5

I'm trying to recover data from a Windows (NTFS) disk that became unreadable for some reason. I'm doing this from within a Linux Mint environment.

I can see the partitions normally, and I also see the correct free space of the disk. However, mounting it gives problems:

> sudo ntfs-3g -o force,rw /dev/sdc1 /media/windows2
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).

> ls /media/windows2 
ls: cannot access /media/windows2: Input/output error

I already tried running testdisk:

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
     Partition               Start        End    Size in sectors
>* HPFS - NTFS              0  32 33    25 126 37     407552
 P HPFS - NTFS             25 126 38 60797  59 62  976297984

If I choose list files, I see a couple of files/directories but far from all. If I go to undelete, I see some files, mainly temporary internet files, which likely indeed were removed. I don't seem to have a way to see the remaining actual files.

I already tried to rebuild the boot sector and check the MFT in checkdisk, but this didn't help.

I also tried running ntfsfix:

> sudo ntfsfix /dev/sdc1
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sdc1 was processed successfully.

There seems to be nothing physically wrong with the disk:

> sudo badblocks /dev/sdc -sv
Checking blocks 0 to 488386582
Checking for bad blocks (read-only test): 
done                                                 
Pass completed, 0 bad blocks found. (0/0/0 errors)

Is there anything else I could try to get access to the files?

Improve this question
3
  • 1
    Do you have a spare drive of same or bigger size? I'd do the image of said disk (with dd), and I'd try to restore the data from the image, not from the disk itself.
    – Mikhail Krutov
    Commented Mar 30, 2016 at 17:49
  • Input/Output error indicates a hardware failure. Restore from backup onto a new drive is the best remedy.
    – Anthon
    Commented Mar 30, 2016 at 17:55
  • No hardware failure, I managed to fix this by using chkdsk in Windows.
    – Matthijs Melissen
    Commented Mar 30, 2016 at 22:49

4 Answers 4

Reset to default
2

In the end, I gave up solving the problem from Linux, and tried it from Windows. That turned out to be a good idea: running chkdsk solved the problem.

Improve this answer
1
  • If you managed to do that with chkdsk, it means that the file system was almost intact and the damage was very slight. Anyway, you should accept an answer, even if it is yours.
    – Andrea Lazzarotto
    Commented Apr 17, 2016 at 18:58
1

The following content is from the Arch wiki:

TestDisk is primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses, or human error, such as the accidental deletion of partition tables.

PhotoRec is file recovery software designed to recover lost files including photographs (Hint: PhotographRecovery), videos, documents, archives from hard disks and CD-ROMs. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even with a re-formatted or severely damaged filesystems and/or partition tables.

Please read that article, it has a lot of good options.

Best of luck!

Improve this answer
1

To recover data you can try photorec PhotoRec_Step_By_Step

Edit Try to check badblocks

Use df -h command to find device name of your hard disk,also fdisk -l will help to find information on disk drives and run the following command , e,g 

/sbin/badblocks -v /dev/hda

Next step try to fix the NTFS partition , umount the partition and type

ntfsfix /dev/hdaX
Improve this answer
2
  • 1
    I've used it as well to recover data from failed NTFS drive. +1.
    – Mikhail Krutov
    Commented Mar 30, 2016 at 18:01
  • Thanks, but I already ran badblocks and ntfsfix, as per my original comment.
    – Matthijs Melissen
    Commented Mar 30, 2016 at 19:21
0

For this task You can try also testdisk.

Improve this answer
1
  • I specified in my comment that I used testdisk, and which options I used. Do you have a more specific recommendation on the use of testdisk?
    – Matthijs Melissen
    Commented Mar 30, 2016 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .