TL;DR:
1TB NTFS secondary drive. Using GParted, resized main partition to be ~800GB. Created and wrote to new partition in the newly-unallocated space. Deleted new partition, attempted to resize new partition back to new size. GParted says:
Outside of the volume reference for inode 1248344 at 226331322:4014
Outside of the volume reference for inode 1248344 at 226352067:3749
.
.
.
Outside of the volume reference for inode 1248344 at 226380468:1506
100.00 percent completed
ERROR: Filesystem check failed!
ERROR: 236884 clusters are referenced outside of the volume.
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.
What do?
Not sure how much background information is relevant, so I'll start from the beginning.
Several years ago, I had a 1TB hdd with windows 10 on it. I later obtained a 240GB SSD, stuck windows on the first ~140GB of it, linux on the last ~100GB, and used the hdd as a secondary drive. Last spring, windows broke (I forget exactly how, but it didn't boot). I switched over to linux as my primary OS, and that was fine. I could still access all of the files on both the hdd and the windows partition.
Later, I finally ran out of room on the 100GB partition, so I "backed up" the windows partition with dd if=/dev/sdb1 of=/media/hdd/backuup/win10ssd.image (don't quote me on the exact names, but I'm 99% sure I used dd if=win10_partition of=path_on_hdd). Recently, I finally needed to access something that was on the windows partition, so I decided to get around to sticking that image onto a new partition. I had ~300 GB free on my hdd, so I had enough room to do it there.
Situation at this point: 1TB hdd has a 999GB NTFS partition on it (sde1). 136GiB image is stored on that as a regular file.
Here is the approximate sequence of events from that point onward:
- In GParted, I shrunk sde1 by ~150GiB.
- GParted needed to move data on sde1, I assume since it didn't have 150 contiguous GiB free at the end. It didn't give any major warnings, so I assumed that this was a relatively save operation (as much as messing around with raw drive data can be safe). This took a few hours.
- In GParted, I created a new partition (sde3) at the end of the unallocated space, and sized it to what I thought was the correct number of MiB.
sudo dd if=win10backup.image of=/dev/sde3. I realize now that this may have been doomed to fail regardless, due to differences in the original partition and the new partition (still don't really know much about this, idk what differences there would be, but it seems that it probably wouldn't have been that simple).- Turns out that this failed after copying most of the image because I made sde3 slightly too small. Probably made a dumb miscalculation with MiB vs MB or something like that.
- I wanted to resize sde3 to exactly the right size. With
fdisk -lI can see the exact byte count of the image, it's not an integer number of MiB, and GParted doesn't appear to work with increments smaller than MiB. - I closed GParted, and opened Ubuntu's Disks utility. This let me create a partition that was the right size, but I couldn't create it at the end of the unallocated space, only the beginning.
I think I created the partition, ran
ddagain to put the image on that partition, and then attempted to mount it. Unfortunately, the terminal that had all the output from most of this disappeared overnight. The only output that I still have isredacted@redacted:~$ sudo mount -o ro /dev/sde3 /mnt [sudo] password for redacted: Failed to read last sector (285778390): Invalid argument HINTS: Either the volume is a RAID/LDM but it wasn't setup yet, or it was not setup correctly (e.g. by not using mdadm --build ...), or a wrong device is tried to be mounted, or the partition table is corrupt (partition is smaller than NTFS), or the NTFS boot sector is corrupt (NTFS size is not valid). Failed to mount '/dev/sde3': Invalid argument The device '/dev/sde3' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?At this point, I read about loop devices. It seemed far simpler than messing around with partitions and whatnot, so I tried mounting the image directly with
sudo mount -t ntfs win10backup.image /mnt. This worked like a charm, and it looked like I could access all my files.- After seeing that work, I now planned to just temporarily mount the image whenever I needed to copy over a document from it to my main linux SSD. Not needing any new partitions anymore, I tried to resize sde1 to take up the currently-unallocated ~150GB again.
While GParted was running
ntfsresize -i -f -v '/dev/sde1', it spit out a bunch of errors, mostly saying "Outside of volume reference for inode 1248344 at #########:####". After several dozen of those lines, it saidERROR: Filesystem check failed!
ERROR: 236884 clusters are referenced outside of the volume.
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.This was the first indication I had seen so far that anything was wrong.
At this point, I realized that I may be in over my head. I have not touched a single drive-related thing (mounting, unmounting, gparted, etc.) since then.
My current main goal is to make sure that as many as possible of my useful files on the hdd and the image stored on the hdd are safe. None of them are of critical importance, but many cannot be replaced. I consider getting everything back to a normal state a stretch goal.
Current situation: 1TB hdd with very old installation of win10 on ~800MB partition, may be corrupted to some extent. Image of newer win10 partition stored in that partition. ~150GB unallocated space after that partition. 240GB SSD with Ubuntu on it, this drive is 100% fine as far as I know.
Ideal situation: All files that were stored on the hdd are freely accessible, and all free space on that drive can be used.
Less-than-ideal-but-still-okay situation: Important files on 1TB drive are accessible in some way, even if only to copy to another stable drive. The important files take up probably only a few of the ~500GB of files on there, so it's unlikely that more than a few of them are completely irrecoverable at this point.
Current things I'm considering doing:
- Buy a new hard drive, see if I can access the files on the old hard drive, and if so, copy the important ones to the new hard drive.
- Pros: should be likely to succeed, shouldn't have even a chance of making the current situation worse.
- Cons: need to buy a new drive, and wait for it to arrive.
- Attempt to boot up the windows 10 installation on sde1, and then probably run
chkdsk /fas GParted recommends.- Pros: may work? It's what GParted says to do.
- Cons: may not work at all, may screw stuff up even more.
- Stop touching stuff, continue as if nothing happened, hope nothing important was corrupted.
- Pros: easy to do, shouldn't make the current situation worse.
- Cons: doesn't fix anything, leaves 150GB unallocated and unusable.
- Continue screwing around with dd, gparted, etc. in the hopes that I manage to fix stuff somehow.
- Pros: fun, I'll learn things.
- Cons: relatively likely to break stuff even more, or at least prevent me from ever recovering stuff that may be recoverable right now.
How should I proceed? At this point, what is safe to do and what may not be safe? Is there any way to tell what inode 1248344 is, and is that the only thing that might be irrecoverable?
Ubuntu 18.04.
Here's the full GParted log from my attempt to resize sde1:
GParted 0.30.0 --enable-libparted-dmraid --enable-online-resize
Libparted 3.2
Delete /dev/sde3 (ntfs, 136.27 GiB) from /dev/sde 00:00:01 ( SUCCESS )
calibrate /dev/sde3 00:00:01 ( SUCCESS )
path: /dev/sde3 (partition)
start: 1605038080
end: 1890818047
size: 285779968 (136.27 GiB)
delete partition 00:00:00 ( SUCCESS )
========================================
Grow /dev/sde1 from 765.34 GiB to 931.07 GiB 00:00:34 ( ERROR )
calibrate /dev/sde1 00:00:00 ( SUCCESS )
path: /dev/sde1 (partition)
start: 63
end: 1605038079
size: 1605038017 (765.34 GiB)
check file system on /dev/sde1 for errors and (if possible) fix them 00:00:34 ( ERROR )
ntfsresize -i -f -v '/dev/sde1' 00:00:34 ( ERROR )
ntfsresize v2017.3.23 (libntfs-3g)
Device name : /dev/sde1
NTFS volume version: 3.1
Cluster size : 4096 bytes
Current volume size: 821779464704 bytes (821780 MB)
Current device size: 821779464704 bytes (821780 MB)
Checking for bad sectors ...
Checking filesystem consistency ...
Outside of the volume reference for inode 1248344 at 217445823:4033
Outside of the volume reference for inode 1248344 at 217455407:2641
Outside of the volume reference for inode 1248344 at 217470379:702
Outside of the volume reference for inode 1248344 at 217495177:842
Outside of the volume reference for inode 1248344 at 217511561:2185
Outside of the volume reference for inode 1248344 at 217536006:11
Outside of the volume reference for inode 1248344 at 217568711:167
Outside of the volume reference for inode 1248344 at 217597453:208
Outside of the volume reference for inode 1248344 at 217630118:156
Outside of the volume reference for inode 1248344 at 217654724:4028
Outside of the volume reference for inode 1248344 at 217675211:4021
Outside of the volume reference for inode 1248344 at 217679346:3982
Outside of the volume reference for inode 1248344 at 217695707:223
Outside of the volume reference for inode 1248344 at 217724338:335
Outside of the volume reference for inode 1248344 at 217740744:865
Outside of the volume reference for inode 1248344 at 225333850:4022
Outside of the volume reference for inode 1248344 at 225342046:4018
Outside of the volume reference for inode 1248344 at 225354383:3969
Outside of the volume reference for inode 1248344 at 225358503:3945
Outside of the volume reference for inode 1248344 at 225374941:3891
Outside of the volume reference for inode 1248344 at 225395366:3946
Outside of the volume reference for inode 1248344 at 225407666:3934
Outside of the volume reference for inode 1248344 at 225432169:4007
Outside of the volume reference for inode 1248344 at 225464904:4040
Outside of the volume reference for inode 1248344 at 225469000:4040
Outside of the volume reference for inode 1248344 at 225501762:4046
Outside of the volume reference for inode 1248344 at 225505858:4046
Outside of the volume reference for inode 1248344 at 225534530:4046
Outside of the volume reference for inode 1248344 at 225542715:4053
Outside of the volume reference for inode 1248344 at 225555012:4044
Outside of the volume reference for inode 1248344 at 225579592:4040
Outside of the volume reference for inode 1248344 at 225608260:4044
Outside of the volume reference for inode 1248344 at 225616457:4039
Outside of the volume reference for inode 1248344 at 225636958:4018
Outside of the volume reference for inode 1248344 at 225669721:4023
Outside of the volume reference for inode 1248344 at 225702472:4040
Outside of the volume reference for inode 1248344 at 225710843:3861
Outside of the volume reference for inode 1248344 at 225723433:3559
Outside of the volume reference for inode 1248344 at 225751680:3984
Outside of the volume reference for inode 1248344 at 225776218:4022
Outside of the volume reference for inode 1248344 at 225800795:4021
Outside of the volume reference for inode 1248344 at 225808992:4016
Outside of the volume reference for inode 1248344 at 225813090:4014
Outside of the volume reference for inode 1248344 at 225821341:3955
Outside of the volume reference for inode 1248344 at 225854689:3375
Outside of the volume reference for inode 1248344 at 225882712:4024
Outside of the volume reference for inode 1248344 at 225915651:3853
Outside of the volume reference for inode 1248344 at 225948247:4025
Outside of the volume reference for inode 1248344 at 225956444:4020
Outside of the volume reference for inode 1248344 at 225976946:3998
Outside of the volume reference for inode 1248344 at 225993333:3995
Outside of the volume reference for inode 1248344 at 226021994:4006
Outside of the volume reference for inode 1248344 at 226030186:4006
Outside of the volume reference for inode 1248344 at 226060971:4029
Outside of the volume reference for inode 1248344 at 226089666:4006
Outside of the volume reference for inode 1248344 at 226106041:4015
Outside of the volume reference for inode 1248344 at 226134703:4025
Outside of the volume reference for inode 1248344 at 226167491:4005
Outside of the volume reference for inode 1248344 at 226175685:4003
Outside of the volume reference for inode 1248344 at 226204338:4022
Outside of the volume reference for inode 1248344 at 226212528:4024
Outside of the volume reference for inode 1248344 at 226224829:4011
Outside of the volume reference for inode 1248344 at 226257583:4025
Outside of the volume reference for inode 1248344 at 226261687:4017
Outside of the volume reference for inode 1248344 at 226278072:4016
Outside of the volume reference for inode 1248344 at 226306727:4033
Outside of the volume reference for inode 1248344 at 226331322:4014
Outside of the volume reference for inode 1248344 at 226352067:3749
Outside of the volume reference for inode 1248344 at 226380468:1506
100.00 percent completed
ERROR: Filesystem check failed!
ERROR: 236884 clusters are referenced outside of the volume.
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.
========================================
I wish I had more logs and stuff, but all the terminals with the output of commands I ran have for some reason disappeared since last night.
