1

Topic: External USB backup drive mysteriously corrupted

G'day folks

I have a 2TB Seagate USB external NTFS drive I use for backups, from my Linux Mint KDE 17.3 partition on an old Dell Dimension 4600i 32 bit desktop.  For some unknown reason, the last time I tried to use it, the drive could not be mounted and error messages suggest it is corrupted.  In Win 7, the drive properties suggest it is 0 bytes in size, and cannot be accessed.

From my past experience with drive corruption problems in this forum, I have noted and tried the following:

Error message from Dolphin file manager in Linux Mint 17.3 KDE when attempting to access (mount) drive by clicking on it:

An error occurred while accessing 'Home', the system responded: The requested operation has failed: Error mounting /dev/sdc1 at /media/frankadmin/Expansion Drive: Command-line `mount -t "ntfs" -o "uhelper=udisks2,nodev,nosuid,uid=1000,gid=1000,dmask=0077,fmask=0177" "/dev/sdc1" "/media/frankadmin/Expansion Drive"' exited with non-zero exit status 13: MFT is corrupt, cannot read its unmapped extent record 19 Note : chkdsk cannot fix this, try ntfsfix Inode is corrupt (0): Input/output error Failed to load runlist for $MFT/$DATA. highest_vcn = 0x3, last_vcn - 1 = 0x4c065 Failed to load $MFT: Input/output error Failed to mount '/dev/sdc1': Input/output error NTFS is either inconsistent, or there is a hardware fault, or it's a SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows then reboot into Windows twice. The usage of the /f parameter is very important! If the device is a SoftRAID/FakeRAID then first activate it and mount a different device under the /dev/mapper/ directory, (e.g. /dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation for more details.

Error message from Partition>Information menu in GParted 0.18.0 in LM17.3KDE  (Has ntfsprogs / ntfs-3g package):

MFT is corrupt, cannot read its unmapped extent record 19
Note : chkdsk cannot fix this, try ntfsfix
Inode is corrupt (0): Input/output error
Failed to load runlist for $MFT/$DATA.
highest_vcn = 0x3, last_vcn - 1 = 0x4c065
Failed to load $MFT: Input/output error
Failed to mount '/dev/sdc1': Input/output error
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
made to NTFS by this software.

Unable to read the contents of this file system!
Because of this some operations may be unavailable.
The cause might be a missing software package.
The following list of software packages is required for ntfs file system support: ntfsprogs / ntfs-3g.



Error message from GParted Partition > Check menu in GParted 0.18.0 in Linux Mint 17.3 KDE

GParted 0.18.0 --enable-libparted-dmraid --enable-online-resize

Libparted 2.3
Check and repair file system (ntfs) on /dev/sdc1  00:00:00    ( ERROR )
        
calibrate /dev/sdc1  00:00:00    ( SUCCESS )
        
path: /dev/sdc1
start: 63
end: 3907024064
size: 3907024002 (1.82 TiB)
check file system on /dev/sdc1 for errors and (if possible) fix them  00:00:00    ( ERROR )
        
ntfsresize -i -f -v /dev/sdc1
        
ntfsresize v2013.1.13AR.1 (libntfs-3g)
MFT is corrupt, cannot read its unmapped extent record 19
Note : chkdsk cannot fix this, try ntfsfix
Inode is corrupt (0): Input/output error
Failed to load runlist for $MFT/$DATA.
highest_vcn = 0x3, last_vcn - 1 = 0x4c065
Failed to load $MFT: Input/output error
ERROR(5): Opening '/dev/sdc1' as NTFS failed: Input/output error
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.

========================================


Extract of Tests via Terminal in Linux Mint 17.3 KDE:

frankadmin@frankadmin-Dell-LM17:~ > sudo fdisk -l -u
[sudo] password for frankadmin:   

Disk /dev/sda: 320.1 GB, 320072933376 bytes [THIS IS THE COMPUTER INTERNAL HDD; TRIPLE BOOTS WIN7, LM17.3KDE AND LM18XFCE]
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xc23ecbb9 

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63    71665964    35832951    7  HPFS/NTFS/exFAT
/dev/sda2        71666026   625141759   276737867    f  W95 Ext'd (LBA)
/dev/sda5        71666028   523074392   225704182+   7  HPFS/NTFS/exFAT
/dev/sda6       614357793   625137344     5389776   82  Linux swap / Solaris
/dev/sda7       523075584   582772735    29848576   83  Linux
/dev/sda8       582793216   614336511    15771648   83  Linux 

Partition table entries are not in disk order
Note: sector size is 4096 (not 512) 



**Disk /dev/sdc: 2000.4 GB, 2000398934016 bytes        [THIS IS THE FAULTY EXTERNAL DRIVE]
255 heads, 63 sectors/track, 243201 cylinders, total 3907029168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x5cb5880f

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1              63  3907024064  1953512001    7  HPFS/NTFS/exFAT



**frankadmin@frankadmin-Dell-LM17:~ > sudo parted /dev/sdc unit s print  [THIS IS THE FAULTY EXTERNAL DRIVE]                                                                                                              Model: Seagate Desktop (scsi)   
Disk /dev/sdc: 3907029168s                                                                                                                                                           
Sector size (logical/physical): 512B/512B                                                                                                                                           
Partition Table: msdos                                                                                                                                                                                                                                                                                                                                                   

Number  Start  End          Size         Type     File system  Flags                                                                                                                       
         1      63s    3907024064s  3907024002s  primary  ntfs                                                                                                                               



frankadmin@frankadmin-Dell-LM17:~ > sudo ntfsfix /dev/sdc                                                             
[sudo] password for frankadmin:                                                                                       

Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.


frankadmin@frankadmin-Dell-LM17:~ > sudo chkdsk
sudo: chkdsk: command not found


My question is whether there is anything else I can do in Linux, or whether I need to boot into Win 7 and run the chkdsk /f command in cmd prompt?  If the latter, I am not sure how to write this in cmd.  My guess would be something like: "chkdsk /f H:"

My apologies for such a long post; not sure how much I need to tell you.  I would be grateful for any suggestions.

Cheers

2

Re: External USB backup drive mysteriously corrupted

frankus333 wrote:

My question is whether there is anything else I can do in Linux, or whether I need to boot into Win 7 and run the chkdsk /f command in cmd prompt?

Because Microsoft wrote and maintains NTFS their tools should be be best for recovering this proprietary file system.

frankus333 wrote:

If the latter, I am not sure how to write this in cmd.  My guess would be something like: "chkdsk /f H:"

Yes,  your guess is the correct syntax.

If you have critical data on the drive that you need to access, I suggest you clone the drive first before running chkdsk.  That way you can recover back to this point in time and seek out other solutions if chkdsk doesn't work.

3

Re: External USB backup drive mysteriously corrupted

Thanks gedakc

I used my old 32 bit 1000H eeePC with Win 7 to run that command, and it deleted all the index entries for all the files and folders, as shown in the output below.  The drive is now recognised as normal, but as a clean, empty drive.

I wonder if there are now any clues as to what went wrong in the first place, and how that might have happened?   I am concerned it may happen again if I can't  get to the bottom of it.

Cheers

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>chkdsk /f E:
The type of the file system is NTFS.
Volume label is Expansion Drive.

CHKDSK is verifying files (stage 1 of 3)...
0 percent complete. (0 of 16 file records processed)
Deleted corrupt attribute list entry
with type code 48 in file 0.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Deleted corrupt attribute list entry
with type code 176 in file 0.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Deleted corrupt attribute list entry
with type code 176 in file 0.
Deleting corrupt attribute record (128, "")
from file record segment 0.
Deleting corrupt attribute record (176, "")
from file record segment 0.
  16 file records processed.
File verification completed.
  0 large file records processed.
  0 bad file records processed.
  0 EA records processed.
Correcting file name errors in system file record segment 0.
  0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
63 percent complete. (17 of 22 index entries processed)
Deleting index entry $RECYCLE.BIN in index $I30 of file 5.
Deleting index entry .Trash-1000 in index $I30 of file 5.
Deleting index entry .Trash-1001 in index $I30 of file 5.
Deleting index entry 20151007-LM17.1KDE-img in index $I30 of file 5.
Deleting index entry 20160120-DellLM17.3KDE-img in index $I30 of file 5.
Deleting index entry Autorun.inf in index $I30 of file 5.
Deleting index entry Backups in index $I30 of file 5.
Deleting index entry BK Fam Files in index $I30 of file 5.
Deleting index entry BKFAMF~1 in index $I30 of file 5.
Deleting index entry Dell-Ku1404-root-BUs in index $I30 of file 5.
Deleting index entry Dell-LM17-root-BUs in index $I30 of file 5.
Deleting index entry gPodder in index $I30 of file 5.
Deleting index entry New Juice Podcasts March 2015 in index $I30 of file 5.
Deleting index entry Photos in index $I30 of file 5.
Deleting index entry Podcasts Old in index $I30 of file 5.
Deleting index entry PODCAS~1 in index $I30 of file 5.
Deleting index entry RECYCLER in index $I30 of file 5.
Deleting index entry Seagate Expansion 3TB files in index $I30 of file 5.
Deleting index entry Seagate Files in index $I30 of file 5.
Deleting index entry SeagateDesktop.ico in index $I30 of file 5.
Deleting index entry SEAGAT~1.ICO in index $I30 of file 5.
Deleting index entry Setup.exe in index $I30 of file 5.
Deleting index entry System Volume Information in index $I30 of file 5.
Deleting index entry SYSTEM~1 in index $I30 of file 5.
72 percent complete. (20 of 22 index entries processed)
Deleting index entry $ObjId in index $I30 of file 11.
75 percent complete. (21 of 22 index entries processed)
Deleting index entry $Quota in index $I30 of file 11.
  22 index entries processed.
Deleting index entry $Reparse in index $I30 of file 11.
82 percent complete. (23 of 22 index entries processed)
Deleting index entry $RmMetadata in index $I30 of file 11.
Index verification completed.
  0 unindexed files scanned.
  0 unindexed files recovered.
Creating object id file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 17.
Inserting an index entry into index $O of file 17.
Creating reparse point file.
Inserting an index entry into index $I30 of file 11.
Creating index $R for file 18.
Creating quota file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 19.
Creating index $Q for file 19.
Inserting default quota record into index $Q in file 19.
CHKDSK is verifying security descriptors (stage 3 of 3)...
  24 file SDs/SIDs processed.
Security descriptor verification completed.
Inserting data attribute into file 0.
  4 data files processed.
Correcting errors in the Master File Table (MFT) mirror.
Correcting errors in the master file table's (MFT) DATA attribute.
Correcting errors in the master file table's (MFT) BITMAP attribute.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

1953512000 KB total disk space.
        16 KB in 8 indexes.
         0 KB in bad sectors.
    125608 KB in use by the system.
     65536 KB occupied by the log file.
1953386376 KB available on disk.

      4096 bytes in each allocation unit.
488378000 total allocation units on disk.
488346594 allocation units available on disk.



C:\Windows\system32>

4

Re: External USB backup drive mysteriously corrupted

It seems that the filesystem / MFT was severely damaged, so the check software did eliminate the content. I hope you had no critical content lost, because it is usually very hard to recover drive content.

The computer + external drive + operating system + user's software + drive's firmware is extremely complex, that's why manufacturers offer a warranty for the hardware value only, not for the content value. There are always software bugs, more or less important. Mechanical and electronics can give problems, too. Even a bad contact in a connection can be source of annoying problems.
Perhaps such problems become more important in case of interconnection of pieces of different "generations" (e.g. a very old hard drive to a new computer or the inverse). I never read it but I suspect it from my own experience.

Hardware problems of the drive can cause problems too. You can check the SMART reports of your hard drive, to see if there is such an issue with your drive.

It is better (I mean *safer*) to keep regular backup of your content. Even a brand new hard drive can fail at every moment, within a month or a week. I bought my self 2 HDs same model; the one worked and works flawlessly, the other wasn't able to be partitioned.

*** It is highly recommended to backup any important files before doing resize/move operations. ***