Managing NTFS Partitions

In this article we will look at how to manage NTFS partitions we will look at how to mount NTFS partitions, have the partition automatically mounted at boot up, clone a NTFS partition and how to recover deleted files that may have been deleted accidentally. The NTFS (New Technology File System) is a propitiatory file system created by Microsoft and provided as a default file system in a wide variety of Microsoft Operating Systems (Windows XP, Windows Vista, etc).

Installation

In this section of the article we will need to install the NTFS utilities if they have not already been installed this can be done by using the YaST utility. The YaST software management module can be started by using two different commands, the first command is yast sw_single which will start a curses based interface and the second command is yast2 sw_single which will start a GUI (Graphical User Interface). In this article we will be using the yast sw_single command to install the DHCP server.

Once you have started the YaST software management module you will need to search for the the keyword “ntfs”. Once you have selected the “ntfsprogs” package you can begin the installation and then exit once the installation has finished. The next step is to confirm that the “ntfsprogs” package was installed successfully this can be done by issuing the rpm command followed by the -q qualifier as shown in Figure 1.1.

linux-5j56:~ # rpm -q ntfsprogs
ntfsprogs-1.11.2-15.2

Figure 1.1: Querying the RPM database for the “ntfsprogs” package.

Mounting a NTFS Partition

In this section of the article we will look at mounting the NTFS partitions with read only properties. The first task is to find out which partition has been formatted with the NTFS, this can be done by issuing the fdisk command with the -l qualifier as shown in Figure 2.1.

linux-5j56:~ # fdisk -l

Disk /dev/sda: 17.1 GB, 17179869184 bytes
255 heads, 63 sectors/track, 2088 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1               1         892     7164958+   7  HPFS/NTFS
/dev/sda2             893        1023     1052257+  82  Linux swap / Solaris
/dev/sda3   *        1024        2088     8554612+  83  Linux

Figure 2.1: Viewing the partition table.

As you can see in Figure 2.1 the “/dev/sda1” partition has the ‘System’ type of NPFS/NTFS which indicates the partition is of type NTFS. Once you know which partition has the NTFS installed you will need to create a mount point for this partition this can be done by issuing the mkdir command followed by a path name. In this article we will create a directory called: “windowsc” within the /media directory as shown in Figure 2.2.

linux-5j56:~ # mkdir /media/windowsc

Figure 2.2: Creating a mount point for the NTFS partition.

Once you have created the mount point for the NTFS partition you can use the mount command to mount the NTFS partition. Figure 2.3 shows the command used to mount the NTFS partition. Table 1 explains what each part of the command does.

linux-5j56:~ # mount /dev/sda1 /media/windowsc/ -o ro

Figure 2.3: Mounting the NTFS partition.

Section	Description
/dev/sda1	This is the NTFS partition that we retrieved earlier as shown in Figure 2.1.
/media/windowsc	This is the mount point for the NTFS partition which we created in Figure 2.2.
-o ro	This section tells the mount command that we want to mount the NTFS partition with read only permissions.

Table 1: Figure 2.3 mount command explained.

Once you have issued the mount commands and no errors were returns you can change into the /media/windowsc directory and issue the ls command which will display the contents of the NTFS partition as shown in Figure 2.4.

linux-5j56:~ # cd /media/windowsc/
linux-5j56:/media/windowsc # ls
AddOn         boot.ini    CONFIG.SYS              IO.SYS     NTDETECT.COM  pagefile.sys   System Volume Information
AUTOEXEC.BAT  Config.Msi  Documents and Settings  MSDOS.SYS  ntldr         Program Files  WINDOWS

Figure 2.4: Listing the contents of the NTFS partition.

Auto mounting NTFS Partitions

In this section of the article we will look at making the NTFS partition automatically mount when the system boots up. The file that you will need to modify is the fstab file which is located within the /etc directory, Figure 3.1 shows the entry that will need to be made in the fstab file and Table2 explains what each column means.

/dev/sda1            /media/windowsc      ntfs       defaults              0 0

Figure 3.1: fstab file entry.

Column	Description
/dev/sda1	This field specifies the block device e.g. The NTFS partition.
/media/windowsc	This field specifies the mount point located on the filesystem.
ntfs	This field specifies the filesystem type e.g. NTFS, ext2, ext3, etc.
defaults	This field specifies the mount options e.g. rw, ro, etc.
0	This field is used for these filesystems by the dump(8) command to determine which filesystems need to be dumped.
0	This field is used by the fsck(8) program to determine the order in which filesystem checks are done at reboot time.

Table 2: fstab syntax.

Cloning a NTFS Partition

In this section of the article we will look at cloning an image of the NTFS partition using the ntfsclone command. The ntfsclone utility allows you to clone an NTFS partition and create a image which can be restored at a later time using the ntfsclone command, the ntfsclone utility works at the disk sector level and copies only the used data.

In this article we will create a image of our current NTFS partition which we will restore later on in this section. Figure 4.1 shows the command use to clone the NTFS partition. Table 3 explains what each qualifier does.

linux-5j56:~ # ntfsclone --save-image -o WindowsXP.img /dev/sda1
ntfsclone v1.11.2
NTFS volume version: 3.1
Cluster size       : 4096 bytes
Current volume size: 7336914944 bytes (7337 MB)
Current device size: 7336917504 bytes (7337 MB)
Scanning volume ...
100.00 percent completed
Accounting clusters ...
Space in use       : 2382 MB (32.5%)
Saving NTFS to image ...

Figure 4.1: Cloning the NTFS Partition.

Qualifier	Description
–save-image	This qualifier creates a special image file which can be later restored.
-o WindowsPartition.img	This qualifier specifies the name of the cloned NTFS partition.
/dev/sda1	This section specifies the NTFS partition.

Table 3: ntfsclone qualifiers explained.

Once you have cloned the NTFS partition it is possible to mount the NTFS image using the mount command as shown in Figure 4.2.

linux-5j56:~ # mount -t ntfs WindowsPartition.img /media/windowsc/ -o loop,rw 

Figure 4.2: Mounting the NTFS cloned image.

Once you have mounted the NTFS image you can make modifications to files or just keep it as a backup. The ntfsclone utility allows you to simply restore your system, to test this we will use the shred command to damage the NTFS partition and then we will restore the NTFS partition to its original state using the ntfsclone command. Figure 4.3 shows the command used to damage the NTFS partition and Figure 4.4 shows the command used to restore the NTFS partition.

linux-5j56:~ # shred -v -n 1 /dev/sda1
shred: /dev/sda1: pass 1/1 (random)...
shred: /dev/sda1: pass 1/1 (random)...17MiB/6.9GiB 0%
shred: /dev/sda1: pass 1/1 (random)...38MiB/6.9GiB 0%
shred: /dev/sda1: pass 1/1 (random)...59MiB/6.9GiB 0%
shred: /dev/sda1: pass 1/1 (random)...79MiB/6.9GiB 1%
...
...
linux-5j56:~ # mount -t ntfs /dev/sda1 /media/windowsc/
mount: wrong fs type, bad option, bad superblock on /dev/sda1,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

Figure 4.3: Damaging the NTFS partition.

linux-5j56:~ # ntfsclone --restore-image -O /dev/sda1 WindowsXP.img
ntfsclone v1.11.2
NTFS volume version: 3.1
Cluster size       : 4096 bytes
Image volume size  : 7336914944 bytes (7337 MB)
Image device size  : 7336917504 bytes
Space in use       : 2382 MB (32.5%)
Restoring NTFS from image ...
100.00 percent completed
Syncing ...

Figure 4.4: Restoring the NTFS partition.

As you can see in Figure 4.3 the second command that was executed (mount) was unable to mount the NTFS partition because of the previous shred command damaged the filesystem. Once the NTFS image has been restored you can mount the /dev/sda1 partition as shown in Figure 2.3.

Recovering Deleted Files

In this section of the article we will look at recovering deleted files using the ntfsundelete command. The ntfsundelete command has the capabilities of recovering deleted files that may have been accidentally deleted.

The first task that you need to do is scan the NTFS partition to see if there are any files that can be recovered this can be done by issuing the ntfsundelete command followed by the NTFS partition as shown in Figure 5.1.

linux-5j56:~ # ntfsundelete /dev/sda1
Inode    Flags  %age  Date           Size  Filename
---------------------------------------------------------------
16       F..!     0%  1970-01-01         0
17       F..!     0%  1970-01-01         0
18       F..!     0%  1970-01-01         0
19       F..!     0%  1970-01-01         0
20       F..!     0%  1970-01-01         0
21       F..!     0%  1970-01-01         0
22       F..!     0%  1970-01-01         0
23       F..!     0%  1970-01-01         0
4128     FN..   100%  2008-06-17   1048576  edb.log
4129     FN..   100%  2008-06-17   1048576  edb00002.log
4130     FN..   100%  2008-06-17   1048576  res2.log
4131     FN..   100%  2008-06-17   1048576  res1.log
4133     FN..   100%  2008-06-17      8192  edb.chk
11090    FN..   100%  2008-06-17     16384  Perflib_Perfdata_b0.dat
11769    F..!     0%  1970-01-01         0
11770    F..!     0%  1970-01-01         0
11771    F..!     0%  1970-01-01         0
11772    F..!     0%  1970-01-01         0
11773    F..!     0%  1970-01-01         0
11774    F..!     0%  1970-01-01         0
11775    F..!     0%  1970-01-01         0

Files with potentially recoverable content: 6

Figure 5.1: Scanning for possible files to recover.

As Figure 5.1 shows there are six files which can potentially be recovered. The next step is to issue the ntfsundelete command with the -u qualifier followed by the inode of the file which you would like to recover and the NTFS partition as shown in Figure 5.2.

linux-5j56:~ # ntfsundelete -u11090 /dev/sda1
Inode    Flags  %age  Date            Size  Filename
---------------------------------------------------------------
11090    FN..     0%  2008-06-17     16384  Perflib_Perfdata_b0.dat

Undeleted 'Perflib_Perfdata_b0.dat' successfully.

Figure 5.2: Recovering the “perflib_Perfdata_b0.dat” file.

Once you have recovered the file you will notice that it appears in your current working directory this file can be copied back to the NTFS partition or stored on some other media.

Final Thoughts

In this article we looked at how to manage NTFS partitions, hopefully you will find this useful if you have a dual boot with Microsoft Windows and SUSE Linux. I would also recommend visiting the Linux NTFS project [1] for the latest news and features.

Reference

[1] http://www.linux-ntfs.org/doku.php