[clue] NTFS logical structure corruption?

[Chris Tubutis]

Remove the drive from the laptop (generally, very easy to do).

Attach it to a SATA - USB adapter for around $20 at MicroCenter, plug it into a USB port of a Windows box and use native Windows utilities to operate on it.

http://www.microcenter.com/search/search_results.phtml?Ntt=sata+usb+adapter&submit.x=0&submit.y=0

NTFS is a proprietary format, best to use Windows-native tools on it as the (generally reverse-engineered) GNU utilities can cause real damage sometimes.





>________________________________
> From: "dshaw at famece.com" <dshaw at famece.com>
>To: CLUE's mailing list <clue at cluedenver.org> 
>Sent: Wednesday, March 7, 2012 4:17 PM
>Subject: Re: [clue] NTFS logical structure corruption?
> 
>Hi all,
>
>Thanks for the thoughtful replies. First, a couple of clarifications. The
>errant drive is the internal drive in a laptop, so making the filesystem
>available on-line, or mounting the drive on a different machine, are more
>difficult-to-implement suggestions than I'm willing to go for at this
>time. In part this is because overall, the machine seems to run fine. I'm
>just worried that something may be amiss that will lead to additional
>troubles in the future.
>
>Jim Ockers wrote:
>
>> I assume you've done CHKDSK C: /F and rebooted,
>
>Correct. Many times, with different options, using the DOS tools available
>under XP/SP3. Nothing is ever reported.
>
>> If you boot the machine from a Windows XP
>> CD and enter the recovery console, can you
>> delete the file?
>
>I haven't tried this yet, but will try to get to it tonight.
>
>> If you fire up Norton Ghost
>
>ok—- so here's some data I didn't put in my initial message. The only real
>backup software I've worked with is Maxtor's Maxblast, a free copy that
>came with a Maxtor drive. It is supposedly smart enough about NTFS to know
>whether it can do "logical" backups or sector-by-sector backups. It can
>create a C drive image without complaint, and browsing that image, I can
>enter the problem folder and see the file I can't delete. Maxblast can
>even restore the whole image without complaint, but with the same outcome
>on the C drive when I'm done. A look at disk defragmenter graphics before
>and after the restore suggests Maxblast was doing a logical file rebuild,
>but I suppose it could switch back and forth as needed...  And
>unfortunately, there's no "restore everything but" option.
>
>> Also there were some command line utilites
>> like CACLS.EXE that would let you manipulate
>
>Right. I’ve tried manipulating the situation with them as well. In
>addition, I have a suite of commercial UNIX utilities for Windows loaded
>on the machine to help me get anything done, and have used them as well.
>This was how I found the problem in the first place, when I tried to run a
>"find C:" and it failed when it ran into the bad directory. Now I having
>to run find with a "-prune" clause to avoid it.
>
>> Can you find a version of WINFILE.EXE (the
>> old Windows NT file manager) from Windows NT
>
>Have not tried this. Any suggestions where I might such a thing that would
>run under XP?
>
>> the reason I mention Ghost is because it's had
>> really good NTFS support just about from the beginning.
>
>Thanks for this recommendation. If nothing else works I may get to this.
>My gut level is to ignore the whole thing. I'm just worried that with all
>the multiply-hard-linked files I'm seeing that something else is wrong.
>Whether any of this is left over from the virus cleaning I have no idea. I
>have another laptop with XP and a copy of Fedora loaded on it that I
>should be able to get running tonight. I'll see whether that produces any
>interesting comparisons.
>
>Davis L. Willson wrote:
>
>> 1) Use CHKDSK to repair the filesystem
>> 2) Use TAKEOWN to take ownership of the
>> files and directories you can't access.
>> 3) Use ICACLS to give Administrators:Full
>> Control and SYSTEM:Full Control on them.
>
>I thought I had tried all these approaches already, but I'll try to take
>another shot at it tonight.
>
>Dave Shaw
>
>
>
>_______________________________________________
>clue mailing list: clue at cluedenver.org
>For information, account preferences, or to unsubscribe see:
>http://cluedenver.org/mailman/listinfo/clue
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue/attachments/20120307/b2f22394/attachment.html