LinuxQuestions.org - NTFS - Disappearing files / appearing free space in dual boot configuration

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - NTFS - Disappearing files / appearing free space in dual boot configuration (https://www.linuxquestions.org/questions/linux-newbie-8/ntfs-disappearing-files-appearing-free-space-in-dual-boot-configuration-4175577576/)

NTFS - Disappearing files / appearing free space in dual boot configuration

Hi!

Yesterday, I had approximately 50Gb free space on my hard drive (not the system disk, one NTFS partition on a 3Tb disk), and for the first time in the last few weeks I started up my windows 7 install. The problem started with the system indicating that I have 158Gb free space.

So I used CHKDSK to find out what is happening, it found some errors, but could not correct them on a mounted filesystem. Restarted the machine, CHKDSK ran, still 158Gb free space.

I rebooted to linux, and now it also indicated the same amount (158 Gb) of free space. To find out what was lost, I verified some checksums (luckily, I have crc checksums for practically everything), and the strangest thing is that nothing is missing.

To make things a bit more weird, this is the second time I have experienced this, and the checksum verification also came up dry that time (and it was also around 100Gb).

The only similar case I have found is when the user hibernates windows, changes files in linux, and resumes windows, but I did not do that (and nothing was lost...).

So my question is, where did that free space came from?

The CHKDSK log is here:

Code:

Checking file system on D:

The type of the file system is NTFS.

Volume label is Storage.





A disk check has been scheduled.

Windows will now check the disk.                        



CHKDSK is verifying files (stage 1 of 3)...

  424362 file records processed.                                        



File verification completed.

  4856 large file records processed.                                  



  0 bad file records processed.                                    



  0 EA records processed.                                          



  0 reparse records processed.                                      



CHKDSK is verifying indexes (stage 2 of 3)...

The first free byte, 0x28, and bytes available, 0xd0, for

root index $I30 in file 0x9086 are not equal.

  436518 index entries processed.                                        



Index verification completed.

  0 unindexed files scanned.                                        



  0 unindexed files recovered.                                      



CHKDSK is verifying security descriptors (stage 3 of 3)...

  424362 file SDs/SIDs processed.                                        



Cleaning up 101 unused index entries from index $SII of file 0x9.

Cleaning up 101 unused index entries from index $SDH of file 0x9.

Cleaning up 101 unused security descriptors.

Security descriptor verification completed.

  6079 data files processed.                                          



CHKDSK is verifying Usn Journal...

  306020024 USN bytes processed.                                            



Usn Journal verification completed.

Windows has checked the file system and found no problems.



  2861458 MB total disk space.

  2706141 MB in 164020 files.

    95324 KB in 6080 indexes.

        0 KB in bad sectors.

    879863 KB in use by the system.

    65536 KB occupied by the log file.

 158070288 KB available on disk.



      4096 bytes in each allocation unit.

 732533503 total allocation units on disk.

  39517572 allocation units available on disk.



Internal Info:

aa 79 06 00 80 98 02 00 38 f0 04 00 00 00 00 00  .y......8.......

69 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00  i...............

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Quote:

The problem started with the system indicating that I have 158Gb free space.

It was not a free space. There was something inside (your linux volume probably) but the problem owed to the fact that Microsoft cannot read Linux file systems.

Quote:

So I used CHKDSK to find out what is happening, it found some errors, but could not correct them on a mounted filesystem. Restarted the machine, CHKDSK ran, still 158Gb free space.

Because again the CHKDSK, a microsoft tool, is not equipped to identify linux file system; although it is able to detect some formats that are not microsoft compliant.

Quote:

I rebooted to linux, and now it also indicated the same amount (158 Gb) of free space.

Because CHKDSK, although it did not (you did not click to edit anything on the linux volume) despite that never the less it altered the MBR (automatically as it used to do) declaring the linux filesystem as empty. The event of alteration occurred on the MBR alone, but not in the file system itself.

Quote:

To find out what was lost, I verified some checksums (luckily, I have crc checksums for practically everything), and the strangest thing is that nothing is missing.

Because you did not alter the volume, and linux file system can easily recover upon booting from anything through its journal records or through an automatic fsck run behind the scene at load up.

Good luck.

m.m.

Thank you for your response!

Quote:

Originally Posted by malekmustaq (Post 5531996)

It was not a free space. There was something inside (your linux volume probably) but the problem owed to the fact that Microsoft cannot read Linux file systems.

No, the linux volume is on a different hard disk, along with the windows system volume (sdb, 750Gb, 4 partitions). The mystery hard drive only has a data partition, no OS was installed on it (sda, 3Tb, 1 partition, NTFS).

Since the morning I have discovered, that the "previous versions" was enabled for the drive on windows, an I can no longer access those. Is it possible, that the ntfs-3g did not handle those properly, and that is what the CHKDSK utility removed, after finding them corrupted?

It is more likely that one month had passed and the "previous versions" were automatically removed.

[EDIT] Oops, that's the "Windows.old" folder that gets deleted in 30 days, not "previous versions". Sorry.