Accessing your Windows partitions from Linux

• Finding your NTFS partition
• Basic NTFS access from Linux
• Read/Write NTFS access from Linux
  • Preparing the Module
  • Gathering ntoskrnl.exe and ntfs.sys
  • Mounting a Captive NTFS Partition

Most Linux distributions come with a read-only NTFS driver. The documentation for NTFS is fairly incomplete, and no one has taken the task of reverse engineering write support just yet. Thankfully, there is a way to mount an NTFS disk as read-only, and then use the Windows NTFS driver that it finds on the disk to mount the disk for full read/write access.

Finding your NTFS partition

The first step is finding the name of the NTFS partition. Your distribution may have shipped with some nice graphical tools to do this already. In SUSE, I would use YaST. In our example, we will use a command-line that works with all Linux distributions.

First, IDE disks in Linux are named hd[a-z]. SCSI and Serial ATA drives are named sd[a-z]. hda is your first IDE disk. If you type "df /", you will see what disk your Linux partition is on:

% df -h /
Filesystem            Size  Used Avail Use% Mounted on
/dev/hda3              28G   17G   12G  59% /

In this case, Linux is installed on the 3rd partition of hda. To see what is on the other partitions of the hard disk, you can use fdisk -l (as root).

% sudo /sbin/fdisk -l /dev/hda

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1            6011        6135     1004062+  82  Linux swap / Solaris
/dev/hda2   *           5        6010    48235441+   7  HPFS/NTFS
/dev/hda3            6136        9729    28868805   83  Linux

I now know that my NTFS partition is on /dev/hda2, and can move on to mounting it.

Basic NTFS access from Linux

First, we will go for read-only access to your NTFS disk. We will need to use this read-only access to get access you the NTFS read-write drivers that Windows comes with. Read-only access is really easy. In this example, I will only make the NTFS partition available to my username, tstrombe:

% sudo mkdir /C
% sudo mount -o uid=tstrombe /dev/hda2 /C

Now if I go to /C, I will be accessing my NTFS partition. If you only want to have read-only access to NTFS, lets make this change permanent by adding this line into /etc/fstab:

/dev/hda2   /C     ntfs     uid=tstrombe        0 0

The drive will now automatically mount at bootup. To test this, unmount your partition before, and remount it using the information from fstab:

% sudo umount /C
% sudo mount /C

Read/Write NTFS access from Linux

Now that you've got your NTFS drive mounted at /C, we will go for full read/write access. Download the latest RPM from the Captive NTFS website, assuming you are running a supported operating system. Otherwise, you'll have to compile it yourself. Once the RPM has been downloaded, install the rpm as root:

sudo rpm -i captive-static-1.1.5-0.i386.rpm 

Preparing the Module

You will need to prepare the Captive NTFS driver before you can use it. If you are running an operating system version listed on the Captive page, such as SUSE 9.1, this is the only step you have to do:

/usr/share/lufs/prepmod

If it gives you an error at the end, you probably don't have a supported version. In my case, I'm running SUSE 9.2, which is not supported. You will need to rebuild the modules for your kernel, which may take 15-20 minutes. It goes a little something like this:

cd /lib/modules/`(uname -r)`
mv build build.bak
ln -s /usr/src/linux build
cd /usr/src/linux
make cloneconfig
make modules

Then run prepmod, and you should be gold. If not, consider downloading and compiling the source code to Captive NTFS yourself.

Gathering ntoskrnl.exe and ntfs.sys

Now we need to copy the ntoskrnl.exe and ntfs.sys files from your Windows partition so that we can emulate it. Thankfully, Captive NTFS includes a program that finds these drivers on your Windows drive. In my experience, it requires a little bit of hand-holding, however. To start it, type:

% sudo /usr/sbin/captive-install-acquire

It will then ask you if you wish to automatically scan your drives. This did not work for me. I told it No until I got to the point where it asked me where I would like to start my search. For this step, make sure that /C from the read-only example has been mounted successfully. I told it to search through /C/WINDOWS:

Do you want to enter your custom search path and/or files? You can also enter web URL.
Enter pathname or URL [hit ENTER to skip it]: /C/WINDOWS

It proceeded to find the best versions it could. The script also asks if you would like to just download XP SP1a from Microsofts website to find them, to which I answered "d" for done (don't download them, thanks).

Mounting a Captive NTFS Partition

It then prepared an fstab entry for me to use, though I didn't like the name of the partition. If you made a read-only fstab entry before, you can comment this out now by putting a # sign in front of the line:

/dev/hda2   /C     ntfs     uid=tstrombe        0 0

I then changed the line that Captive NTFS created for me, so that it mounted at /C and ran automatically. This is what it looked like originally:

/dev/hda2 /mnt/captive-noname captive-ntfs defaults,noauto 0 0

and this is what I changed it to:

/dev/hda2 /C captive-ntfs defaults,uid=tstrombe 0 0

To try out your lovely new mount, simply type:

mount /C