I'm in a situation where I need to fix the NTFS file system of a SSD or the image file that I saved from it using ddrescue. Which tool can do this?
This is the backstory:
I had a working installation of Win 8.1 with 2 drives:
- SSD, 128 GB (drive C:): PLEXTOR PX-128M6G-2280
- HDD, 1 TB (drive D:): ST1000LM014-1EJ164
Windows was installed onto the SSD, but it also stored applications and AppData, ProgramData, user documents etc.
At one point I noticed some irregularities, e.g. GitHub Desktop couldn't start because apparently its sqlite db file was corrupted. So I told Windows to do a chkdsk at the next boot. When I rebooted, it did the check, but then it rebooted again and seemed to do the check again, and then it tried to reboot again but failed. It just showed this blue screen:
I had created a Windows recovery usb stick before, so I booted into that one, and tried to "Repair PC", but I got this error:
So I went into the command prompt and tried `bootrec /RebuildBcd`, but it didn't find the windows installation:
So then (after reading some advice) I tried `chkdsk C: /f /x /r`, but it didn't work:
I noticed that it said:
According to Microsoft docs: "Chkdsk will mark the space as free so the file system can use it."CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
This seemed suspicious to me, so I checked in diskpart:
It said 119 GB free of 119 GB, so it claims that ALL was free on the SSD, which can't be! It should only be a few GB that were free (about 10).
Also, diskpart says the read-only attribute is NOT set, so how can my SSD be locked?
I was very worried that chkdsk screwed up my SSD, and booted into a linux live usb stick, and did `fdisk -l`:
The SSD is sdb, the HDD is sda. (sdc is the usb stick that contains the linux live image and sdd is an external disk).
As you can see, it says "Disk /dev/sdb doesn't contain a valid partition table". So it wasn't possible to mount it. I became even more worried, and asked on IRC.
Someone recommended using ddrescue to save an image of the SSD, so I saved an image of the SSD as broken-ssd.img.
Then he recommended to use testdisk to extract the files from the SSD.
It said "partition sector doesn't have the endmark 0xaa55", but I could continue.
After some progress (some files extracted) I got some errors:
After some time (after the first error occurred), it flashed many messages over the screen that scrolled by faster than I could read them (or take a pic), then it stopped at the main screen with "354 failed".
Then I ran smartctl to check the status of sdb but it showed a corrupted output and the error "terminate command early due to bad response to iec mode page":
Also, `fdisk -l` now said "unrecognised disk label" for sdb:
Running testdisk on /dev/sdb didn't work again/anymore, so I extracted the files from the broken-ssd.img directly. It took almost a week to extract all the files, it was very slow, it took a long time to extract each file. The guy on IRC said it was because it was reading and writing to the same external disk (that I had saved broken-ssd.img onto), but it seemed to be even slower than it should have been.. Anyway, it finished after almost a week:
(Btw, notice that pagefile.sys appears many times which shouldn't be the case, it only existed once.)
After this, I power cycled the SSD by booting into BIOS and staying in BIOS for 30 min, and then keep the laptop powered off for 30s, then repeating the process 3 times.
After this, I booted into the SystemRescueCd usb stick again, and now smartctl worked with sdb again!
I did a short smart test, and these are the results:
The guy on IRC said it looks healthy, is that true?
1. If it's possible in any way, I want to avoid having to reinstall Windows, and want to save the Windows installation that I captured in the broken-ssd.img file. But for that, I need to be able to repair the file system, either on the SSD or in the broken-ssd.img file. How can I repair the ntfs file system with testdisk or other tools (either on the SSD on in the img file)? Should I try ntfsfix?
2. Is the old SSD's hardware still healthy, or does it need to be replaced? (I have it in this laptop since Jan 2015 without problems.) If it's healthy, how can I unlock it, so that I can repair it with the Windows recovery usb stick?
3. If I replace the SSD with a new one (Samsung 850 Evo), and I dd the broken-ssd.img onto it, Windows still can't boot because the file system is corrupted in that img file. Can the Windows recovery usb stick's "Repair PC" function also repair the file system, or does it need the FS to be working, and can only repair individual files like winload.exe?
4. Will dd'ing the img file also make the new SSD appear "locked"? What causes this locking?
5. What is the best way in your opinion to proceed, and to save this Windows installation (onto the new SSD)?
(It would take many weeks to reinstall everything (all the applications etc.) and configure everything as it was, and to copy the AppData etc. so I'd really prefer to save this installation. (And I don't want to install Win 10.))
What I currently plan to do is: Copy (dd) the broken-ssd.img onto the new SSD (if the old SSD is physically broken), and fix it so that I can boot this Windows installation again. So can you please tell me, which tool can I use to repair the ntfs file system, either in the img file, or on the new SSD after I dd the img file onto it. (And after I repaired the file system, if it still doesn't boot, then I can use the Windows recovery usb stick to "Refresh PC", which can then repair individual files like winload.exe, right?)
Thanks so much!