Hello,

I am trying to diagnose and, if possible, repair an NTFS metadata problem on an external Seagate 16 TB HDD.

Main symptom:
Windows 11 shows the volume as RAW and Explorer reports that the file or directory is corrupted and unreadable. However, TestDisk, DMDE, R-Studio, macOS with Paragon NTFS, and an older Windows computer can read the files and directory structure.

The problem began after the Windows 11 computer resumed from sleep while the disk was still connected.

What has already been checked:

- CrystalDiskInfo reports SMART status “Good”
- Reallocated Sectors Count: 0
- Current Pending Sector Count: 0
- Uncorrectable Sector Count: 0
- Reported Uncorrectable Errors: 0
- UltraDMA CRC Error Count: 0
- GPT structure is readable in TestDisk
- Primary NTFS boot sector: OK
- Backup boot sector: OK
- Both boot sectors are identical
- MFT and MFT mirror match perfectly
- TestDisk can list the files
- DMDE and R-Studio can open the existing NTFS volume and display the files directly

CHKDSK behaviour:

- chkdsk /scan reports that problems were found
- chkdsk /f /x reports no problems
- chkdsk /offlinescanandfix reports no problems
- chkdsk /f /x /sdcleanup reports no problems
- chkdsk /spotfix processes 0 corruption records and says it could not fix all issues
- DiskPart still reports the volume as RAW

Windows Event Viewer reports:

Event ID 55:
Corruption in:
$R:$INDEX_ROOT

The file reference points to MFT record 26, which DMDE identifies as:
$Extend\$Reparse

Event ID 50:
Delayed Write Failed for:
$I30:$INDEX_ALLOCATION

In DMDE, MFT record 26 contains:

- $INDEX_ROOT:$R
- $INDEX_ALLOCATION:$R, size 16384 bytes
- $BITMAP:$R, value 0F 00 00 00 00 00 00 00

The bitmap therefore appears to mark four 4096-byte INDX blocks as allocated, matching the 16384-byte INDEX_ALLOCATION size.

DMDE does not show obvious red logical errors, and the directory repair function is unavailable for this special system index.

I also bought an Intenso 8 TB HDD and copied the same files. Windows now shows that disk as RAW as well, while DMDE and R-Studio can read it. So I'm thinking maybe a file on the Seagate disk is causing the problem?

My questions are:

1. Is there a known way to validate or rebuild the NTFS $Extend\$Reparse $R index?
2. Could one invalid reparse entry cause Windows to reject the entire volume as RAW?
3. Is it possible to identify the invalid entry by comparing $INDEX_ROOT, the four INDX records, and $BITMAP?
4. Is there any tool that can rebuild this particular system index without recreating the entire NTFS volume?
5. What additional diagnostic information should I provide?

I can attach screenshots, CHKDSK output, Event Viewer XML, SMART data, TestDisk results, and the relevant DMDE views.

Thank you.

I have no experience with the intricacies of the NTFS file system and its service structures, but judging by the fact that chkdsk and the previous version of Windows don't detect errors and allow access to files on the drive, the system can handle the corruption of this log file. Considering NTFS is a key component of Windows, it can't be changed on a whim, including breaking backward compatibility.

Try booting the computer from a Windows 11 installation flash drive, and using the command line or the system image recovery option, open the problematic drive. You can also run chkdsk there, and I don't think it will find any problems either.

Primary means to detect MFT entry corruption is the fixup value in update sequence array.



So last 2 bytes in each sector should correspond with first 2 bytes you find in update sequence array, in my example 0x2A00

I answered this once on SuperUser, you should be able to read without account:

https://superuser.com/a/1792764/2476335

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service

If you could upload the $Extend\$Reparse metafile and MFT record #26, perhaps one of could identify the problem.

_________________
A backup a day keeps DR away.

An additional and potentially important finding is that I have been able to reproduce the problem on a completely separate 8 TB test drive.
I freshly formatted the test drive as NTFS in Windows 11 and confirmed that it worked normally. I then copied data originating from the Seagate drive onto it using macOS. After this, Windows 11 developed the same problem and would no longer mount/read the NTFS volume normally.
By testing the copied folders individually, I isolated the trigger to one particular Final Cut Pro library (.fcpbundle). If that library is removed from the test drive, Windows 11 can read the drive normally again.
The Final Cut Pro library itself works normally on macOS and opens correctly in Final Cut Pro. It contains exactly 286 symbolic links. Interestingly, CHKDSK on the affected test volume reported 286 reparse records.
I then created a separate test folder containing only symbolic links derived from this library. That alone was sufficient to reproduce the Windows 11 problem. Removing the symlink test folder made the NTFS volume readable by Windows again.
This makes me suspect that the issue is related to how these macOS symbolic links are being represented as NTFS reparse points, rather than corruption of the media files themselves.
If the $Reparse index itself looks valid to you, would the next step be to inspect the individual $REPARSE_POINT attributes referenced by the index?

Unfortunately the forum wont allow me to upload .bin files.

Furhtermore, I experienced the same issue on a third disk. I was working on a large 5 hours .mts AVCHD video file in Davinci Resolve 20. After about 1 hours of work, the software suddently froze and I couldn't eject the harddrive nor could I access it in windows explorer and got an error message, see attached. I managed to turn the PC of normally and after a while it shut down normally. But the light in the HDD kept blinking, even after i removed the USB connection for the pc.

Compress the .bin files with 7Zip or your preferred tool.

_________________
A backup a day keeps DR away.

Given the errors presented, maybe your Windows 11 machine needs a fresh install of Windows 11 26H2.

NTFS is well documented so MacBook and Linux can all at least read disks.

I suggest using exFAT for swapping between Windows and a MacBook which is very well supported. ExFAT is also the standard for the SD card association for cards > 32GB. ExFAT can support larger disks than NTFS can.

_________________
USB 3.5" enclosures are $19 USD postage paid from China, I own several

Pray tell, how will this fix the external drive???

I found exFAT to work on hard disks and SSD alike fine. I use it when Linux or BSD machines need files copied etc

_________________
USB 3.5" enclosures are $19 USD postage paid from China, I own several

are you chatGPT v0.1 ?