How to recover read-only NTFS partition

Reading time: 14m

The following is how to recover a read-only NTFS partition

The Error

mkdir: cannot create directory '/mnt/external/recovery_xxxxxxxx': Read-only file system

The Journey

My journey today started with a stack of old SATA drives that had a bunch of data on it.  I needed to be sure I had gotten everything off of them, even if the files were deleted (especially if the files were deleted).

To physically mount the externals I needed a docking station, so I picked up a $40 HDD docking device at a local mall.  It had a weird label on it, but after finding out it wasn’t stocked at Best Buy, Staples, and some other local computer repair services, I was ready to try my luck.

Works perfectly!  I can read all of the old drives, so I have a lot of recovery to do!

Off to mount and recover with photorec!

The Recovery

I get to the part of photorec where you put the directory you want to put the recover files to, so I go to create a directory in an External USB 2TB /mnt/external for the restored files to go.  Mounts okay, tons of old backups.  Then I create a directory to have for the restored files of this drive, and it shuts me down 🙁

sudo mkdir /mnt/external/recovery_$DRIVESERIAL

mkdir: cannot create directory '/mnt/external/recovery_xxxxxxxx': Read-only file system

So I look at /proc/mounts to see if there’s ro, and sure enough:

grep external /proc/mounts

/dev/sde1 /mnt/external ntfs ro,relatime,uid=0,gid=0,fmask=0177,dmask=077,nls=utf8,errors=continue,mft_zone_multiplier=1

Okay so I need to remount rw, no problem:

sudo mount -oremount,rw /dev/sde1

mount: /mnt/external: cannot remount /dev/sde1 read-write, is write-protected.

So I googled that error, which lead me down a few wild goose chases, like toggling the drive’s write protection via hdparm -r, and checking the Security lock status in hdparm -I:

~ # hdparm -r 0 /dev/sde

setting readonly to 0 (off)
readonly = 0 (off)
~ # hdparm -I /dev/sde
ATA device, with non-removable media
Model Number: TOSHIBA MQ01UBB200
Serial Number: redacted
Firmware Revision: AY000U
Transport: Serial, ATA8-AST, SATA 1.0a, SATA II Extensions, SATA Rev 2.5, SATA Rev 2.6
Supported: 8 7 6 5
Likely used: 8
Logical max current
cylinders 16383 16383
heads 16 16
sectors/track 63 63
CHS current addressable sectors: 16514064
LBA user addressable sectors: 268435455
LBA48 user addressable sectors: 3907029168
Logical Sector size: 512 bytes
Physical Sector size: 4096 bytes
Logical Sector-0 offset: 0 bytes
device size with M = 1024*1024: 1907729 MBytes
device size with M = 1000*1000: 2000398 MBytes (2000 GB)
cache/buffer size = 8192 KBytes
Form Factor: 2.5 inch
Nominal Media Rotation Rate: 5400
LBA, IORDY(can be disabled)
Queue depth: 32
Standby timer values: spec'd by Standard, no device specific minimum
R/W multiple sector transfer: Max = 16 Current = 16
Advanced power management level: 128
DMA: sdma0 sdma1 sdma2 mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 *udma5
Cycle time: min=120ns recommended=120ns
PIO: pio0 pio1 pio2 pio3 pio4
Cycle time: no flow control=120ns IORDY flow control=120ns
Enabled Supported:
SMART feature set
Security Mode feature set
* Power Management feature set
* Write cache
* Look-ahead
* Host Protected Area feature set
* WRITE_BUFFER command
* READ_BUFFER command
* NOP cmd
* Advanced Power Management feature set
SET_MAX security extension
* 48-bit Address feature set
* Device Configuration Overlay feature set
* Mandatory FLUSH_CACHE
* SMART error logging
* SMART self-test
* General Purpose Logging feature set
* 64-bit World wide name
* Gen1 signaling speed (1.5Gb/s)
* Gen2 signaling speed (3.0Gb/s)
* Native Command Queueing (NCQ)
* Host-initiated interface power management
* Phy event counters
* Idle-Unload when NCQ is active
DMA Setup Auto-Activate optimization
Device-initiated interface power management
* Software settings preservation
* SMART Command Transport (SCT) feature set
* SCT Write Same (AC2)
* SCT Error Recovery Control (AC3)
* SCT Features Control (AC4)
* SCT Data Tables (AC5)
Master password revision code = 65534
not enabled
not locked
not frozen
not expired: security count
supported: enhanced erase
Logical Unit WWN Device Identifier: 0000000000000000
NAA : 0
IEEE OUI : 000000
Unique ID : 000000000
Checksum: correct

I even tried blockdev --setrw /dev/sde1 to no avail.  At this point I am starting to get a little irked.

That lead to more Googling to find which advised to check dmesg so I did:

dmesg | grep sde

Then ended up finding:

[1940754.320996] ntfs: (device sde1): ntfs_remount(): Volume is dirty and read-only. Cannot remount read-write.

So I searched (put quotes around the error part of the message)

This search lead me to the source of ntfs/super.c in the filesystem drivers for the linux kernel –

So I started an in-page search for Volume is dirty and read-only and found a constant being used called VOLUME_IS_DIRTY, so I look for where else that constant was being referenced in that file, and sure enough I found what I was looking for here:

On line 543 it says to run chkdsk.  I’m not on Windows so I don’t have chkdsk, and I know a fsck wouldn’t yield any results here.  Then I remember the partition I am mount is an NTFS partition, so I look up the terms:

which leads me to this post – in which they say to run ntfsfix

I look up ntfs on my OS package manager search and it’s available as sys-apps/ntfs3g so I install it and it installs the ntfsfix binary, so I run ntfsfix /dev/sde1:

Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sde1 was processed successfully.

I then tried to remount with ,rw, which gave the message:

~ # mount -oremount,rw /dev/sde1
Remounting is not supported at present. You have to umount volume and then mount it once again.

So we un-mount and mount the partition again:

~ # umount /mnt/external
~ # mount -t ntfs /dev/sde1 /mnt/external
~ # grep external /proc/mounts
/dev/sde1 /mnt/external fuseblk rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,blksize=4096 0 0

Bimbo! I can create that directory now and get back to work!


Leave a Reply

Your email address will not be published. Required fields are marked *