2

I'm trying to recover data from a Windows (NTFS) disk that became unreadable for some reason. I'm doing this from within a Linux Mint environment.

I can see the partitions normally, and I also see the correct free space of the disk. However, mounting it gives problems:

> sudo ntfs-3g -o force,rw /dev/sdc1 /media/windows2
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).

> ls /media/windows2 
ls: cannot access /media/windows2: Input/output error

I already tried running testdisk:

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
     Partition               Start        End    Size in sectors
>* HPFS - NTFS              0  32 33    25 126 37     407552
 P HPFS - NTFS             25 126 38 60797  59 62  976297984

If I choose list files, I see a couple of files/directories but far from all. If I go to undelete, I see some files, mainly temporary internet files, which likely indeed were removed. I don't seem to have a way to see the remaining actual files.

I already tried to rebuild the boot sector and check the MFT in checkdisk, but this didn't help.

I also tried running ntfsfix:

> sudo ntfsfix /dev/sdc1
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sdc1 was processed successfully.

There seems to be nothing physically wrong with the disk:

> sudo badblocks /dev/sdc -sv
Checking blocks 0 to 488386582
Checking for bad blocks (read-only test): 
done                                                 
Pass completed, 0 bad blocks found. (0/0/0 errors)

Is there anything else I could try to get access to the files?

  • 1
    Do you have a spare drive of same or bigger size? I'd do the image of said disk (with dd), and I'd try to restore the data from the image, not from the disk itself. – Mikhail Krutov Mar 30 '16 at 17:49
  • Input/Output error indicates a hardware failure. Restore from backup onto a new drive is the best remedy. – Anthon Mar 30 '16 at 17:55
  • No hardware failure, I managed to fix this by using chkdsk in Windows. – Matthijs Melissen Mar 30 '16 at 22:49
1

To recover data you can try photorec PhotoRec_Step_By_Step

Edit Try to check badblocks

Use df -h command to find device name of your hard disk,also fdisk -l will help to find information on disk drives and run the following command , e,g

/sbin/badblocks -v /dev/hda

Next step try to fix the NTFS partition , umount the partition and type

ntfsfix /dev/hdaX
  • 1
    I've used it as well to recover data from failed NTFS drive. +1. – Mikhail Krutov Mar 30 '16 at 18:01
  • Thanks, but I already ran badblocks and ntfsfix, as per my original comment. – Matthijs Melissen Mar 30 '16 at 19:21
1

In the end, I gave up solving the problem from Linux, and tried it from Windows. That turned out to be a good idea: running chkdsk solved the problem.

  • If you managed to do that with chkdsk, it means that the file system was almost intact and the damage was very slight. Anyway, you should accept an answer, even if it is yours. – Andrea Lazzarotto Apr 17 '16 at 18:58
0

For this task You can try also testdisk.

  • I specified in my comment that I used testdisk, and which options I used. Do you have a more specific recommendation on the use of testdisk? – Matthijs Melissen Mar 30 '16 at 19:19
0

The following content is from the Arch wiki:

TestDisk is primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses, or human error, such as the accidental deletion of partition tables.

PhotoRec is file recovery software designed to recover lost files including photographs (Hint: PhotographRecovery), videos, documents, archives from hard disks and CD-ROMs. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even with a re-formatted or severely damaged filesystems and/or partition tables.

Please read that article, it has a lot of good options.

Best of luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.