1

I have a hard drive that began to fail recently, throwing errors and failing to mount any of its partitions. I used the amazing ddrescue tool, running in Debian, to recover the main three partitions from it. All three are NTFS partitions and in all three cases ddrescue was able to recover the vast majority of the data. But in all three partitions, it also indicated that some data was lost to errors:

  • Partition 1: Size: 57 GB, errsize (from ddrescue): 8KB
  • Partition 2: Size: 110 GB, errsize: 40 KB
  • Partition 3: Size: 95 GB, errsize: 14.6 MB

All three images mount normally and seem to be accessible.

My question is: I don't know where these errors are in each image, and I don't know which files are damaged. Would it make sense to run fsck on these images to correct any inconsistencies? Or might that screw things up further?

  • Its probably pretty safe, but don't expect it to pick up on the lost data, unless the entire file is lost. If the volumes are not mountable you always have the ability to fall back to file carving utilities like photorec or recuva if necessary. – Frank Thomas Nov 4 '16 at 16:54
  • fsck for NTFS drives is useless. But you may consider running chkdsk on them after you made a backup copy just to be sure. – Andrea Lazzarotto Nov 6 '16 at 12:35
2

My answer to another question may be useful here. I'm pasting the most important fragment below.

Linux is not well equipped to fix corrupted NTFS. There is ntfsfix tool, however its manual says:

ntfsfix is a utility that fixes some common NTFS problems. ntfsfix is NOT a Linux version of chkdsk. It only repairs some fundamental NTFS inconsistencies, resets the NTFS journal file and schedules an NTFS consistency check for the first boot into Windows.

As you can see the tool leaves the hard work for Windows to do. It seems there is no way to repair serious NTFS issues from under Linux only.

The right tool is Windows chkdsk with /f option.

To use chkdsk with the raw image use ImDisk. I have no experience with ImDisk at all but it is recommended here.

I think chkdsk may fix inconsistencies (if any) in the filesystem itself but it won't recover the files content that was lost (if it's the case), because NTFS has no redundancy for this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.