2

I have a hard drive that began to fail recently, throwing errors and failing to mount any of its partitions. I used the amazing ddrescue tool, running in Debian, to recover the main three partitions from it. All three are NTFS partitions and in all three cases ddrescue was able to recover the vast majority of the data. But in all three partitions, it also indicated that some data was lost to errors:

  • Partition 1: Size: 57 GB, errsize (from ddrescue): 8KB
  • Partition 2: Size: 110 GB, errsize: 40 KB
  • Partition 3: Size: 95 GB, errsize: 14.6 MB

All three images mount normally and seem to be accessible.

My question is: I don't know where these errors are in each image, and I don't know which files are damaged. Would it make sense to run fsck on these images to correct any inconsistencies? Or might that screw things up further?

Kamil Maciorowski
  • 81,893
ShankarG
  • 946

1 Answers1

2

My answer to another question may be useful here. I'm pasting the most important fragment below.

Linux is not well equipped to fix corrupted NTFS. There is ntfsfix tool, however its manual says:

ntfsfix is a utility that fixes some common NTFS problems. ntfsfix is NOT a Linux version of chkdsk. It only repairs some fundamental NTFS inconsistencies, resets the NTFS journal file and schedules an NTFS consistency check for the first boot into Windows.

As you can see the tool leaves the hard work for Windows to do. It seems there is no way to repair serious NTFS issues from under Linux only.

The right tool is Windows chkdsk with /f option.

To use chkdsk with the raw image use ImDisk. I have no experience with ImDisk at all but it is recommended here.

I think chkdsk may fix inconsistencies (if any) in the filesystem itself but it won't recover the files content that was lost (if it's the case), because NTFS has no redundancy for this.

Community
  • 1
Kamil Maciorowski
  • 81,893