Unable to Mount Partitions/Drive accessed by Windows 10

I have an old assembled system. I have two SSDs one for Windows and another for Linux running Leap 15.2 and an external 3TB HDD with NTFS. I was running Windows 7 32 bit with two partitions on SSD, one for the OS and programs and other for data. I could mount and read all partitions and the external HDD from Leap.

I just changed from Windows 7 32 bit to Windows 10 64 bit on the partition for OS. No changes were made to the partition for data or the external HDD. However I find that I cannot access these from Leap. What I now understand is that partitions accessed from Windows with fast boot on are no longer accessible from Linux. Is it correct?
I have not been able to find how to turn off the fast boot option. Can anyone help me?

Thanks

PrakashC

Trying to use (from Linux) Windows file systems that are not closed properly (e.g. by using the Windows fast boot feature) has never worked. Probably your old Windows did not use fast boot, thus you never have experienced this.

Yes, you have to turn off fast boot in your Windows. As I know almost nothing about Windows I can not tell you how to do that. But I assume that that can not be too difficult to find. Else wait for someone her who knows also things about Windows, or als in a Windows forums.

Try searching for “disable windows 10 fast boot” on the internet (I favor DuckDuckGo). It’s quite easy to find and do.

Note that after some major updates Windows 10 tends to re-enable fast boot, so you have to disable it again.

Hi
The other way is to do a full shutdown of windows, either when pressing shutdown hold the shiftkey and select shutdown, or create a shortcut shutdown /s /t 3 where t 3 equals 3 seconds.

Thanks. Found it with “disable windows 10 fast boot”! Hidden in plain sight.

Control Panel -> search for power options -> click -> click choose what power buttons do -> click change settings that are currently unavailable -> click to unselect fast start up -> save changes

PrakashC

I have managed to get rid of fastboot in windows 10. The internal partitions on SSDs are now again accessible from Leap. However, the external HDD is not even detected by Windows 10 itself or by Leap or even the partitioner or Qphotorec. I have checked in various Windows forums and found mention of the problem mentioned in only one place but no solutions. It is reported there that Parted Magic also does not help.

I now understand that Windows when shutting down with fastboot writes to the storage media some (each time a new) code which helps it come out of hibernation quickly when booted next. However if a drive is not connected when the systems boots again the code becomes meaningless and the drive is blocked. **From what I can make out Microsoft will not even acknowledge the problem and put out a warning much less find or put out a solution.
**
Any suggestions for recovering the HDD?

PrakashC

Eject the external hard drive before shutting windows down. That is so that the fastboot is not set on the external drive.

That is an alternative to disabling fastboot. Fine, but I have turned off fastboot. Now the problem is to recover the striken External HDD.

PrakashC

Boot Leap, run “journalctl --follow” in terminal, connect external HDD, post output of journalctl.

AFAIK fastboot is a hibernate/shutdown hybrid, you really should eject any removable media, like USB disks, pendrives, etc., before shutting down - unless you didn’t write anything to it since it was mounted, of course.

A clarification please, do I connect ext HDD before or after running the “journalctl --follow” command? I only have to switch on the power to the HDD.

Thanks

PrakashC

Like @arvidjaar wrote, in that order:

  1. run “journalctl --follow” in terminal
  2. connect external HDD
  3. post output of journalctl
-- Logs begin at Mon 2021-07-26 15:12:10 IST. --
Jul 26 15:14:23 localhost.localdomain kwin_x11[2002]: qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 26112, resource id: 35652644, major code: 18 (ChangeProperty), minor code: 0
Jul 26 15:14:28 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:14:34 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:14:35 localhost.localdomain su[2684]: (to root) prakash on pts/1
Jul 26 15:14:35 localhost.localdomain su[2684]: pam_unix(su-l:session): session opened for user root by prakash(uid=1000)
Jul 26 15:14:40 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:14:46 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:14:52 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:14:58 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:04 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:10 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:16 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:22 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:28 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:35 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:41 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:47 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:53 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:15:59 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:16:05 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:16:11 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!
Jul 26 15:16:17 localhost.localdomain kernel: IPv6: MLD: clamping QRV from 1 to 2!

That is what I get.

PrakashC

Is that what is added to your “follow” when you connect/switch on the device? Or that that only what was shown already direct after giving the command?

The idea of the “follow” functionality is that you see a short list of the last logs and after that you will see every fresh log entry that is made. Thus allows one to see the direct effect of an action in the logs. Thus only the entries that are made as a result of the action (connecting) are important.

I ask because I see nothing in relation to device connection.

Did you run it as root? If yes, your external disk is broken.

Any hope of retrieving data? Something like QPhotRec?

PrakashC

In Microsoft community some one has reported being able to retrieve data fro the locked drive using UBCD software and Parted Magic.
Anyone has experience with UBCD?

PrakashC

Lucky Break!:slight_smile:

I have been trawling through posts on Windows 10 hoping to find a way to reach into the external HDD but without any success. However whenever I turn on the PC either with Leap 15.2 or Windows 10 I switch on the affected HDD hoping for a miracle.

Today while working with Windows 10 the drive suddenly showed signs of life! And I could access the data. After shutdown restarted with Leap and the HDD was still working. No idea what happened.

Thanks.

PrakashC

Fine. Of course make a backup of all on it as soon as possible.

The external drive is now readable. Ran the “journalctl --follow” command and switched on the external HDD. The output is as follows:

localhost:~ # journalctl --follow
-- Logs begin at Sat 2021-08-14 09:58:57 IST. --
Aug 14 12:19:13 localhost.localdomain systemd[1]: Starting Network Manager Script Dispatcher Service...
Aug 14 12:19:13 localhost.localdomain dbus-daemon[951]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Aug 14 12:19:13 localhost.localdomain systemd[1]: Started Network Manager Script Dispatcher Service.
Aug 14 12:19:39 localhost.localdomain kwin_x11[2116]: qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 303, resource id: 60817411, major code: 15 (QueryTree), minor code: 0
Aug 14 12:19:39 localhost.localdomain kwin_x11[2116]: qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 308, resource id: 60817411, major code: 18 (ChangeProperty), minor code: 0
Aug 14 12:19:39 localhost.localdomain kwin_x11[2116]: qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 581, resource id: 39846875, major code: 18 (ChangeProperty), minor code: 0
Aug 14 12:19:39 localhost.localdomain kwin_x11[2116]: qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 585, resource id: 58720261, major code: 18 (ChangeProperty), minor code: 0
Aug 14 12:20:14 localhost.localdomain kwin_x11[2116]: qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 3952, resource id: 39846970, major code: 18 (ChangeProperty), minor code: 0
Aug 14 12:20:24 localhost.localdomain su[4283]: (to root) prakash on pts/1
Aug 14 12:20:24 localhost.localdomain su[4283]: pam_unix(su-l:session): session opened for user root by prakash(uid=1000)
Aug 14 12:21:30 localhost.localdomain kernel: usb 2-1.4: new high-speed USB device number 3 using xhci_hcd
Aug 14 12:21:31 localhost.localdomain kernel: usb 2-1.4: New USB device found, idVendor=0bc2, idProduct=50a1, bcdDevice= 1.00
Aug 14 12:21:31 localhost.localdomain kernel: usb 2-1.4: New USB device strings: Mfr=2, Product=3, SerialNumber=1
Aug 14 12:21:31 localhost.localdomain kernel: usb 2-1.4: Product: FA GoFlex Desk
Aug 14 12:21:31 localhost.localdomain kernel: usb 2-1.4: Manufacturer: Seagate
Aug 14 12:21:31 localhost.localdomain kernel: usb 2-1.4: SerialNumber: NA0L4TLH
Aug 14 12:21:31 localhost.localdomain mtp-probe[4345]: checking bus 2, device 3: "/sys/devices/pci0000:00/0000:00:1c.1/0000:02:00.0/usb2/2-1/2-1.4"
Aug 14 12:21:31 localhost.localdomain mtp-probe[4345]: bus: 2, device: 3 was not an MTP device
Aug 14 12:21:31 localhost.localdomain kernel: usb-storage 2-1.4:1.0: USB Mass Storage device detected
Aug 14 12:21:31 localhost.localdomain kernel: scsi host4: usb-storage 2-1.4:1.0
Aug 14 12:21:31 localhost.localdomain kernel: usbcore: registered new interface driver usb-storage
Aug 14 12:21:31 localhost.localdomain kernel: usbcore: registered new interface driver uas
Aug 14 12:21:32 localhost.localdomain kernel: scsi 4:0:0:0: Direct-Access     Seagate  FA GoFlex Desk   0D0B PQ: 0 ANSI: 0
Aug 14 12:21:32 localhost.localdomain kernel: sd 4:0:0:0: Attached scsi generic sg2 type 0
Aug 14 12:21:32 localhost.localdomain kernel: sd 4:0:0:0: [sdc] 3907029167 512-byte logical blocks: (2.00 TB/1.82 TiB)
Aug 14 12:21:32 localhost.localdomain kernel: sd 4:0:0:0: [sdc] Write Protect is off
Aug 14 12:21:32 localhost.localdomain kernel: sd 4:0:0:0: [sdc] Mode Sense: 0f 00 00 00
Aug 14 12:21:32 localhost.localdomain kernel: sd 4:0:0:0: [sdc] No Caching mode page found
Aug 14 12:21:32 localhost.localdomain kernel: sd 4:0:0:0: [sdc] Assuming drive cache: write through
Aug 14 12:21:32 localhost.localdomain kernel:  sdc: sdc1
Aug 14 12:21:32 localhost.localdomain kernel: sd 4:0:0:0: [sdc] Attached SCSI disk
Aug 14 12:21:32 localhost.localdomain udisksd[1877]: Error probing device: Error sending ATA command IDENTIFY DEVICE to /dev/sdc: Unexpected sense data returned:
                                                     0000: 70 00 05 00  00 00 00 0a  00 00 00 00  20 00 00 00    p........... ...
                                                     0010: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00    ................
                                                      (g-io-error-quark, 0)

Request arvidjaar to kindly take a look and let me know if there are still some problems.
Thanks
PrakashC