Corrupted NTFS Partition - External HDD - Data Still Safe

[kes8622]

Hello Everyone,

I have an external USB Drive, the NTFS partition appears to be shot. Windows hangs when it plugs in but asks to format it. In Ubuntu I can not mount it, I can see it's size, etc via testdisk and even image it, but it fails to mount due to ntfs error. Ntfsfix says the signature is bad and to chkdsk it.

Chkdsk in Windows just hangs.

Using some other data recovery software (PC Inspector), I can open it and see the contents, pull individual files, etc. I know the disk is in good condition health wise, I have no idea how the partition became corrupted.

Is there any way to fix this or get chkdsk to run properly? Do I have another tool to get all the data off? PC inspector is painfully slow.

Thank you

[bcometa]

I like and often start logical recoveries (your case) using R-Studio. You can download a free trial at r-studio.com. This will help in recovering your data to a new drive, but will not fix the partition.

Often when a partition goes bad, it means the drive has bad sectors, so if your drive is more than a couple years old, it's probably worth buying a new one. Then reinstall your OS and move back recovered data.

*PS... the fact the software is running slow probably means bad sectors (at least). It's possible using more software tools on this drive could cause the drive to become unreadable (with excessive wear and tear/seeking/reading), if it's on it's last leg.

[Vulcan]

@kes8622,

I know the disk is in good condition health wise

How exactly do you know this? I'm interested in your analysis (i.e. what did you do or check, to be sure that the disk is in "good condition"?), but since you also say:

Chkdsk in Windows just hangs.

and

PC inspector is painfully slow.

these symptoms mean that you have a bigger problem than you think (i.e. they suggest you have more than "just" NTFS corruption). For this reason, I would not be doing any logical recovery directly from that disk - you don't know when it could fail more catastrophically.

You said:

In Ubuntu I can not mount it, I can see it's size, etc via testdisk and even image it

[my emphasis above]

Does that mean you have already got a complete, error-free, sector-by-sector image (i.e. clone) of this disk? If so, how exactly did you get that (which program / command did you use)? And if you do have a clone, have you tried recovering your data from that clone - or, even better, from a copy of that clone? (It's a good idea to keep the master clone untouched in case the original disk fails - your clone might become the only copy of the data, so don't do anything which might change that master clone.)

[kes8622]

Hello thank you both.

Health wise, I say it is good, because I ran various tools to check the health of the disk and they all report it is in good health, of course they may be wrong.

I did get a full image using testdisk and then created an image.

I am not sure what to do to extract data, when I try to mount the image, it insists that it can't auto detect the FS and if I try to force it as NTFS it says no NTFS found, yet, testdisk clearly detects there is an NTFS partition.

In software tools on Windows (PC Inspector) I can see the files on the disk, but it's slow.

CHKDSK is actually running a /f now, it's at.......... 812GB of 1024GB progress ........ it has taken 20 hrs so far. I am not concerned yet since a full 1 TB disk I have had take much longer w/ checkdisk.

I am just not sure what my options are from here. I am scared if I try to use a software tool to try to pull the data it will do more damage.

The disk is not important, so if I can salvage data I will replace it. It's an external HDD.

Also, the data isn't direly important, truthfully it'd just be good to get if I can, not going to cry over it.

Thanks

[laptokowiec]

First of all clone the HDD.
Then you can recover

[hddguy]

Also, the data isn't direly important, truthfully it'd just be good to get if I can, not going to cry over it.

This is good because you are taking too many risks with it and very likely you will kill the media

[Vulcan]

@kes8622,

Thanks for the update.

I am just not sure what my options are from here. I am scared if I try to use a software tool to try to pull the data it will do more damage.

Yes there are risks of various types, and you're continuing to do things (e.g. running chkdsk) without waiting for advice from here, even though you say you're "not sure" what to do. However, since you've said the data is not important, here are some comments about things you could do.

Health wise, I say it is good, because I ran various tools to check the health of the disk and they all report it is in good health, of course they may be wrong.

There's no "hard data" (e.g. program screenshots showing SMART parameters etc.) for me to comment in detail, but in general you cannot rely on programs to tell you that a drive is definitely healthy. There are some types of problems which typical health check-type utilities do not identify.

From the information supplied, I can't tell whether the problem(s) is/are with your hard disk or elsewhere, but I certainly can't rule-out a disk problem from that information. Making the best decisions about what to do, would be helped by finding the actual problem(s) which you currently have. That depends on how much time & effort (and perhaps money) you are prepared to spend on that investigation.

I did get a full image using testdisk and then created an image.

I don't understand the difference beetween "I did get a full image using testdisk" and "created an image" - aren't they the same thing? But thanks for explaining that you used testdisk. I hope that testdisk did not report that read errors occurred, as it was creating the image file.

From everything I have read about testdisk, it does not create an image of the disk, but of the selected partition. Unfortunately for you, that makes it more difficult to directly re-use that image on another disk, as the partition image file does not contain the partition table.

CHKDSK is actually running a /f now

Remember that chkdsk can make huge changes to your filesystem - not necessarily only changes that you want!! Since you say that you have an image of that partition, at least you can use that as your backup, in case chkdsk makes more (or different) changes, than you want.

Now that you have confirmed you have an image (of the partition), then as I said before, you can use recovery software to try to recover from that clone (or a copy), which I hope was made before you ran chkdsk.

There are many other potential approaches - for example: You can use a new blank disk (1TB or more), recreate (or copy) the MBR from your current disk onto that new disk (in order to create an identical partition), and then copy the partition image which you already have, into that (empty) partition on the new disk. Effectively that new disk then becomes a full clone of your current disk, and then you can try running chkdsk on that new disk - that may be more successful, if your underlying problem is with your currrent disk.

Since we don't know your skills, available equipment / time / money etc. it's impossible to know the "best" approach for you, but I hope those commants above have given you some ideas. Although you've said the data is not important, remember to keep that partition image that you have, in case the disk fails or chkdsk severely affects the data on the disk etc.