Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I had a 3TB internal drive on my system (dual Ubuntu 14.04 and Windows 7) and I recently lost it's entire contents. I'm hoping that there is some way of getting it back. I'm including here the events that transpired because I am not sure what the real cause is.

I had three drives in the system to begin with.

  • The bootable drive, with grub, a NTFS windows partition, and an Ubuntu partition.
  • "Loonies" - a 3TB NTFS full of videos that I do not have other copies of.
  • "Foundation" - a 2TB NTFS full of more stuff I don't have other copies of.

I also had a macbook, but it wouldn't boot. I had an external drive called "Wayside" which had a time machine backup of that macbook. I booted the desktop into linux and used a shell script to copy the reconstructed filesystem from the time machine backup to Loonies, and then told the desktop to shut down. However, Ubuntu just hung for about 15 minutes and I did a hard shutdown.

Next, I took the 500Gb drive that was inside the macbook and installed it in the desktop, then booted it up. I was planning on wiping it. I accidently let the machine boot to windows, and chkdisk started running. It printed some alarming messages about deleting things on Loonies and then windows came up. I checked Loonies to see what had changed and found the following.

.
├── bootsqm.dat
├── $RECYCLE.BIN
│   └── S-1-5-21-2659500990-1773008521-1777391169-1000
│       └── desktop.ini
└── System Volume Information
    ├── Chkdsk
    │   └── Chkdsk20140713075035.log
    └── tracking.log

I rebooted to Ubuntu to see if it would appear differently and found that it did not. Running photorec on Loonies finds a lot of files but they are all garbage.

At this point I am concerned about whether I can recover any of the data that was originally on Loonies, and whether it is safe to ever boot windows again.

The contents of Chkdsk20140713075035.log are below. If they make any sense to you, please share your insights.

Checking file system on R:
The type of the file system is NTFS.
Volume label is Loonies.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                         
Unable to query LCN from VCN 0x4 for attribute of type 0x80.
The non resident attribute of type 0x80 is inconsistent.  The valid data
length is 0x6c700000, file size 0x6c700000, and allocated length 0x4000.
The non resident attribute of type 0x80 is inconsistent.  The valid data
length is 0x6c700000, file size 0x4000, and allocated length 0x4000.

CHKDSK is verifying files (stage 1 of 3)...
Deleted corrupt attribute list entry
with type code 48 in file 0.
Unable to find child frs 0x10 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x13 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x12 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 176 in file 0.
Unable to find child frs 0x11 with sequence number 0x1.
The attribute of type 0x80 and instance tag 0x1 in file 0x0
has allocated length of 0x6c700000 instead of 0x4000.
Deleted corrupt attribute list entry
with type code 128 in file 0.
The attribute of type 0xb0 and instance tag 0x5 in file 0x0
has allocated length of 0x38000 instead of 0x34000.
Deleted corrupt attribute list entry
with type code 176 in file 0.
Unable to locate attribute with instance tag 0x1 and segment
reference 0x1000000000000.  The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 0.
Unable to locate attribute with instance tag 0x5 and segment
reference 0x1000000000000.  The expected attribute type is 0xb0.
Deleting corrupt attribute record (176, "")
from file record segment 0.
  16 file records processed.                                         

File verification completed.
  0 large file records processed.                                   

  0 bad file records processed.                                     

  0 EA records processed.                                           

Correcting file name errors in system file record segment 0.
  0 reparse records processed.                                      

    CHKDSK is verifying indexes (stage 2 of 3)...
    An index entry of index $I30 in file 0x5 points to file 0xa5
    which is beyond the MFT.
    Deleting index entry $RECYCLE.BIN in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x6283
    which is beyond the MFT.
    Deleting index entry CrossModal in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1ddea
    which is beyond the MFT.
    Deleting index entry data in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x413e1
    which is beyond the MFT.
    Deleting index entry DirectX9.0c in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x4089f
    which is beyond the MFT.
    Deleting index entry Documents in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1dde0
    which is beyond the MFT.
    Deleting index entry Downloads in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de21
    which is beyond the MFT.
    Deleting index entry EU37E0~1.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1f
    which is beyond the MFT.
    Deleting index entry EUD159~1.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de20
    which is beyond the MFT.
    Deleting index entry EUFCB1~1.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1a
    which is beyond the MFT.
    Deleting index entry eula.1028.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1b
    which is beyond the MFT.
    Deleting index entry eula.1031.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1c
    which is beyond the MFT.
    Deleting index entry eula.1033.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1e
    which is beyond the MFT.
    Deleting index entry eula.1036.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1f
    which is beyond the MFT.
    Deleting index entry eula.1040.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de20
    which is beyond the MFT.
    Deleting index entry eula.1041.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de21
    which is beyond the MFT.
    Deleting index entry eula.1042.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de19
    which is beyond the MFT.
    Deleting index entry eula.2052.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1d
    which is beyond the MFT.
    Deleting index entry eula.3082.txt in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1a
    which is beyond the MFT.
    Deleting index entry EULA10~1.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1b
    which is beyond the MFT.
    Deleting index entry EULA10~2.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1c
    which is beyond the MFT.
    Deleting index entry EULA10~3.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1e
    which is beyond the MFT.
    Deleting index entry EULA10~4.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de19
    which is beyond the MFT.
    Deleting index entry EULA20~1.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de1d
    which is beyond the MFT.
    Deleting index entry EULA30~1.TXT in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x23
    which is beyond the MFT.
    Deleting index entry Fraps in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de22
    which is beyond the MFT.
    Deleting index entry globdata.ini in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1df85
    which is beyond the MFT.
    Deleting index entry homebackup in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de15
    which is beyond the MFT.
    Deleting index entry IN49AD~1.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de14
    which is beyond the MFT.
    Deleting index entry IN93F3~1.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de16
    which is beyond the MFT.
    Deleting index entry IN943B~1.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de17
    which is beyond the MFT.
    Deleting index entry INBF93~1.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de18
    which is beyond the MFT.
    Deleting index entry INF9C2~1.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de23
    which is beyond the MFT.
    Deleting index entry install.exe in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de24
    which is beyond the MFT.
    Deleting index entry install.ini in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de11
    which is beyond the MFT.
    Deleting index entry install.res.1028.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de12
    which is beyond the MFT.
    Deleting index entry install.res.1031.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de13
    which is beyond the MFT.
    Deleting index entry install.res.1033.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de15
    which is beyond the MFT.
    Deleting index entry install.res.1036.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de16
    which is beyond the MFT.
    Deleting index entry install.res.1040.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de17
    which is beyond the MFT.
    Deleting index entry install.res.1041.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de18
    which is beyond the MFT.
    Deleting index entry install.res.1042.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de10
    which is beyond the MFT.
    Deleting index entry install.res.2052.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de14
    which is beyond the MFT.
    Deleting index entry install.res.3082.dll in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de10
    which is beyond the MFT.
    Deleting index entry INSTAL~1.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de11
    which is beyond the MFT.
    Deleting index entry INSTAL~2.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de12
    which is beyond the MFT.
    Deleting index entry INSTAL~3.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de13
    which is beyond the MFT.
    Deleting index entry INSTAL~4.DLL in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x12350
    which is beyond the MFT.
    Deleting index entry KSP in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x41404
    which is beyond the MFT.
    Deleting index entry MacBackup in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1dde3
    which is beyond the MFT.
    Deleting index entry SteamLibrary in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1dde3
    which is beyond the MFT.
    Deleting index entry STEAML~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0xa8
    which is beyond the MFT.
    Deleting index entry System Volume Information in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0xa8
    which is beyond the MFT.
    Deleting index entry SYSTEM~1 in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1455
    which is beyond the MFT.
    Deleting index entry Talk in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x11fce
    which is beyond the MFT.
    Deleting index entry Touhou in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de26
    which is beyond the MFT.
    Deleting index entry vcredist.bmp in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de27
    which is beyond the MFT.
    Deleting index entry VC_RED.cab in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1de25
    which is beyond the MFT.
    Deleting index entry VC_RED.MSI in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x11faa
    which is beyond the MFT.
    Deleting index entry VirtualBox_VMs in index $I30 of file 5.
    An index entry of index $I30 in file 0x5 points to file 0x1227e
    which is beyond the MFT.
    Deleting index entry WoT in index $I30 of file 5.
    Index entry $ObjId of index $I30 in file 0xb points to unused file 0x19.
    Deleting index entry $ObjId in index $I30 of file 11.
    Index entry $Quota of index $I30 in file 0xb points to unused file 0x18.
    Deleting index entry $Quota in index $I30 of file 11.
      22 index entries processed.                                        

    Index entry $Reparse of index $I30 in file 0xb points to unused file 0x1a.
    Deleting index entry $Reparse in index $I30 of file 11.
    Index entry $RmMetadata of index $I30 in file 0xb points to unused file 0x1b.
    Deleting index entry $RmMetadata in index $I30 of file 11.
    Index verification completed.
      0 unindexed files scanned.                                        

      0 unindexed files recovered.                                      

    Creating object id file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $O for file 17.
    The object id in file 0x3 does not appear in the object
    id index in file 0x11.
    Inserting an index entry into index $O of file 17.
    Creating reparse point file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $R for file 18.
    Creating quota file.
    Inserting an index entry into index $I30 of file 11.
    Creating index $O for file 19.
    Creating index $Q for file 19.
    Inserting default quota record into index $Q in file 19.
    CHKDSK is verifying security descriptors (stage 3 of 3)...
      24 file SDs/SIDs processed.                                        

    Cleaning up 28 unused index entries from index $SII of file 0x9.
    Cleaning up 28 unused index entries from index $SDH of file 0x9.
    Cleaning up 28 unused security descriptors.
    Security descriptor verification completed.
    Inserting data attribute into file 0.
      4 data files processed.                                           

    The MFT mirror is different from the MFT.
    Correcting errors in the Master File Table (MFT) mirror.
    Correcting errors in the master file table's (MFT) DATA attribute.
    Correcting errors in the master file table's (MFT) BITMAP attribute.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    Windows has made corrections to the file system.

       2861458 MB total disk space.
            24 KB in 8 indexes.
             0 KB in bad sectors.
        155403 KB in use by the system.
         65536 KB occupied by the log file.
       2861307 MB available on disk.

          4096 bytes in each allocation unit.
     732533503 total allocation units on disk.
     732494647 allocation units available on disk.

    Internal Info:
    10 00 00 00 10 00 00 00 0b 00 00 00 00 00 00 00  ................
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00
share|improve this question
1  
Your MFT was wiped this means the "data" is on the hdd but without the table to tell an os where the files are its just random noise. This doesn't happen to healthy disk. Not much can be done to recover from a failure like this. The filesystem failed which wasn't caused by a particular OS. –  Ramhound Jul 14 at 1:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.