I've been running ddrescue on a failed NTFS drive. I don't remember what's on the drive, but I doubt it's important.
GNU ddrescue
was able to recover about 80% of the drive easily, but then is very slow at recovering the rest. It has bad sectors throughout the whole drive in a repeating pattern, so it will take eons to scrape every bit of data off the drive:
There are bits of good data in the middle of each bad chunk (which are also in a repeating pattern):
but it is taking days to get through even the first bad chunk, and there are thousands of such chunks.
So I want to just confirm that the files on the drive are unimportant and give up.
I cannot mount the drive image as is. It says
$MFTMirr does not match $MFT (record 0).
Failed to mount '/dev/loop42': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.
If I run ntfsfix
I am able to mount the drive and see folders and files:
$MFTMirr does not match $MFT (record 0).
FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr...
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 1024 usa_ofs: 0 usa_count: 0: Invalid argument
OK
Comparing $MFTMirr to $MFT... FAILED
Correcting differences in $MFTMirr record 0...OK
Correcting differences in $MFTMirr record 1...OK
Correcting differences in $MFTMirr record 2...OK
Correcting differences in $MFTMirr record 3...OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Checking the alternate boot sector... FIXED
NTFS volume version is 3.1.
NTFS partition /dev/loop43 was processed successfully.
So then I can mount it, and everything I can see is unimportant stuff that I have duplicate copies of.
But how do I know if it is listing all the files and folders that were on the drive?
Is there some way to view the $MFT and $MFTMirr and vbindiff
them and manually correct any missing bits in one by using the copy in the other? I read that the MFT is scattered throughout the drive. How do I know if it recovered all of the MFT?
User contributions licensed under CC BY-SA 3.0