Hard disc repartitioning and recovery with Knoppix

[Aloone_Jonez]

My computer is fucked up, I was just doing college work a few days ago and my hard drive made some crazy noise, I just thought there was some shit caught in the fan so I ignored it. I shut it down, came back later and tried to boot and it refused, the BIOS displayed "IDE ERROR" so I booted from Knoppix, then I looked at my Windows ntfs paritition and it said "BAD SUPERBLOCK"

Just a few questions:

What the fuck is the SUPERBLOCK?

Is the hard drive fucked up?

Can I recover the data on the ntfs partition using Knoppix? I tried fschk but it won't work for ntfs.

If ever I manage to recover the data, how can I burn it to a CD using Knoppix when I only have one CD drive?

I also want to resize an FAT32 partition on the slave drive but I need to deframent it first, is there a way of doing this in Knoppix? I tried defrag but it won't work on FAT32.

By the way my Windows hard drive has XP sp2 and I'm using Knoppix 3.4, yes I know I need to upgrade Knoppix.

[noob]

i find knoppix std is a good recovery tool. reads stuff windows cant and can recover data well. i nevber use ntfs because of that problem. get a new hdd and put that imn as master, old one as slave and use knoppix to copy the whole drive over. then shut it down, remove the secondary drive, the fubared one and put in the xp cd. run the recovery console and re-write the boot sector. then try and boot it up. xp *MAY* bsod cause of the different hdd. if it does, run the xp install from the cd and go to the second point qhere ity asks you is you want to repair xp. it MAY work, or may require a full re-insyall of everything.
hope it works.

[Aloone_Jonez]

i find knoppix std is a good recovery tool. reads stuff windows cant and can recover data well. i nevber use ntfs because of that problem.

I haven't had a problem reading the ntfs partition before in Knoppix and using cative I can both read and write to it. I use ntfs because it's better than FAT32 because it's journaled, for example if the system isn't shut down properly it's less likely to fuck up.

get a new hdd and put that imn as master, old one as slave and use knoppix to copy the whole drive over. then shut it down, remove the secondary drive, the fubared one and put in the xp cd.

I have another hard disc, it's currently set up as a slave, it has Vector Linux and the FAT32 partition I was talking about resizing. Vector Linux won't boot at the moment because X is currenty using a mode that won't work with my new flat screen monitor, Knoppix and Windows didn't have a problem with it, but anyway I can't be fucked to fix this at the moment as I'm thinking of trying a diferent distro once (or if I manage to) I've recovered my data on the ntfs drive.

run the recovery console and re-write the boot sector.

Hang on it's the SUPERBLOCK that's fucked up not the boot sector, or are they the same thing?

then try and boot it up. xp *MAY* bsod cause of the different hdd. if it does, run the xp install from the cd and go to the second point qhere ity asks you is you want to repair xp. it MAY work, or may require a full re-insyall of everything.
hope it works.

I'm not bothered about getting Windows working, all I want to do at the moment is recover my data.

[piratePenguin]

According to this:

The Superblock contains a description of the basic size and shape of this file system.

This page describes how to 'fix a corrupted magic number in the file system superblock', but it's for JFS and GNU/Linux. It also says:

If the superblock of a file system is damaged, the file system cannot be accessed. Most damage to the superblock cannot be repaired.

I dunno if that page can help in your situation, but the 'od' part is quite interesting if you ask me. See if your FS has the correct magic number. You might be able to fix it then...

[noob]

i meant copy it all over to another drive and the re-write the boot sector wo sindows will boot. then u can get the data you want off it. and i have had most probelms with ntfs and bad shutdowns. fat 32 gets errors, but are easier to fix.

[piratePenguin]

See if your FS has the correct magic number. You might be able to fix it then...

From what I can see, there is a primary superblock and a secondary superblock (see steps 4 and 5).

Assuming the NTFS partition is somewhere on /dev/hda (primary master), in Knoppix run:
# od -x -N 64 /dev/hda +0x1000
and then:
# od -x -N 64 /dev/hda +0x1f000

AFAIK, the output from those two commands should be precisely the same (is for me anyhow).
Your superblock is aparantly fucked, so copying the secondary superblock to the primary superblock might work (read steps 5 and 6), but I honestly have no clue.

[Lead Head]

i heared that a USB to IDE adaptor can resolve some prblems with a computers built in IDE,
http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=1225711&Tab=11&NoMapp=0

[Aloone_Jonez]

piratePenguin,
The output from the two commands you suyggested is exactly the same so does this mean the superblock is ok after all?

I may have been too quick to draw a conclusion I didn't read the error message properly, when I tried to mount hda1 it displayed:

mount: wrong fs type, bad option, bad superblock on /dev/hda1

I just guessed the later but do you think something else could be wrong with the drive or file system?

[KernelPanic]

On *nix filesystems there tends to be one or more backup compies of the superblock.
Unfortunately I do not know if Windows does the same thing. Perhaps someone like muzzy does.


Also, get your other data off that disk ASAP before it dies for good.

[piratePenguin]

piratePenguin,
The output from the two commands you suyggested is exactly the same so does this mean the superblock is ok after all?

TBH, I have not got a clue. Different filesystems... But I was expecting them to be slightly different somewhere and then you could replace the primary with the secondary (assuming they do exist on NTFS, which is probably a very stupid assumption), but that mustn't be it.

I may have been too quick to draw a conclusion I didn't read the error message properly, when I tried to mount hda1 it displayed:

mount: wrong fs type, bad option, bad superblock on /dev/hda1

First of all, run:
# fdisk -l /dev/hda
and make sure the output from that is alright (there's a hda1 partition of type NTFS or whatever). I think the NTFS module has to be loaded (or built inside the kernel itself) to get an error like that, but I'd just make sure it's there ('lsmod').
Then make sure your using the right arguments to mount ('-t ntfs /dev/hda1 /mnt' (and '-o ro' for read-only if you like but it shouldn't matter)).

Can you still boot into Windows on that disk?

I just guessed the later but do you think something else could be wrong with the drive or file system?

Well, I've seen that error message _alot_ before, and not yet has it been because of a bad superblock. But, the BIOS "IDE ERROR" is a bit fucked up tbh. Check the IDE connections maybe, and I dunno if disconnecting unnecesary IDE drives would help (but I always tend to try that first for some odd reason).

[Aloone_Jonez]

TBH, I have not got a clue. Different filesystems... But I was expecting them to be slightly different somewhere and then you could replace the primary with the secondary (assuming they do exist on NTFS, which is probably a very stupid assumption), but that mustn't be it.
First of all, run:
# fdisk -l /dev/hda
and make sure the output from that is alright (there's a hda1 partition of type NTFS or whatever). I think the NTFS module has to be loaded (or built inside the kernel itself) to get an error like that, but I'd just make sure it's there ('lsmod').

The output is correct, both the file system and disc size are right.

Then make sure your using the right arguments to mount ('-t ntfs /dev/hda1 /mnt' (and '-o ro' for read-only if you like but it shouldn't matter)).

I didn't, I just clicked on it in KDE and I've never had a problem mounting it with KDE before. I've just tried form the command line and I get exactly the same error message.

Can you still boot into Windows on that disk?

No, the BIOS displays "IDE ERROR" when it attempts to boot Windows.

Well, I've seen that error message _alot_ before, and not yet has it been because of a bad superblock. But, the BIOS "IDE ERROR" is a bit fucked up tbh.

Yes, it is weird how fdisk can see the partition table but it won't mount and the BIOS won't boot it.

Check the IDE connections maybe, and I dunno if disconnecting unnecesary IDE drives would help (but I always tend to try that first for some odd reason).

I haven't tried this, but I will have a go.

I don't have a very good feeling about this, I think the file system and possibly the hard disc might be fucked. If the checking the IDE connections doesn't work I'll install Windows on the hdb and see if scandisk will work.

[KernelPanic]

It seriously seems like you just need to instruct Windows to read and/or restor the backup superblock.

This is easy with Linux, you should try this question somewhere else where someone actually knows half a shit about Windows filesystems. Try asking specifically about restoring the superblock.
Don't be screwing up your system trying to fix it

Have you managed to run chkdsk from Win Recovery Console or BartPE?

[Aloone_Jonez]

I'll havwe a go when I get acess to a decent Internet connection so I can burn it.

Yes I think I'll go to a Windows forum for this one, I know I'm treading a fine line asking this question in this forum but I thought it'd be alright as I'm asking about data recovery rather than help with Windows.

Thank you all for your help, you lot've been great. :thumbup: