2

I dual boot Ubuntu and Windows 7, and share(d) a 3TB GUID NTFS partition between the two. This worked fine for ages.

Yesterday I did a large file copy from a suspect (perhaps failing) ext3 partition:

sudo cp -rp /media/user/failing_ext3/* /media/user/3TB/tmp/
sudo cp -rp /media/user/3TB/tmp/* /media/user/new_ext4_drive/

This worked fine, but I'm thinking now that copying from ext3 -> NTFS -> ext4 was a dumb idea and caused chkdsk to be run. I booted into windows 7 later, and barely noticed that chkdsk was running on bootup. Windows and linux now see an (almost) empty partition on the 3TB drive. From a bit of research, I figured chkdsk probably blew away the partition and the master file tree. There is a single Chkdsk log in a folder called /System Volume Information/Chkdsk:

Checking file system on I:
The type of the file system is NTFS.
Volume label is 3TB.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                         
Unable to query LCN from VCN 0x5 for attribute of type 0x80.
The non resident attribute of type 0x80 is inconsistent.  The valid data
length is 0x1f380000, file size 0x1f380000, and allocated length 0x4000.
The non resident attribute of type 0x80 is inconsistent.  The valid data
length is 0x1f380000, file size 0x4000, and allocated length 0x4000.

CHKDSK is verifying files (stage 1 of 3)...
Deleted corrupt attribute list entry
with type code 48 in file 0.
Unable to find child frs 0x10 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x17 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x11 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x12 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x13 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x14 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x15 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x16 with sequence number 0x1.
The attribute of type 0x80 and instance tag 0x1 in file 0x0
has allocated length of 0x1f380000 instead of 0x4000.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to locate attribute with instance tag 0x1 and segment
reference 0x1000000000000.  The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 0.
  16 file records processed.                                         

File verification completed.
  0 large file records processed.                                   

  0 bad file records processed.                                     

  0 EA records processed.                                           

Correcting file name errors in system file record segment 0.
  0 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 3)...
An index entry of index $I30 in file 0x5 points to file 0x47aa5
which is beyond the MFT.
Deleting index entry $RECYCLE.BIN in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x23
which is beyond the MFT.
Deleting index entry 1TB in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47aa1
which is beyond the MFT.
Deleting index entry System Volume Information in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47aa1
which is beyond the MFT.
Deleting index entry SYSTEM~1 in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47f78
which is beyond the MFT.
Deleting index entry tmp in index $I30 of file 5.
Index entry $ObjId of index $I30 in file 0xb points to unused file 0x19.
Deleting index entry $ObjId in index $I30 of file 11.
Index entry $Quota of index $I30 in file 0xb points to unused file 0x18.
Deleting index entry $Quota in index $I30 of file 11.
  22 index entries processed.                                        

Index entry $Reparse of index $I30 in file 0xb points to unused file 0x1a.
Deleting index entry $Reparse in index $I30 of file 11.
Index entry $RmMetadata of index $I30 in file 0xb points to unused file 0x1b.
Deleting index entry $RmMetadata in index $I30 of file 11.
Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

Creating object id file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 17.
The object id in file 0x3 does not appear in the object
id index in file 0x11.
Inserting an index entry into index $O of file 17.
Creating reparse point file.
Inserting an index entry into index $I30 of file 11.
Creating index $R for file 18.
Creating quota file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 19.
Creating index $Q for file 19.
Inserting default quota record into index $Q in file 19.
CHKDSK is verifying security descriptors (stage 3 of 3)...
  24 file SDs/SIDs processed.                                        

Cleaning up 27 unused index entries from index $SII of file 0x9.
Cleaning up 27 unused index entries from index $SDH of file 0x9.
Cleaning up 27 unused security descriptors.
Security descriptor verification completed.
Inserting data attribute into file 0.
  4 data files processed.                                           

The MFT mirror is different from the MFT.
Correcting errors in the Master File Table (MFT) mirror.
Correcting errors in the master file table's (MFT) DATA attribute.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

   2861458 MB total disk space.
        12 KB in 8 indexes.
         0 KB in bad sectors.
    155403 KB in use by the system.
     65536 KB occupied by the log file.
   2861307 MB available on disk.

      4096 bytes in each allocation unit.
 732533503 total allocation units on disk.
 732494650 allocation units available on disk.

Internal Info:
10 00 00 00 10 00 00 00 0b 00 00 00 00 00 00 00  ................
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00

This issue has been asked about before, see:

Everything on my NTFS partition disappeared

Empty folders after NTFS file system recovery

I'm running TestDisk/PhotoRec and it's finding files, though without file names or directories; with 1.2TB of data it'll take a while to go through the whole drive. TestDisk did not find any deleted NTFS partitions (crap!). Some of the data is backed up, but it would be really nice to recover the file tree intact. Are there some decent recovery tools that can infer the file tree from millions of intact files? I'm not hopeful, but perhaps some good Samaritan can suggest what might work in this particular situation.

Improve this question
3
  • What exactly is your question? You seem to already have an answer to your problem? File recovery software really is your only choice. I suspect this question is likely a duplicate, and there are more appropriate questions, that could be marked as the duplicate rather then the questions you linked to.
    – Ramhound
    Commented Mar 5, 2015 at 16:29
  • @Ramhound My question was, and still is, what might work to recover data in this scenario? Through my own trial and error over the last 24 hours I had some success, so thought I'd share it as an answer. I did not have an answer before posing this question. Q&A sites also work to disseminate information, not just as a tool for the person who asks the question. I'd love further advice on the matter, if you feel you have an answer.
    – Rooke
    Commented Mar 5, 2015 at 16:36
  • What will work is file recovery software of your choice. We don't do software recommendations here at Superuser. So asking "what will work" is a extremely broad question. I am trying to understand how your problem differs from the existing questions. I personally can't find a high quality duplicate, that offers some detailed suggestions, otherwise I would be flagging to close as a duplicate.
    – Ramhound
    Commented Mar 5, 2015 at 16:47

1 Answer 1

Reset to default
0

I had good results with "MiniTool Power Data Recovery 6.8". About 90% of file names with their proper folder structure were recovered.

Improve this answer
3
  • This seems like it should be a comment rather then an answer to your question.
    – Ramhound
    Commented Mar 5, 2015 at 16:35
  • @Ramhound No. If this answer had been posted by someone else yesterday, I would have upvoted it. It is an answer to the question. Delete the whole question if you insist on doubting the appropriateness of my question, my subsequent answer, or the uniqueness of either of them.
    – Rooke
    Commented Mar 5, 2015 at 16:42
  • Only the community can delete a question and/or answer. I am not the community. I can only speak for what I believe. I believe this to be more of a comment than an answer.
    – Ramhound
    Commented Mar 5, 2015 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .