How To Fix an NTFS Drive?

abrogard · 07-15-2020, 07:50 PM

I have this win10 system drive that suddenly wouldn't boot and windows couldn't even see it.

Put it on my Mint system. Mint could see it and reported it couldn't be mounted except ro.

So I used SuperClone to make a copy.

That copy Mint then told me was also unmountable. So that proved the disk itself was alright. But I've now got two crippled disks.

So I mounted the data partition (sdc4) ro and have been able to copy lots of data off it. Some 30,000 files or more. Excellent.

But now I need to fix the disks. Make the read/write at least if not bootable, as they should be.

I had a suggestion that ntfsfix -d might fix it.

So I ran ntfsfix on sdc and it didn't like it:

Code:

dave@linuxMint ~ $ sudo ntfsfix -d /dev/sdc
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

Note: I can't put it back in a windows system and run chkdsk. Windows can't see the disk and presumably won't see the clone either, for the same reason, whatever it is.

I am very much a newbie.

So I tried sdc1 because I see the df command shows sda mounted as sda1.

And I got:

Code:

dave@linuxMint ~ $ sudo ntfsfix -d /dev/sdc1
[sudo] password for dave: 
Mounting volume... The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
FAILED
Attempting to correct errors... 
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sdc1 was processed successfully.

Which seemed to indicate that all was good.

So I tried to mount it as sdc:

Code:

dave@linuxMint ~ $ sudo mount -t ntfs /dev/sdc /mnt/fixedsea
NTFS signature is missing.
Failed to mount '/dev/sdc': Invalid argument
The device '/dev/sdc' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

So I tried sdc1:

Code:

dave@linuxMint ~ $ sudo mount -t ntfs /dev/sdc1 /mnt/fixedsea
dave@linuxMint ~ $ df -x squashfs
Filesystem     1K-blocks      Used Available Use% Mounted on
udev             1519080         0   1519080   0% /dev
tmpfs             308060      5136    302924   2% /run
/dev/sda1      958206472 518886468 390622816  58% /
tmpfs            1540288     40752   1499536   3% /dev/shm
tmpfs               5120         4      5116   1% /run/lock
tmpfs            1540288         0   1540288   0% /sys/fs/cgroup
cgmfs                100         0       100   0% /run/cgmanager/fs
tmpfs             308060        28    308032   1% /run/user/1000
/dev/sdc1         510972     12536    498436   3% /mnt/fixedsea

Looks great. Job's done.

But it is not.

In the file system I can see only the first two partitions. The 'Recovery' partition and the 'System Volume' partition. There actually are 5 partitions and some free space showing in the 'disks' gui utility.

I had partition 4 mounted and thought that might have something to do with it so I unmounted it and looked again. Still the same.

So I unmounted sdc1 and tried to mount sdc again. No luck. Same as previously.

So I tried mounting sdc1 again and was successful again.

With the same result: I have a mounted 5 partition disk that I can only see two partitions of.

I guess at this stage I could run ntfsfix -d on the original disk and then take it back to the windows machine and see if it is seeable. And if it is try windows checkdisk on it or whatever and failing everything else format it.

But the overall thing is pretty unclear to me. I'm such a beginner. Maybe there is something simple I should know about. And some clear things I should do next.

So I'm just asking the community for any advice they may have.

rtmistler · 07-15-2020, 09:09 PM

Some drives have a lot of partitions. Some of those are hidden or protected because they may be backup and restore utility partitions.

The best thing to do is to use the fdisk command on the drive:

Code:

$ sudo fdisk -x /dev/sdc

The -x argument provides extra details, but please check the manual page for fdisk before issuing it so you can see for yourself. Then post the results.

Question is whether or not the partition you did mount contained the data you were trying to fix, backup, or restore?

Note also that you did a smart and correct thing by recognizing that mounting the entire drive would not work and instead you needed to mount a partition of the correct type.

The fdisk output will help you to discern what each of the partitions are, their size, and their type.

Most Linux systems may not have a certain package, ... the name escapes me, ntfs-3g? which recognizes NTFS drives. But your's does see it, so I'm assuming that package is installed, and would not recommend you check that any further unless someone who knows this in more detail makes a more definitive comment.

michaelk · 07-15-2020, 09:49 PM

In addition, you can not mount /dev/sdc because it isn't a single filesystem like /dev/sdc1.

You can only run ntfsfix against a filesystem and it only fixes simple problems. Ubuntu and its derivatives should automatically support NTFS filesystems and usually these days with mainstream distributions fileystem type ntfs = ntfs-3g so that should not matter. Also Windows 10 by default hibernates versus a full shutdown so mounting the actual Windows data partition will probably fail anyway.

The output of the lsblk should show how your Windows drive is partitioned and which is the real Windows data drive.

jefro · 07-15-2020, 09:54 PM

I'm never a fan of fixing a Microsoft OS with a linux distro unless last resort. Lucky for most users is that there are tons of help web pages on the subject of fixing some aspect of windows.

Tools like chkdsk, diskpart and boot loader repair tools and many others are usually available even using free ISO's from MS.

frankbell · 07-15-2020, 10:02 PM

abrogard, is this the internal HDD from a Windows machine, as opposed to, say, a USB external drive?

When you tried to boot it with Windows, did it give you an option to boot into recovery mode?

If the answer to the first question is yes and to the second question no, my gut reaction is that this drive is toast.

In any event, the best way to repair an NTFS file system is to use Windows disk administration tools. If you can find a Windows machine to connect the drive to, doing so would be your best course of action for trying to shoot this trouble.

Also, could you please surround any terminal output with "code" tags which become available when you click the "Advanced" button beneath the compose/edit post window? It makes terminal output much easier to read.