2

TL;DR:

1TB NTFS secondary drive. Using GParted, resized main partition to be ~800GB. Created and wrote to new partition in the newly-unallocated space. Deleted new partition, attempted to resize new partition back to new size. GParted says:

Outside of the volume reference for inode 1248344 at 226331322:4014
Outside of the volume reference for inode 1248344 at 226352067:3749
.
.
.
Outside of the volume reference for inode 1248344 at 226380468:1506
100.00 percent completed
ERROR: Filesystem check failed!
ERROR: 236884 clusters are referenced outside of the volume.
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.

What do?


Not sure how much background information is relevant, so I'll start from the beginning.

Several years ago, I had a 1TB hdd with windows 10 on it. I later obtained a 240GB SSD, stuck windows on the first ~140GB of it, linux on the last ~100GB, and used the hdd as a secondary drive. Last spring, windows broke (I forget exactly how, but it didn't boot). I switched over to linux as my primary OS, and that was fine. I could still access all of the files on both the hdd and the windows partition.

Later, I finally ran out of room on the 100GB partition, so I "backed up" the windows partition with dd if=/dev/sdb1 of=/media/hdd/backuup/win10ssd.image (don't quote me on the exact names, but I'm 99% sure I used dd if=win10_partition of=path_on_hdd). Recently, I finally needed to access something that was on the windows partition, so I decided to get around to sticking that image onto a new partition. I had ~300 GB free on my hdd, so I had enough room to do it there.

Situation at this point: 1TB hdd has a 999GB NTFS partition on it (sde1). 136GiB image is stored on that as a regular file.

Here is the approximate sequence of events from that point onward:

  • In GParted, I shrunk sde1 by ~150GiB.
  • GParted needed to move data on sde1, I assume since it didn't have 150 contiguous GiB free at the end. It didn't give any major warnings, so I assumed that this was a relatively save operation (as much as messing around with raw drive data can be safe). This took a few hours.
  • In GParted, I created a new partition (sde3) at the end of the unallocated space, and sized it to what I thought was the correct number of MiB.
  • sudo dd if=win10backup.image of=/dev/sde3. I realize now that this may have been doomed to fail regardless, due to differences in the original partition and the new partition (still don't really know much about this, idk what differences there would be, but it seems that it probably wouldn't have been that simple).
  • Turns out that this failed after copying most of the image because I made sde3 slightly too small. Probably made a dumb miscalculation with MiB vs MB or something like that.
  • I wanted to resize sde3 to exactly the right size. With fdisk -l I can see the exact byte count of the image, it's not an integer number of MiB, and GParted doesn't appear to work with increments smaller than MiB.
  • I closed GParted, and opened Ubuntu's Disks utility. This let me create a partition that was the right size, but I couldn't create it at the end of the unallocated space, only the beginning.
  • I think I created the partition, ran dd again to put the image on that partition, and then attempted to mount it. Unfortunately, the terminal that had all the output from most of this disappeared overnight. The only output that I still have is

    redacted@redacted:~$ sudo mount -o ro /dev/sde3 /mnt
    [sudo] password for redacted: 
    Failed to read last sector (285778390): Invalid argument
    HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
       or it was not setup correctly (e.g. by not using mdadm --build ...),
       or a wrong device is tried to be mounted,
       or the partition table is corrupt (partition is smaller than NTFS),
       or the NTFS boot sector is corrupt (NTFS size is not valid).
    Failed to mount '/dev/sde3': Invalid argument
    The device '/dev/sde3' doesn't seem to have a valid NTFS.
    Maybe the wrong device is used? Or the whole disk instead of a
    partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
    
  • At this point, I read about loop devices. It seemed far simpler than messing around with partitions and whatnot, so I tried mounting the image directly with sudo mount -t ntfs win10backup.image /mnt. This worked like a charm, and it looked like I could access all my files.

  • After seeing that work, I now planned to just temporarily mount the image whenever I needed to copy over a document from it to my main linux SSD. Not needing any new partitions anymore, I tried to resize sde1 to take up the currently-unallocated ~150GB again.
  • While GParted was running ntfsresize -i -f -v '/dev/sde1', it spit out a bunch of errors, mostly saying "Outside of volume reference for inode 1248344 at #########:####". After several dozen of those lines, it said

    ERROR: Filesystem check failed!
    ERROR: 236884 clusters are referenced outside of the volume.
    NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
    The usage of the /f parameter is very IMPORTANT! No modification was
    and will be made to NTFS by this software until it gets repaired.

    This was the first indication I had seen so far that anything was wrong.

At this point, I realized that I may be in over my head. I have not touched a single drive-related thing (mounting, unmounting, gparted, etc.) since then.

My current main goal is to make sure that as many as possible of my useful files on the hdd and the image stored on the hdd are safe. None of them are of critical importance, but many cannot be replaced. I consider getting everything back to a normal state a stretch goal.


Current situation: 1TB hdd with very old installation of win10 on ~800MB partition, may be corrupted to some extent. Image of newer win10 partition stored in that partition. ~150GB unallocated space after that partition. 240GB SSD with Ubuntu on it, this drive is 100% fine as far as I know.

Ideal situation: All files that were stored on the hdd are freely accessible, and all free space on that drive can be used.

Less-than-ideal-but-still-okay situation: Important files on 1TB drive are accessible in some way, even if only to copy to another stable drive. The important files take up probably only a few of the ~500GB of files on there, so it's unlikely that more than a few of them are completely irrecoverable at this point.

Current things I'm considering doing:

  1. Buy a new hard drive, see if I can access the files on the old hard drive, and if so, copy the important ones to the new hard drive.
    • Pros: should be likely to succeed, shouldn't have even a chance of making the current situation worse.
    • Cons: need to buy a new drive, and wait for it to arrive.
  2. Attempt to boot up the windows 10 installation on sde1, and then probably run chkdsk /f as GParted recommends.
    • Pros: may work? It's what GParted says to do.
    • Cons: may not work at all, may screw stuff up even more.
  3. Stop touching stuff, continue as if nothing happened, hope nothing important was corrupted.
    • Pros: easy to do, shouldn't make the current situation worse.
    • Cons: doesn't fix anything, leaves 150GB unallocated and unusable.
  4. Continue screwing around with dd, gparted, etc. in the hopes that I manage to fix stuff somehow.
    • Pros: fun, I'll learn things.
    • Cons: relatively likely to break stuff even more, or at least prevent me from ever recovering stuff that may be recoverable right now.

How should I proceed? At this point, what is safe to do and what may not be safe? Is there any way to tell what inode 1248344 is, and is that the only thing that might be irrecoverable?


Ubuntu 18.04.

Here's the full GParted log from my attempt to resize sde1:

GParted 0.30.0 --enable-libparted-dmraid --enable-online-resize

Libparted 3.2

Delete /dev/sde3 (ntfs, 136.27 GiB) from /dev/sde  00:00:01    ( SUCCESS )
  calibrate /dev/sde3  00:00:01    ( SUCCESS )
    path: /dev/sde3 (partition)
    start: 1605038080
    end: 1890818047
    size: 285779968 (136.27 GiB)
  delete partition  00:00:00    ( SUCCESS )

========================================

Grow /dev/sde1 from 765.34 GiB to 931.07 GiB  00:00:34    ( ERROR )
  calibrate /dev/sde1  00:00:00    ( SUCCESS )
    path: /dev/sde1 (partition)
    start: 63
    end: 1605038079
    size: 1605038017 (765.34 GiB)

  check file system on /dev/sde1 for errors and (if possible) fix them  00:00:34    ( ERROR )
    ntfsresize -i -f -v '/dev/sde1'  00:00:34    ( ERROR )
      ntfsresize v2017.3.23 (libntfs-3g)
      Device name : /dev/sde1
      NTFS volume version: 3.1
      Cluster size : 4096 bytes
      Current volume size: 821779464704 bytes (821780 MB)
      Current device size: 821779464704 bytes (821780 MB)
      Checking for bad sectors ...
      Checking filesystem consistency ...
      Outside of the volume reference for inode 1248344 at 217445823:4033
      Outside of the volume reference for inode 1248344 at 217455407:2641
      Outside of the volume reference for inode 1248344 at 217470379:702
      Outside of the volume reference for inode 1248344 at 217495177:842
      Outside of the volume reference for inode 1248344 at 217511561:2185
      Outside of the volume reference for inode 1248344 at 217536006:11
      Outside of the volume reference for inode 1248344 at 217568711:167
      Outside of the volume reference for inode 1248344 at 217597453:208
      Outside of the volume reference for inode 1248344 at 217630118:156
      Outside of the volume reference for inode 1248344 at 217654724:4028
      Outside of the volume reference for inode 1248344 at 217675211:4021
      Outside of the volume reference for inode 1248344 at 217679346:3982
      Outside of the volume reference for inode 1248344 at 217695707:223
      Outside of the volume reference for inode 1248344 at 217724338:335
      Outside of the volume reference for inode 1248344 at 217740744:865
      Outside of the volume reference for inode 1248344 at 225333850:4022
      Outside of the volume reference for inode 1248344 at 225342046:4018
      Outside of the volume reference for inode 1248344 at 225354383:3969
      Outside of the volume reference for inode 1248344 at 225358503:3945
      Outside of the volume reference for inode 1248344 at 225374941:3891
      Outside of the volume reference for inode 1248344 at 225395366:3946
      Outside of the volume reference for inode 1248344 at 225407666:3934
      Outside of the volume reference for inode 1248344 at 225432169:4007
      Outside of the volume reference for inode 1248344 at 225464904:4040
      Outside of the volume reference for inode 1248344 at 225469000:4040
      Outside of the volume reference for inode 1248344 at 225501762:4046
      Outside of the volume reference for inode 1248344 at 225505858:4046
      Outside of the volume reference for inode 1248344 at 225534530:4046
      Outside of the volume reference for inode 1248344 at 225542715:4053
      Outside of the volume reference for inode 1248344 at 225555012:4044
      Outside of the volume reference for inode 1248344 at 225579592:4040
      Outside of the volume reference for inode 1248344 at 225608260:4044
      Outside of the volume reference for inode 1248344 at 225616457:4039
      Outside of the volume reference for inode 1248344 at 225636958:4018
      Outside of the volume reference for inode 1248344 at 225669721:4023
      Outside of the volume reference for inode 1248344 at 225702472:4040
      Outside of the volume reference for inode 1248344 at 225710843:3861
      Outside of the volume reference for inode 1248344 at 225723433:3559
      Outside of the volume reference for inode 1248344 at 225751680:3984
      Outside of the volume reference for inode 1248344 at 225776218:4022
      Outside of the volume reference for inode 1248344 at 225800795:4021
      Outside of the volume reference for inode 1248344 at 225808992:4016
      Outside of the volume reference for inode 1248344 at 225813090:4014
      Outside of the volume reference for inode 1248344 at 225821341:3955
      Outside of the volume reference for inode 1248344 at 225854689:3375
      Outside of the volume reference for inode 1248344 at 225882712:4024
      Outside of the volume reference for inode 1248344 at 225915651:3853
      Outside of the volume reference for inode 1248344 at 225948247:4025
      Outside of the volume reference for inode 1248344 at 225956444:4020
      Outside of the volume reference for inode 1248344 at 225976946:3998
      Outside of the volume reference for inode 1248344 at 225993333:3995
      Outside of the volume reference for inode 1248344 at 226021994:4006
      Outside of the volume reference for inode 1248344 at 226030186:4006
      Outside of the volume reference for inode 1248344 at 226060971:4029
      Outside of the volume reference for inode 1248344 at 226089666:4006
      Outside of the volume reference for inode 1248344 at 226106041:4015
      Outside of the volume reference for inode 1248344 at 226134703:4025
      Outside of the volume reference for inode 1248344 at 226167491:4005
      Outside of the volume reference for inode 1248344 at 226175685:4003
      Outside of the volume reference for inode 1248344 at 226204338:4022
      Outside of the volume reference for inode 1248344 at 226212528:4024
      Outside of the volume reference for inode 1248344 at 226224829:4011
      Outside of the volume reference for inode 1248344 at 226257583:4025
      Outside of the volume reference for inode 1248344 at 226261687:4017
      Outside of the volume reference for inode 1248344 at 226278072:4016
      Outside of the volume reference for inode 1248344 at 226306727:4033
      Outside of the volume reference for inode 1248344 at 226331322:4014
      Outside of the volume reference for inode 1248344 at 226352067:3749
      Outside of the volume reference for inode 1248344 at 226380468:1506
      100.00 percent completed
      ERROR: Filesystem check failed!
      ERROR: 236884 clusters are referenced outside of the volume.
      NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
      The usage of the /f parameter is very IMPORTANT! No modification was
      and will be made to NTFS by this software until it gets repaired.

========================================

I wish I had more logs and stuff, but all the terminals with the output of commands I ran have for some reason disappeared since last night.

0

I would first make a backup by copying all files from the partition to somewhere else, or taking an image of the partition (even using dd if other tools fail). Then use Rufus to put a Windows installer (which you can legally download from Microsoft) onto a flash drive, boot from that, and run chkdsk from there. It will tell you which files it deleted in order to fix the "outside of the volume reference for inode" errors. The you can try to copy those files back manually, if they matter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.