Ubuntu
testdisk package

Recover files on NTFS partition

Asked by Austin Allen

I installed Ubuntu on a second partition on my hard drive, with XP on the first. When i went to boot back into Windows, it said "NTLDR not found Please run chkdsk to fix". So i ran chkdsk, and it deleted everything. It said,

"The volume is dirty.

Unable to query LCN from VCN 0x4 for attribute of type 0x80.

The non resident attribute of type 0x80 is inconsistent. The valid data

length is 0xc25c000, file size 0xc25c000, and allocated length 0x4000.

The non resident attribute of type 0x80 is inconsistent. The valid data

length is 0xc25c000, file size 0x4000, and allocated length 0x4000.

Deleted corrupt attribute list entry

with type code 128 in file 0.

Unable to find child frs 0x10 with sequence number 0x1.

The attributes with same type code 0x80 but different instance tags

0x3 and 0x0 have non-contiguous VCN numbers 0x4 and 0x5a57

respectively in file 0x0.

Deleted corrupt attribute list entry".......

I've posted the complete log here, http://www.mediafire.com/?sharekey=eaa49a73d771aaf2d2db6fb9a8902bda

I need a recovery program that would ignore the MFT and undelete the files. I'm fine with not recovering the OS, because linux is sweet, but i need to recover the documents and settings folder.
I can mount the volume fine, but only the system information file and the log show up. Any suggestions for recovering from Ubuntu, or even a third party tool?

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu testdisk Edit question
Assignee:
No assignee Edit question
Solved by:
Austin Allen
Solved:
Last query:
Last reply:
Revision history for this message
marcobra (Marco Braida) (marcobra) said : 		#1

Please try from installed Ubuntu the recover testdisk utility http://www.cgsecurity.org/wiki/TestDisk

To install testdisk you must enable Universe repository so using System->Administration->Software sources [Ubuntu software tab] please enable the Universe repository row.

Then open a Terminal from the menu Applications->Accessories->Terminal and type:

sudo apt-get update
sudo apt-get upgrade
sudo apt-get install testdisk

give your user password when requested, you don't see nothing when you type it, then press enter.

To run testdisk please open a terminal and type:

sudo testdisk

Testdisk homepage http://www.cgsecurity.org/wiki/TestDisk
Testdisk question and answer https://answers.launchpad.net/ubuntu/+source/testdisk

Hope this helps

Revision history for this message
Austin Allen (dubblea13) said : 		#2

Thank you very much for your help! i have installed testdisk and followed recovery directions, but when i try to rebuild the boot sector and list the files, it says "List directions and filesSegmentation fault. and then i get the default bash prompt. What does this mean, and how do i remedy it? Is the geometry messed up?

Revision history for this message
ronnie_libra (ronnie-libra) said : 		#3

you said NTLDR not found it could be the virus that caused it or file corruption.
Pls. try to copy this file from other computer, it is hidden in drive C: or in the partition where Microsoft OS is installed it could be in the drive d:,to view this file openn command prompt type cd\ if your not in the c:\ if os is in other drive(D:\) type cd\ then d:, then type Attrib -h -r -s NTLDR, this file should be visible copy this,to your drive where you installed microsoft,using kubuntu installed in your computer or live cd.If it still does not work.Try to download NTFSDOS to make bootable cd or floppy, use other computer with microsoft windows.
NOTE: you must have to hide NTLDR again to protect this file. type Attrib +h +r +s NTLDR

Revision history for this message
Austin Allen (dubblea13) said : 		#4

Thanks for your response. I understand how the windows boot process goes, but it's not quite what I'm getting at. You see, the boot record is fine, and my partition tables are all good, it has to deal with the actual filesystem. when windows "deletes" a file, even from the trash can, it's still there, only marked as "deleted". I was wondering if there is a program (other than TestDisk) that would ignore windows' MFT and search at the file and folder level for things that things that were once there. Is there a way to make the drive show up as an actual disk inside of VMWare? and i could scan it using Recuva?

Revision history for this message
Austin Allen (dubblea13) said : 		#5

Well, i recovered my files by booting into a live XP environment and using a program called "File Scavenger". I just had it recover them to an external hard drive. Thanks for the help though!