0

I have a laptop with SSD which has Windows 10 installed. I booted the laptop from USB flash drive into Ubuntu 14.04.3 and tried to find out the file system on partition 4. According to gdisk it has partition code 0x0700, which means that it is 0x07(0x0700/0x0100) in MBR codes which means HPFS/NTFS/exFAT. This is in accord with gdisk manual which says that codes for all varieties of FAT and NTFS partition correspond to a single GPT code(entered as 0x0700 in sgfdisk). According to parted it's msftdata. Parted seems to gather its information by looking the data from partition. fdisk -s /dev/sda4, which uses the same principle as parted, finds that the file-system is PE32 executable. Finally I tried to get any additional information with ntfsinfo, but looks like that ntfsinfo wants the file-system to be mounted:

ntfsinfo

For example dumpe2fs can be used on unmounted file-systems. One could assume that this is a NTFS partition, but for some reason the partition is not mounted:

mount

In short, how to determine Windows file-system on GPT disk partition? Or is there a way to check from Linux if this partition is encrypted?

1

If the kernel will support mounting it, you can just try

mkdir /mnt/tmp
mount /dev/sda4 /mnt/tmp

and then do df -T to check it.

If not, you could try file -s /dev/sda4 to get more information.

  • Unfortunately I'm not able to mount this partition. I use NTFS driver version 2.1.31 and mount -t ntfs /dev/sda4 /mnt results in NTFS signature is missing. I added additional information to my initial post. – Martin Sep 1 '15 at 22:24
  • 1
    If the kernel's autodetect fails (as is indicated by the You must specify the filesystem type message), then file -s may provide some information. If not (it says data without more details if it can't identify the argument) then you would have to make an educated guess from research, then find out how to identify that hypothetical filesystem. – Tom Hunt Sep 1 '15 at 22:26
  • As seen in my initial post, file -s /dev/sda4 says P32 executable (native) Intel 80386, for MS Windows. I'm afraid that the file-system in encrypted, but I don't know how to check this from Linux or this is possible at all.. – Martin Sep 1 '15 at 23:03
  • file is probably picking up the Windows boot sector/bootloader, then, and not FS stuff. All I can recommend is to research what it could be, then try to find individual checking methods for the possibilities. – Tom Hunt Sep 2 '15 at 3:56
0

Turned out, that file-system on /dev/sda4 partition was corrupted and not encrypted. I was able to fix the partition with ntfsfix /dev/sda4. Output of file -s /dev/sda4 and ntfsinfo once the file-system is fixed can be seen below:

root@ubuntu:~# file -s /dev/sda4
/dev/sda4: x86 boot sector
root@ubuntu:~# ntfsinfo -vm /dev/sda4 | head
Volume Information 
    Name of device: /dev/sda4
    Device state: 11
    Volume Name: 
    Volume State: 91
    Volume Flags: 0x0000
    Volume Version: 3.1
    Sector Size: 512
    Cluster Size: 4096
    Index Block Size: 4096
root@ubuntu:~# 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.