Monday, October 19, 2015

NTFS Partition disappeared after windows chkdsk

I dual boot Ubuntu and Windows 7, and share(d) a 3TB GUID NTFS partition between the two. This worked fine for ages.


Yesterday I did a large file copy from a suspect (perhaps failing) ext3 partition:


sudo cp -rp /media/user/failing_ext3/* /media/user/3TB/tmp/
sudo cp -rp /media/user/3TB/tmp/* /media/user/new_ext4_drive/

This worked fine, but I'm thinking now that copying from ext3 -> NTFS -> ext4 was a dumb idea and caused chkdsk to be run. I booted into windows 7 later, and barely noticed that chkdsk was running on bootup. Windows and linux now see an (almost) empty partition on the 3TB drive. From a bit of research, I figured chkdsk probably blew away the partition and the master file tree. There is a single Chkdsk log in a folder called /System Volume Information/Chkdsk:


Checking file system on I:
The type of the file system is NTFS.
Volume label is 3TB.
One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
Unable to query LCN from VCN 0x5 for attribute of type 0x80.
The non resident attribute of type 0x80 is inconsistent. The valid data
length is 0x1f380000, file size 0x1f380000, and allocated length 0x4000.
The non resident attribute of type 0x80 is inconsistent. The valid data
length is 0x1f380000, file size 0x4000, and allocated length 0x4000.
CHKDSK is verifying files (stage 1 of 3)...
Deleted corrupt attribute list entry
with type code 48 in file 0.
Unable to find child frs 0x10 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x17 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x11 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x12 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x13 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x14 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x15 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x16 with sequence number 0x1.
The attribute of type 0x80 and instance tag 0x1 in file 0x0
has allocated length of 0x1f380000 instead of 0x4000.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to locate attribute with instance tag 0x1 and segment
reference 0x1000000000000. The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 0.
16 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.
0 EA records processed.
Correcting file name errors in system file record segment 0.
0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
An index entry of index $I30 in file 0x5 points to file 0x47aa5
which is beyond the MFT.
Deleting index entry $RECYCLE.BIN in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x23
which is beyond the MFT.
Deleting index entry 1TB in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47aa1
which is beyond the MFT.
Deleting index entry System Volume Information in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47aa1
which is beyond the MFT.
Deleting index entry SYSTEM~1 in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47f78
which is beyond the MFT.
Deleting index entry tmp in index $I30 of file 5.
Index entry $ObjId of index $I30 in file 0xb points to unused file 0x19.
Deleting index entry $ObjId in index $I30 of file 11.
Index entry $Quota of index $I30 in file 0xb points to unused file 0x18.
Deleting index entry $Quota in index $I30 of file 11.
22 index entries processed.
Index entry $Reparse of index $I30 in file 0xb points to unused file 0x1a.
Deleting index entry $Reparse in index $I30 of file 11.
Index entry $RmMetadata of index $I30 in file 0xb points to unused file 0x1b.
Deleting index entry $RmMetadata in index $I30 of file 11.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
Creating object id file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 17.
The object id in file 0x3 does not appear in the object
id index in file 0x11.
Inserting an index entry into index $O of file 17.
Creating reparse point file.
Inserting an index entry into index $I30 of file 11.
Creating index $R for file 18.
Creating quota file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 19.
Creating index $Q for file 19.
Inserting default quota record into index $Q in file 19.
CHKDSK is verifying security descriptors (stage 3 of 3)...
24 file SDs/SIDs processed.
Cleaning up 27 unused index entries from index $SII of file 0x9.
Cleaning up 27 unused index entries from index $SDH of file 0x9.
Cleaning up 27 unused security descriptors.
Security descriptor verification completed.
Inserting data attribute into file 0.
4 data files processed.
The MFT mirror is different from the MFT.
Correcting errors in the Master File Table (MFT) mirror.
Correcting errors in the master file table's (MFT) DATA attribute.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
2861458 MB total disk space.
12 KB in 8 indexes.
0 KB in bad sectors.
155403 KB in use by the system.
65536 KB occupied by the log file.
2861307 MB available on disk.
4096 bytes in each allocation unit.
732533503 total allocation units on disk.
732494650 allocation units available on disk.
Internal Info:
10 00 00 00 10 00 00 00 0b 00 00 00 00 00 00 00 ................
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00

This issue has been asked about before, see:


Everything on my NTFS partition disappeared


Empty folders after NTFS file system recovery


I'm running TestDisk/PhotoRec and it's finding files, though without file names or directories; with 1.2TB of data it'll take a while to go through the whole drive. TestDisk did not find any deleted NTFS partitions (crap!). Some of the data is backed up, but it would be really nice to recover the file tree intact. Are there some decent recovery tools that can infer the file tree from millions of intact files? I'm not hopeful, but perhaps some good Samaritan can suggest what might work in this particular situation.

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...