
gzip bootsector


Regards

Jean-Pierre


Fri Dec 02, 2011 09:28
Profile

Joined: Thu Dec 01, 2011 18:21
Posts: 6
Post Re: endless loop in libntfs!!!
Hi,

Happy to help! Here's the boot sector.

HTH,
KJ4UFX
{.i doi .tcikoritys. mi cuxna ba'e do}


Attachments:
File comment: My boot sector
bootsector.gz [507 Bytes]
Downloaded 1108 times
Sat Dec 03, 2011 01:16
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
Happy to help! Here's the boot sector.

Well, not exactly. This is the boot sector of your disk, but I need the boot sector of the ntfs partition (apparently this is sda3), I should have been more clear about it.
Code:
dd if=/dev/sda3 of=bootsector bs=512 count=1
gzip bootsector


Regards

Jean-Pierre


Sat Dec 03, 2011 10:22
Profile

Joined: Thu Dec 01, 2011 18:21
Posts: 6
Post Re: endless loop in libntfs!!!
Hi,

Lol, sorry about that, I should've known which one. Here ya go :)

HTH,
KJ4UFX
{.i doi .tcikoritys. mi cuxna ba'e do}


Attachments:
File comment: The correct boot sector
sda3_bootsector.gz [481 Bytes]
Downloaded 1116 times
Sat Dec 03, 2011 20:52
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: endless loop in libntfs!!!
Hi,

Quote:
Lol, sorry about that, I should've known which one. Here ya go :)

Thanks,

so the MFT starts at cluster 786432, and to get the first 32 entries (metadata), you have to extract 8 clusters. The corruption is expected roughly in the middle, and there should be no user data there.
Code:
dd if=BACKUP of=mft.copy bs=4096 skip=786432 count=8

I prefer of course the data from your backup, with the unfixed corruption in it.

Regards

Jean-Pierre


Sat Dec 03, 2011 22:25
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 27 posts ]  Go to page 1, 2  Next


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.