Ubuntu~ Recovering broken or deleted NTFS partitions?
Tags: ubuntu, bootfilesystemmountn, data, recoverydual
Published: 2021-11-25 17:06:00

---
title: Ubuntu~ Recovering broken or deleted NTFS partitions?
published: true
date: 2021-11-23 06:34:28 UTC
tags: Ubuntu,bootfilesystemmountn,data,recoverydual
canonical_url: https://stackallflow.com/ubuntu/ubuntu-recovering-broken-or-deleted-ntfs-partitions/
---

<header>
<p><span style="font-size: 1.2em; color: initial;">data-recovery</span><span style="font-size: 1.2em; color: initial;">dual-boot</span><span style="font-size: 1.2em; color: initial;">filesystem</span><span style="font-size: 1.2em; color: initial;">mount</span><span style="font-size: 1.2em; color: initial;">ntfs</span></p>
</header>

About two weeks ago I had a problem with my PC that my brother wrote a question about at [PC not booting after using Windows 7 auto-repair](https://askubuntu.com/questions/774434/pc-not-booting-after-using-windows-7-auto-repair).

**I still haven’t solved the problem, so my PC is unusable now.**

Now I think that it would be simpler to re-install both Win7 & Ubuntu than repair them, but there’re some data on their partitions. I want to recover this data.

These partitions are not mountable for some reason. I don’t know why.

**`sudo fdisk -l` about the problematic partitions:**

```
Device Boot Start End Blocks Id System
/dev/sda1 2048 147912703 73955328 83 Linux
/dev/sdb2 206848 174079999 86936576 7 HPFS/NTFS/exFAT

```

And in GParted:

[![enter image description here](https://i.stack.imgur.com/rsB04.jpg)](https://i.stack.imgur.com/rsB04.jpg)

[![enter image description here](https://i.stack.imgur.com/epeup.jpg)](https://i.stack.imgur.com/epeup.jpg)

And the error of the `mount` command:

```
Failed to mount '/dev/sdb2': Invalid argument
The device '/dev/sdb2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

```

And the exact same message for `/dev/sda1`

How can I recover my data from those HDDs?

**EDIT**

I have tried to specify the type of the drive:

```
$ sudo mount -t ext4 /dev/sda1 /olddisk
mount: wrong fs type, bad option, bad superblock on /dev/sda1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail or so
$ sudo mount -t ntfs /dev/sdb2 /olddisk
NTFS signature is missing.
Failed to mount '/dev/sdb2': Invalid argument
The device '/dev/sdb2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

```

**EDIT**

`sudo ntfsfix /dev/sdb2` returns:

```
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.
```

#### Accepted Answer

> **Disclaimer:** I provided an answer to similar questions [here](https://softwarerecs.stackexchange.com/a/31377/19806) and [here](https://unix.stackexchange.com/a/283009/84179). This is a summary of those two answers. Moreover, I am the developer of RecuperaBit.

Your NTFS partition is broken. In order to restore the data, you need to make a copy of it (ideally) and then use a NTFS reconstruction software to restore its contents.

# Clone the drive

You really _should_ clone the drive in a file on an external disk, unless it is so big you can’t find another drive than can contain it.

If you are **really sure** the NTFS partition coincides with `/dev/sdb2`, then use `ddrescue` to copy only that one:

```
sudo ddrescue /dev/sdb2 /media/user/External/copy.img /media/user/External/status.log

```

If you are not sure, it is much better to clone the entire `/dev/sdb` drive. This will take more space, of course:

```
sudo ddrescue /dev/sdb /media/user/External/copy.img /media/user/External/status.log

```

The `status.log` file is not mandatory, but it is needed if you want to pause the process and resume later on.

# Analyze and reconstruct the file system

If the file system is only slightly broken, you may have luck with `testdisk`:

```
testdisk /media/External/copy.img

```

Follow the step-by-step procedure in the CLI and you will be able to list the contents of the partition with the `P` key, **assuming it is almost intact.**

If the damage is more serious, you need something else. You can recover (possibly severely) damaged NTFS partitions using [RecuperaBit](https://github.com/Lazza/RecuperaBit). RecuperaBit attempts to reconstruct file system structures and recover  
files. RecuperaBit attempts reconstruction of the directory structure regardless of:

- missing partition table
- unknown partition boundaries
- partially-overwritten metadata
- quick format

Currently, it does not require installation, you need to download the archive from GitHub and extract it in a directory of your choice.

After that, create a directory for the output and start the program with:

```
mkdir /media/user/External/recovered_files
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save

```

You might also use `python`, however `pypy` is faster. The scanning process will take quite some time. When it’s done, type `recoverable` and find the id of your partition. If it is e.g. 2, type:

```
restore 2 5
restore 2 -1

```

`5` means the _Root_ directory and `-1` means the _Lost Files_ directory.

For additional details, explanations and caveats, see the two links at the top of this post.

The post [Ubuntu~ Recovering broken or deleted NTFS partitions?](https://stackallflow.com/ubuntu/ubuntu-recovering-broken-or-deleted-ntfs-partitions/) appeared first on [Stack All Flow](https://stackallflow.com).