0

I cannot access my Windows drive from a Ubuntu live session because the "disk contains an unclean file system". How do I mount it anyways?

There's only one document I (desperately) need to get from the drive before I can reinstall the OS. Windows won't let me boot because apparently files got corrupted (no idea how, the PC just shut down while I wasn't using it with a download running) and I can't repair the damage with the install media as suggested by below picture taken after trying to boot into Windows. The recovery tool tells me it's beyond repair.

I'm not sure if the damage is because of a virus or a faulty SSD. I think it's the latter.

Right now I'm in the process of creating an image of the whole disk (will post logfile):

ubuntu@ubuntu:/media/ubuntu/TOSHIBA EXT$ sudo ddrescue -d /dev/sda test.img test.logfile

enter image description here

Translation from German (rough): "Recovery. PC/device has to be repaired. An app or OS couldn't be loaded because a required file is missing or contains errors. You have to use recovery tools."

enter image description here

Sda4 is the data partition on the SSD. The one I need access to.

Dmesg (with info on failed mount attempt at the end): http://pastebin.com/dnLYetRu

sudo ntfsfix -d /dev/sda

came up with this

Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

I think I made the mistake to not specify a partition. When I instead use "sda4" (the correct partition) I get this

Mounting volume... ntfs_attr_pread_i: ntfs_pread failed: Input/output error
Failed to read of MFT, mft=160412 count=1 br=-1: Input/output error
Inode is corrupt (43352): Input/output error
FAILED
Attempting to correct errors... 
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
ntfs_attr_pread_i: ntfs_pread failed: Input/output error
Failed to read of MFT, mft=160412 count=1 br=-1: Input/output error
Inode is corrupt (43352): Input/output error
Remount failed: Input/output error

When I tried

sudo mount -t ntfs-3g -o ro,recover /dev/sda4 /mnt

it gave me

ntfs_attr_pread_i: ntfs_pread failed: Input/output error
Failed to read NTFS $Bitmap: Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

I'm beginning to get worried now. I really need this one file. It's a paper I've been working on for quite some time. Could it be my SSD gave up the ghost?

H3R3T1K
  • 2,401
  • You may have a look at my answer here which describes a way to use testdisk tool to recover files. – Videonauth Nov 22 '16 at 13:41
  • 1
    Stop trying "fixing" your partition with ntfsfix or similar tools which might modify it and make the situation even worse. See the answer linked above for the usage of RecuperaBit, a software which I developed. You will recover all files, not just that one that you "desperately need". :) – Andrea Lazzarotto Nov 23 '16 at 13:43

2 Answers2

0

From the terminal run this command to clear the volume dirty flag if the volume can be fixed and mounted: sudo ntfsfix -d /dev/devicename

To find out the device name you can run: lsblk

neofug
  • 634
  • Thanks. Unfortunately it didn't work. Updated my question. – H3R3T1K Nov 22 '16 at 09:13
  • How is this supposed to work? The screenshot clearly shows the MFT is corrupt, ntfsfix can't do anything about it. – Andrea Lazzarotto Nov 23 '16 at 13:44
  • Hey Andrea. I didn't find any way to contact you personally. I wanted to ask you to delete this post as it seems that my data cannot be recovered. ddrescue created an image only 850MB in size so it seems that the 240GB SSD is fubar. It seems further attempts to get the file I was looking for with photorec is not worth the time. – H3R3T1K Nov 26 '16 at 11:12
0

sudo mount -t ntfs-3g -o ro,recover /dev/sdxx /mnt

or, for older versions

sudo mount -t ntfs-3g -o ro,force /dev/sdxx /mnt

  • recover or force forces the mount, disregarding the state of the file system
  • ro mounts the file system read-only, which is both more likely to succeed and strongly recommended if the file system has not been unmounted cleanly in Windows.
AlexP
  • 10,197