Recovering Wubi disk images

I previously waxed lyrical about Wubi as a nice way of getting Ubuntu on your Windows laptop without having to repartition your hard drive. It achieves this task by storing the partition as a disk image on your NTFS partition. However, I have recently discovered a major drawback of this approach. On the return leg of my journey, my laptop NTFS partition slowly started to die. Windows wouldn’t boot but the Linux partition was OK. However a few days later, I couldn’t boot Linux either. I am not sure yet if it is a hard drive problem or a file system problem but things were getting desperate as I had all my trip photos and videos on this disk!
Foolishly I ran CHKDSK in /R mode which decided to delete my root.disk index entry. Doh! I tried the various NTFS recovery utilities but to no avail. There are so many worthless (or expensive) file system recovery problems for Windows, I thought I might have better luck with a Linux utility.

In steps the excellent magicrescue. This utility can recover files based on a signature in the file header, similar to the way the Linux utility file works. However, to get it working you need to build a recipe which will identify Linux file system images. After a bit of hacking and with reference to /usr/share/misc/magic I constructed this one, which seemed to work:

1080 char x53
1081 char xef
1100 char x01
1124 char x03
command ./writenbytes.py 42949672960 $1

The accompanying Python script simply extracts N bytes from stdin and writes it to a file.

#!/usr/bin/python
import sys
import os
max = int(sys.argv[1])
fh = open(sys.argv[2], "w")
n = 0
while 1:
 if n == max:
  break
 data = sys.stdin.read(1024)
 n += len(data)
 if not data:
  break
 fh.write(data)
fh.close()

I found that this recipe extracted 4 potential files from the corrupt file system, of which one of them was my root.disk partition. Magicrescue has no way of identifying the end of a file, so I decided that I would extract to a file somewhat larger than the partition size (about 30Gb). After that has completed you can fix the partition by using e2fsck -f root.disk and then resize2fs. Job done!

Leave a Reply

Your email address will not be published.