1

I'm on Debian Jessie and I have an external USB drive with NTFS. I plugged it into my Raspberry Pi, which then spontaneously restarted (probably the power consumption was too high for the adapter I'm using). Since then I cannot access my USB drive anymore. I tried to fix it on my regular computer with

sudo ntfsfix /dev/sdb1

but it would only tell me

Volume is corrupt. You should run chkdsk.

I got hold of a Windows computer, but it cannot detect the drive either. Here's some more information:

$ ll /dev/sd*
> brw-rw---- 1 root disk 8,  0 Oct 28 12:07 /dev/sda
> brw-rw---- 1 root disk 8,  1 Oct 28 12:07 /dev/sda1
> brw-rw---- 1 root disk 8,  2 Oct 28 12:07 /dev/sda2
> brw-rw---- 1 root disk 8,  5 Oct 28 12:07 /dev/sda5
> brw-rw---- 1 root disk 8, 16 Oct 28 12:16 /dev/sdb
> brw-rw---- 1 root disk 8, 18 Oct 28 12:16 /dev/sdb2
> brw-rw---- 1 root disk 8, 19 Oct 28 12:16 /dev/sdb3

$ sudo fdisk -l
> Disk /dev/sda: 232.9 GiB, 250059350016 bytes, 488397168 sectors
> Units: sectors of 1 * 512 = 512 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> Disklabel type: dos
> Disk identifier: 0x0007f3b4
> 
> Device     Boot     Start       End   Sectors   Size Id Type
> /dev/sda1  *         2048 472016895 472014848 225.1G 83 Linux
> /dev/sda2       472018942 488396799  16377858   7.8G  5 Extended
> /dev/sda5       472018944 488396799  16377856   7.8G 82 Linux swap / Solaris

> Disk /dev/sdb: 1.8 TiB, 2000365289472 bytes, 3906963456 sectors
> Units: sectors of 1 * 512 = 512 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> Disklabel type: dos
> Disk identifier: 0x6e697373
> 
> Device     Boot      Start        End    Sectors   Size Id Type
> /dev/sdb1  ?    1936269394 3772285809 1836016416 875.5G 4f QNX4.x 3rd part
> /dev/sdb2  ?    1917848077 2462285169  544437093 259.6G 73 unknown
> /dev/sdb3  ?    1818575915 2362751050  544175136 259.5G 2b unknown
> /dev/sdb4  ?    2844524554 2844579527      54974  26.9M 61 SpeedStor
> 
> Partition table entries are not in disk order.

$ cat /etc/fstab 
> # /etc/fstab: static file system information.
> #
> # Use 'blkid' to print the universally unique identifier for a
> # device; this may be used with UUID= as a more robust way to name devices
> # that works even if disks are added and removed. See fstab(5).
> #
> # <file system> <mount point>   <type>  <options>       <dump>  <pass>
> # / was on /dev/sda1 during installation
> UUID=4b0d4c23-d659-4d16-9396-b895c4964b12 /               ext4    errors=remount-ro 0       1
> # swap was on /dev/sda5 during installation
> UUID=2cc71c90-2d55-4f49-bdb0-b25166d77014 none            swap    sw              0       0
> /dev/sdb1       /media/usb0     auto    rw,user,noauto  0       0

The partition should be /dev/sdb1, but as you can see it's not in /dev. Also, I don't understand why fdisk is saying its type is QNX4.x 3rd part. Any help how I can at least retrieve the files on the disk?

1

If you are able to read the raw data off the disk, you can use dd to create a clone of your disk (or dd_rescue, if dd fails). Then, you can use a file carver like foremost (which, for me, produced good results on both formatted and corrupted partitions).

To use foremost, you should have at least 2.5 times the size of your partition to recover as free space (you need space for the partition image and space for the carved files).

Especially if you deal with a corrupted device, it is mandatory to create an image of it to work on (prevents data loss by accidentally overwriting the device and minimizes data loss due to device malfunction).

The disadvantage of a file carver is that you may need to manually reconstruct files out of pieces of it or you need to use alternative data (like, for example, the preview of a JFIF image you cannot reconstruct).

Specifically for NTFS, you could also try a tool like Stellar Phoenix NTFS Data Recovery (which I have not tested or used).

0

As can be seen by the fdisk command, the partition table was all messed up. This probably happened because the power on the drive was cut while it tried to access it. I installed testdisk, then ran

sudo testdisk /dev/sdb

After a quick analysis, the disk was properly recognized as being an ntfs disk with only one partition, as opposed to the four partitions suggested by fdisk. Rewriting the partition table with testdisk fixed the issue. I now have access to all files, as if nothing ever happened.

Source: https://linuxacademy.com/blog/linux/ntfs-partition-repair-and-recovery-in-linux/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.