Brief description

The problem I'll describe occures just recently on my Laptop, running Ubuntu and Win7. Ubuntu is installed on a SSD, and the additional HDD contains the Win7 installation (which runs without any problems) and a NTFS partition (which contains only data) encrypted with TrueCrypt.

The other day I suddenly couldn't access the data anymore. Windows' chkdsk tool was able to repair the filesystem, and again I could access my data. But now the problem is that the filesystem repeats to be damaged, this is, every time I turn on the Laptop after a longer downtime, I have to let chkdsk repair the partition before being able to see my data!

More in detail

When does the problem occure?

It seems like the Laptop needs to be turned off for several hours before the NTFS filesystem gets "damaged"(?). A simple restart, or even a downtime of two hours, don't cause any problems.

Output of chkdsk

Every time I invoke chkdsk /f to repair the filesystem I get the message

The first NTFS boot sector is unwriteable or corrupt

Therefore it uses the second boot sector. The rest of the output differs every time, but normally chkdsk repairs one or several of the NTFS metafiles.

How did the problem appear?

I have been running my Laptop without any problems for more than one year now, until I made a fresh install of Windows 7. After the Win7 Setup somehow the encrypted NTFS partition wasn't listed in the MBR partition table of the hard drive anymore! Fortunately I was able to put the partition back into the partition table –– but then I got the problem described above.

But actually I can't believe that the installation of Windows caused the problem that I have now.

What I already tried to solve the problem.

After several days (running chkdsk every day) I formatted the partition and put all data back onto it.

Again after several days without success, I erased the whole Truecrypt partition and created a new one with different start and end sectors. Formattion without the "quick" option didn't find any bad sectors - it terminated without errors, but the problem remains. SMART for the drive is enabled, but it doesn't show errors. The counter of reallocated sectors is at zero.

My question

What do you suggest to do next? How can I find out the real problem?

Is there a possibility of a bad sector which the software tools can't see? Should I try to mount the partition on a different system?

Thanks in advance for any help!

  • If you acess the NTFS filesystem from Linux and write, you can corrupt it. A Windows I had when I still double booted used to scream each boot that some nefarious malware had taken over (yes, it was Linux' boot machinery...). Maybe it sees updates there and gets the willies? – vonbrand Mar 20 '13 at 1:54
  • If I understand you correctly, you suggest to reinstall the Windows Boot Loader and check if I have problems when I only use Windows? Yes, I use Grub2 as Boot Loader. I'll do a reinstall of Grub2 and see if it helps already. – myrdd Mar 20 '13 at 7:40

Hard drive errors - if that is what you have - are notoriously difficult for OS-based tools to find.

You really need a specialist tool such as Spinrite. This is specifically designed to exercise the disk in such a way as to find the real errors on the disk and is often able to completely correct them too.

Do read the explanation on the GRC web site that explains why SMART monitoring does not normally work. Spinrite uses SMART in a way that allows it to actually spot potential problems with the drive that never show up under normal monitoring while in use.

Since Spinrite costs USD90, I would first try removing the "odd" parts of your setup. Firstly remove TrueCrypt so that you can make sure that isn't corrupting things. Secondly remove GRUB and use a standard Windows installation.

| improve this answer | |
  • Thanks for your answer! The harddrive errors shown by Spinrite are interesting, but it seems like what I have is a software error: For over a week I booted only Windows (still using GRUB2) and had no problems. Today I mounted Linux for the second time since. So as it seems to be a problem of my Kubuntu GNU/Linux installation, how can I figure out which process/program/etc. causes this problem? – myrdd Apr 4 '13 at 17:09
  • So you ARE seeing errors in Spinrite? What errors? Maybe try removing the NTFS volume from the partition table in Linux for now so it doesn't try to mount it. – Julian Knight Apr 4 '13 at 20:23
  • Oh, sorry for writing unclearly. No, I didn't use Spinrite nor bought it. – So yes, removing the NTFS volume from the partition table might be another good step, thanks! Let's see what happens. – myrdd Apr 4 '13 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.