Re: [gentoo-user] [OT]: Powering off Windows XP, crashing NTFS with a Live CD.

[Mick]

On Sunday 03 Jul 2011 11:31:14 Alan Mackenzie wrote:
> Hi, Gentoo.
>
> There's been a cock and bull story on comp.os.linux.setup and I'm
> wondering about some of the details.  Mainly, I'd like some education,
> please!
>
> The story, in essence:
> (i) Windows XP is running, with a normal NTFS filesystem(s).
> (ii) Power off without a proper shutdown.

Not particularly wise on NTFS.  Upon next boot up it'll try to run chkdsk, 
which you *must* not interrupt.  99% of the time it'll happily continue into a 
normal boot.


> (iii) Start again with a Linux Live CD (distribution not specified).
> (iv) This corrupts the NTFS journal(s).

No it does not.  The NTFS journals (or the MSWindows partition and its NTFS) 
have nothing to do with a LiveCD booting and running exclusively in RAM.
 

> (v) It is now difficult to start Windows.

It would be without running chkdsk first, but you do not explain what the 
difficulty amounts to ... error messages 'n all.


> OK.  My questions:
> o - Do live CDs actually mount filesystems on HDDs?

Only when you ask them to.

To mount NTFS you would these days use ntfs-3g:

  ntfs-3g /dev/sda1 /mnt/windows

or
  mount -t ntfs-3g /dev/sda1 /mnt/windows


> o - If so, would the start-up actually write anything to a partition?

Nope.  The start-up of a LiveCD happens in RAM.


> o - Would this actually try to mount an NTFS filesystem?

Linux LiveCDs will not typically mount anything whatsoever.  They are by 
default respectful of the devices on the system.  I don't know if this 
convention has changed recently, or if there are particular LiveCDs created 
with different mounting conventions for the sake of MSWindows users - who 
would not otherwise know how to mount a partition from Linux.

Can't recall what MSWindows based LiveCDs do (e.g. BartsPE).


> o - Given that Linux's NTFS doesn't (?yet) do journaling (see kernel
>   docs), would the driver not detect the presence of a journal and leave
>   well alone?

The Kernel's NTFS driver is not safe for writing to a NTFS partition.  It is 
mostly a read only driver (check the Help page of the module, next time you're 
rolling up a new kernel).  If you mount a NTFS partition using the kernel 
driver and then try to write to it in a way that it requires a change to the 
fs journals then you will invariably corrupt the NTFS fs.  The working 
solution for NTFS partitions these days is the ntfs-3g userspace application 
as mentioned above.


CONCLUSION:

To recover a MSWindows partition which did not shutdown cleanly, boot into 
MSWindows and let it run through the chkdsk sequence.  When it finishes all 
should be good.

If the MSWindows journal is corrupted, then you could try running 

  ntfsfix /dev/sda1

to force it to run chkdsk next time it boots.

When the MSWindows OS boots next time it will go through the chkdsk routine.  
If that does not fix it either, then the journalling problem is probably 
unrecoverable.  In that case ntfs-3g won't work.  Instead you could try 
mounting the partition using the Linux kernel driver (read only of course) and 
if it succeeds recover the files you need.

If the Linux kernel NTFS driver does not work, then we are into a full blown 
recovery exercise.  You could try testdisk and photorec.  There are also a 
bunch of MSWindows solutions too to recover NTFS partitions/files, but I'm not 
sure if any of these are open source.

HTH.
-- 
Regards,
Mick