How to repair NTFS fs of SSD (or its image)?

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
andrea
Posts: 2
Joined: 04 Jul 2018, 13:58

How to repair NTFS fs of SSD (or its image)?

#1 Post by andrea »

Hi,

I'm in a situation where I need to fix the NTFS file system of a SSD or the image file that I saved from it using ddrescue. Which tool can do this?

This is the backstory:

I had a working installation of Win 8.1 with 2 drives:
- SSD, 128 GB (drive C:): PLEXTOR PX-128M6G-2280
- HDD, 1 TB (drive D:): ST1000LM014-1EJ164

Windows was installed onto the SSD, but it also stored applications and AppData, ProgramData, user documents etc.

At one point I noticed some irregularities, e.g. GitHub Desktop couldn't start because apparently its sqlite db file was corrupted. So I told Windows to do a chkdsk at the next boot. When I rebooted, it did the check, but then it rebooted again and seemed to do the check again, and then it tried to reboot again but failed. It just showed this blue screen:

Image

I had created a Windows recovery usb stick before, so I booted into that one, and tried to "Repair PC", but I got this error:

Image

So I went into the command prompt and tried `bootrec /RebuildBcd`, but it didn't find the windows installation:

Image

So then (after reading some advice) I tried `chkdsk C: /f /x /r`, but it didn't work:

Image
Image

I noticed that it said:
CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
According to Microsoft docs: "Chkdsk will mark the space as free so the file system can use it."

This seemed suspicious to me, so I checked in diskpart:

Image

It said 119 GB free of 119 GB, so it claims that ALL was free on the SSD, which can't be! It should only be a few GB that were free (about 10).

Also, diskpart says the read-only attribute is NOT set, so how can my SSD be locked?

Image

I was very worried that chkdsk screwed up my SSD, and booted into a linux live usb stick, and did `fdisk -l`:

Image

The SSD is sdb, the HDD is sda. (sdc is the usb stick that contains the linux live image and sdd is an external disk).

As you can see, it says "Disk /dev/sdb doesn't contain a valid partition table". So it wasn't possible to mount it. I became even more worried, and asked on IRC.
Someone recommended using ddrescue to save an image of the SSD, so I saved an image of the SSD as broken-ssd.img.

Image

Then he recommended to use testdisk to extract the files from the SSD.

Image

It said "partition sector doesn't have the endmark 0xaa55", but I could continue.

After some progress (some files extracted) I got some errors:

Image
Image

After some time (after the first error occurred), it flashed many messages over the screen that scrolled by faster than I could read them (or take a pic), then it stopped at the main screen with "354 failed".

Image

Then I ran smartctl to check the status of sdb but it showed a corrupted output and the error "terminate command early due to bad response to iec mode page":

Image

Also, `fdisk -l` now said "unrecognised disk label" for sdb:

Image

Running testdisk on /dev/sdb didn't work again/anymore, so I extracted the files from the broken-ssd.img directly. It took almost a week to extract all the files, it was very slow, it took a long time to extract each file. The guy on IRC said it was because it was reading and writing to the same external disk (that I had saved broken-ssd.img onto), but it seemed to be even slower than it should have been.. Anyway, it finished after almost a week:

Image

(Btw, notice that pagefile.sys appears many times which shouldn't be the case, it only existed once.)

After this, I power cycled the SSD by booting into BIOS and staying in BIOS for 30 min, and then keep the laptop powered off for 30s, then repeating the process 3 times.
After this, I booted into the SystemRescueCd usb stick again, and now smartctl worked with sdb again!
I did a short smart test, and these are the results:
http://dpaste.com/2VJG604
http://dpaste.com/0BTNEGA

The guy on IRC said it looks healthy, is that true?

1. If it's possible in any way, I want to avoid having to reinstall Windows, and want to save the Windows installation that I captured in the broken-ssd.img file. But for that, I need to be able to repair the file system, either on the SSD or in the broken-ssd.img file. How can I repair the ntfs file system with testdisk or other tools (either on the SSD on in the img file)? Should I try ntfsfix?

2. Is the old SSD's hardware still healthy, or does it need to be replaced? (I have it in this laptop since Jan 2015 without problems.) If it's healthy, how can I unlock it, so that I can repair it with the Windows recovery usb stick?

3. If I replace the SSD with a new one (Samsung 850 Evo), and I dd the broken-ssd.img onto it, Windows still can't boot because the file system is corrupted in that img file. Can the Windows recovery usb stick's "Repair PC" function also repair the file system, or does it need the FS to be working, and can only repair individual files like winload.exe?

4. Will dd'ing the img file also make the new SSD appear "locked"? What causes this locking?

5. What is the best way in your opinion to proceed, and to save this Windows installation (onto the new SSD)?
(It would take many weeks to reinstall everything (all the applications etc.) and configure everything as it was, and to copy the AppData etc. so I'd really prefer to save this installation. (And I don't want to install Win 10.))

What I currently plan to do is: Copy (dd) the broken-ssd.img onto the new SSD (if the old SSD is physically broken), and fix it so that I can boot this Windows installation again. So can you please tell me, which tool can I use to repair the ntfs file system, either in the img file, or on the new SSD after I dd the img file onto it. (And after I repaired the file system, if it still doesn't boot, then I can use the Windows recovery usb stick to "Refresh PC", which can then repair individual files like winload.exe, right?)

Thanks so much! :)

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: How to repair NTFS fs of SSD (or its image)?

#2 Post by cgrenier »

It's very strange, ddrescue doesn't list bad sectors but smartctl information is damaged.
Remove the original SSD, try to write the image using ddrescue to a new empty disk and try to repair the clone using chkdsk.

andrea
Posts: 2
Joined: 04 Jul 2018, 13:58

Re: How to repair NTFS fs of SSD (or its image)?

#3 Post by andrea »

Thanks for the quick reply!

Btw, when I try mounting the broken-ssd.img, it fails with the error "ntfs signature missing".

Image

I replaced the SSD with a new Samsung 850 Evo and wrote the saved img file onto it, using ddrescue.

In diskpart, it lists the drive with `list disk` (but it has no drive letter):

Image

Then I ran chkdsk on the SSD:

Image
Image

As you can see, it says 3086 KB total disk space, which is wrong.
Any idea how I can fix the file system of the written image on this new SSD (or the fs in the image file)?

I'd really appreciate any help on this!

Locked