Boot Mode Files & Folders Restore: PDF file corrupt and unreadable

Another way to delete a "can't delete" file! What I am going to describe is the way I just deleted a corrupted file using Knoppix. My environment is a Dell 8250 Dimension with the first IDE drive having a Dell FAT utility partition and the second being my WinXP C: drive. I had a restored directory structure hanging off my C:\temp directory with the last directory having a corrupted file called nsli.exe.
I used Knoppix v5.1.1, but in retrospect, I think any distro that has ntfs-3g will work. ntfs-3g is a rewrite of ntfs read/write with a focus on reliability. ntfs-3g has been stable since v1.0. Your distro still needs a up to date FUSE package for ntfs-3g to work. I believe the Trinity Rescue Kit has ntfs-3g in it, as well as many other linux packages. You might want to look at http://www.ntfs-3g.org and http://wiki.linux-ntfs.org. Look for the About ntfs-3g link.
In my environment, Knoppix finds (the first HD) and puts up a icon for hda1 (my Dell utility partition) and hda2 (my C: partition) on its GUI desktop. As booted, you can't use the GUI called Konqueror (think windows explorer) to write to hda2 even though you can see the files and read them.
I used linux to establish a mount point called /mnt/windows. I then used linux to actually mount (attach) my C: drive to the linux file structure. Note: You need to have root capabilities to issue the commands, and you can get there by selecting the K icon in the lower left of the desktop, select Knoppix, select rootshell. Issue the commands from there.
Mounting my C: drive (hda2) was done with a mount -t ntfs-3g /dev/hda2 /mnt/windows.
I could then go back to the desktop (now that linux had a path to my C: drive in read/write mode) and double click on the hda2 icon. That brought up the Konqueror GUI and I could navigate to the offending file. I started by deleting the file. I then navigated one directory at a time towards the C: temp directory and deleted a single empty directory at a time. I left the C:temp empty directory in place. I never saw any feedback from Konqueror that he had any problem doing what I wanted. The item in question just disappeared. Make sure you go back to the root window and unmount hda2 before you shutdown.
ntfs-3g does not use ntfsmount nor captive-ntfs.
I booted to winxp and the offending file/directories were gone. I ran AVG anti-spyware and it did not find a corrupted file (it always did before). I used TI v10 build 4942 to do a complete image and validated it. No problems.
I think the key is ntfs-3g. I'm sure there are other ways to do this (we have had two other ways mentioned in this forum already). Now there is a third. I hope this helps somebody else dig themselves out of the hole I found myself in. Thanks Mustang for suggesting Knoppix. I had never even see Linux before, let alone Knoppix.

 

Hi desertdad,

Congratulations. You have done extremely well. I'm sure that must feel great.

I tried to duplicate the corrupt, undeletable file situation. The good news is that I was not able to do it. Acronis must have made some changes for the better in recent builds. Previously, I had no trouble creating the problem. Just for the fun of it, I booted Knoppix to try out your mount instructions for ntfs-3g. For me it was a little more involved than it was for you. In my case Knoppix only created mount points for two of my four hard drives. My C: drive was not shown. I had to look in /dev to see all the hard drives. I could see them at sda, sdb, sdc and sdd. Only sdb and sdc showed on the desktop. I made two new directories (/media/sda1 and /mnt/windows). Then I had to add an entry in /ect/fstab for /dev/sda1. The first step was to change the permissions on /etc/fstab to read, write and execute for all users with chmod a+rwx /ect/fstab. The second step was to open /etc/fstab with KWrite and duplicate the entry for an existing ntfs partition changing the device name to sda1. Then I was able to use the mount -t ntfs-3g /dev/sda1 /mnt/windows command to mount my C: drive. At that point I suspect I could have used Konqueror to delete the bad file if I had one.

You certainly have come a long way in a short time.

 

My results so far lead me to the following conclusions:
1. I believe my problem was related to a very specific set of conditions. I used TI10 bld 4871 from winxp to build a drive image of my C: drive on a second local IDE drive; used a TI10 build 4871 rescue CD to pull a .exe file out of the image and attempt to restore it; and it came up "corrupted".
2. Doing the same image/file restore from within winxp was successful, including the file restore.
3. I have subsequently done the same test with build 4942 and have pulled the same .exe file out of a bld 4942 image and restoring to a ntfs drive using both the TI10 rescue CD and a BartPE CD with TI10 on it. Both were successful.
4. The folks running TI10 should get to build 4942 or better asap.
Perhaps the fundamental problem has indeed been fixed.