The following is how to recover a read-only NTFS partition
The Error
mkdir: cannot create directory '/mnt/external/recovery_xxxxxxxx': Read-only file system
The Journey
My journey today started with a stack of old SATA drives that had a bunch of data on it. I needed to be sure I had gotten everything off of them, even if the files were deleted (especially if the files were deleted).
To physically mount the externals I needed a docking station, so I picked up a $40 HDD docking device at a local mall. It had a weird label on it, but after finding out it wasn’t stocked at Best Buy, Staples, and some other local computer repair services, I was ready to try my luck.
Works perfectly! I can read all of the old drives, so I have a lot of recovery to do!
Off to mount and recover with photorec!
The Recovery
I get to the part of photorec where you put the directory you want to put the recover files to, so I go to create a directory in an External USB 2TB /mnt/external for the restored files to go. Mounts okay, tons of old backups. Then I create a directory to have for the restored files of this drive, and it shuts me down 🙁
sudo mkdir /mnt/external/recovery_$DRIVESERIAL
mkdir: cannot create directory '/mnt/external/recovery_xxxxxxxx': Read-only file system
So I look at /proc/mounts to see if there’s ro, and sure enough:
grep external /proc/mounts
/dev/sde1 /mnt/external ntfs ro,relatime,uid=0,gid=0,fmask=0177,dmask=077,nls=utf8,errors=continue,mft_zone_multiplier=1
Okay so I need to remount rw, no problem:
sudo mount -oremount,rw /dev/sde1
mount: /mnt/external: cannot remount /dev/sde1 read-write, is write-protected.
So I googled that error, which lead me down a few wild goose chases, like toggling the drive’s write protection via hdparm -r, and checking the Security lock status in hdparm -I:
~ # hdparm -r 0 /dev/sde /dev/sde: setting readonly to 0 (off) readonly = 0 (off)
~ # hdparm -I /dev/sde
/dev/sde:
ATA device, with non-removable media
Model Number: TOSHIBA MQ01UBB200
Serial Number: redacted
Firmware Revision: AY000U
Transport: Serial, ATA8-AST, SATA 1.0a, SATA II Extensions, SATA Rev 2.5, SATA Rev 2.6
Standards:
Supported: 8 7 6 5
Likely used: 8
Configuration:
Logical max current
cylinders 16383 16383
heads 16 16
sectors/track 63 63
--
CHS current addressable sectors: 16514064
LBA user addressable sectors: 268435455
LBA48 user addressable sectors: 3907029168
Logical Sector size: 512 bytes
Physical Sector size: 4096 bytes
Logical Sector-0 offset: 0 bytes
device size with M = 1024*1024: 1907729 MBytes
device size with M = 1000*1000: 2000398 MBytes (2000 GB)
cache/buffer size = 8192 KBytes
Form Factor: 2.5 inch
Nominal Media Rotation Rate: 5400
Capabilities:
LBA, IORDY(can be disabled)
Queue depth: 32
Standby timer values: spec'd by Standard, no device specific minimum
R/W multiple sector transfer: Max = 16 Current = 16
Advanced power management level: 128
DMA: sdma0 sdma1 sdma2 mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 *udma5
Cycle time: min=120ns recommended=120ns
PIO: pio0 pio1 pio2 pio3 pio4
Cycle time: no flow control=120ns IORDY flow control=120ns
Commands/features:
Enabled Supported:
SMART feature set
Security Mode feature set
* Power Management feature set
* Write cache
* Look-ahead
* Host Protected Area feature set
* WRITE_BUFFER command
* READ_BUFFER command
* NOP cmd
* DOWNLOAD_MICROCODE
* Advanced Power Management feature set
SET_MAX security extension
* 48-bit Address feature set
* Device Configuration Overlay feature set
* Mandatory FLUSH_CACHE
* FLUSH_CACHE_EXT
* SMART error logging
* SMART self-test
* General Purpose Logging feature set
* WRITE_{DMA|MULTIPLE}_FUA_EXT
* 64-bit World wide name
* IDLE_IMMEDIATE with UNLOAD
* WRITE_UNCORRECTABLE_EXT command
* {READ,WRITE}_DMA_EXT_GPL commands
* Segmented DOWNLOAD_MICROCODE
* Gen1 signaling speed (1.5Gb/s)
* Gen2 signaling speed (3.0Gb/s)
* Native Command Queueing (NCQ)
* Host-initiated interface power management
* Phy event counters
* Idle-Unload when NCQ is active
DMA Setup Auto-Activate optimization
Device-initiated interface power management
* Software settings preservation
* SMART Command Transport (SCT) feature set
* SCT Write Same (AC2)
* SCT Error Recovery Control (AC3)
* SCT Features Control (AC4)
* SCT Data Tables (AC5)
Security:
Master password revision code = 65534
supported
not enabled
not locked
not frozen
not expired: security count
supported: enhanced erase
454min for SECURITY ERASE UNIT. 454min for ENHANCED SECURITY ERASE UNIT.
Logical Unit WWN Device Identifier: 0000000000000000
NAA : 0
IEEE OUI : 000000
Unique ID : 000000000
Checksum: correct
I even tried blockdev --setrw /dev/sde1 to no avail. At this point I am starting to get a little irked.
That lead to more Googling to find https://serverfault.com/a/232720 which advised to check dmesg so I did:
dmesg | grep sde
Then ended up finding:
[1940754.320996] ntfs: (device sde1): ntfs_remount(): Volume is dirty and read-only. Cannot remount read-write.
So I searched https://duckduckgo.com/?q=%22ntfs_remount()%3A+Volume+is+dirty+and+read-only.+Cannot+remount+read-write.%22&ia=web (put quotes around the error part of the message)
This search lead me to the source of ntfs/super.c in the filesystem drivers for the linux kernel – https://code.woboq.org/linux/linux/fs/ntfs/super.c.html
So I started an in-page search for Volume is dirty and read-only and found a constant being used called VOLUME_IS_DIRTY, so I look for where else that constant was being referenced in that file, and sure enough I found what I was looking for here:
https://elixir.bootlin.com/linux/latest/source/fs/ntfs/super.c#L540
On line 543 it says to run chkdsk. I’m not on Windows so I don’t have chkdsk, and I know a fsck wouldn’t yield any results here. Then I remember the partition I am mount is an NTFS partition, so I look up the terms:
https://duckduckgo.com/?q=VOLUME_IS_DIRTY+ntfs+chkdsk&ia=web
which leads me to this post – https://askubuntu.com/a/112161 in which they say to run ntfsfix
I look up ntfs on my OS package manager search and it’s available as sys-apps/ntfs3g so I install it and it installs the ntfsfix binary, so I run ntfsfix /dev/sde1:
Mounting volume... OK Processing of $MFT and $MFTMirr completed successfully. Checking the alternate boot sector... OK NTFS volume version is 3.1. NTFS partition /dev/sde1 was processed successfully.
I then tried to remount with ,rw, which gave the message:
~ # mount -oremount,rw /dev/sde1 Remounting is not supported at present. You have to umount volume and then mount it once again.
So we un-mount and mount the partition again:
~ # umount /mnt/external ~ # mount -t ntfs /dev/sde1 /mnt/external ~ # grep external /proc/mounts /dev/sde1 /mnt/external fuseblk rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other,blksize=4096 0 0
Bimbo! I can create that directory now and get back to work!