Rescue Windows hard disk with Knoppix

mmgarber

My Dell XP machine motherboard failed. I wanted to get the data off the WD2500 (250MB) hard drive so slaved it to an older Dell machine running Win 2k. Unfortunately, the older machine's BIOS is so old it can't read the larger hard drive. Then, I connected it to a Gateway machine running Win 2k; it started running chkdsk on the WD2500 drive and indicated it was 'fixing' a bunch of errors. It appeared to be in an endless loop, fixing the same problem over and over, so I killed the power. Then, I booted the Gateway machine with Knoppix Live CD. It shows the 250G hard drive in the file manager window. When I click on the 250G hard drive icon it shows at the bottom of the window '1 visible item (0 hidden), Free space: 97.4 GB (Total: 250.0 GB)' This seems about right. However, the file listing only includes a single item, 'Documents and Settings' of size 4.1 kb. So something to do with the directory structure is corrupted, but I don't know what, and I don't know how to fix it. Any suggestions?

mfillpot

It sounds like a portion of your master boot record or mft table has been corrupted, when that happens the data still exists but there is no direct reference to tell you where a file starts of ends and no reference to the file names.

You may find some utilities on the ultimate boot cd (http://www.ultimatebootcd.com/) that will be able to help you diagnose and correct the problems

woboyle

Unfortunately you didn't use Linux to try and recover the data originally. You could have mounted it read-only and had no issues with munging the file system like you had with Windows. In the ntfsprogs package is a tool called ntfsfix which may or may not help. According to its man page:

ntfsfix is a utility that fixes some common NTFS problems. ntfsfix is NOT a Linux version of chkdsk.
It only repairs some fundamental NTFS inconsistencies, resets the NTFS journal file and schedules an
NTFS consistency check for the first boot into Windows.

mfillpot

woboyle wrote:

Unfortunately you didn't use Linux to try and recover the data originally. You could have mounted it read-only and had no issues with munging the file system like you had with Windows. In the ntfsprogs package is a tool called ntfsfix which may or may not help. According to its man page:

ntfsfix is a utility that fixes some common NTFS problems. ntfsfix is NOT a Linux version of chkdsk.
It only repairs some fundamental NTFS inconsistencies, resets the NTFS journal file and schedules an
NTFS consistency check for the first boot into Windows.

ntfsfix does do a llittle more than chkdsk, but in the end it triggers for windows to run chkdsk on the next boot, so does little more to help fix issues with the windows filesystems.