Bad NTFS Boot Partition?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
akovia
Posts: 2
Joined: 23 Sep 2014, 23:43

Bad NTFS Boot Partition?

#1 Post by akovia »

Hi,
I have something stange going on and I can't figure out what happened, but now my *new* external usb3 4TB drive won't mount.

I am running a dual boot system with windows 7 and xubuntu. My main OS is xubuntu. I am getting ready to update my Linux OS and have had to boot into Windows a few times to sync the time and such, and in the process Windows of course made a bunch of updates. I had my USB drive connected as the reason I was upgrading my OS was that my Nix filesystem seemed to be damamged and so I used Gnu ddrescure to back everything up to img files on the big USB drive. All was fine until one last boot into Windows sparked a chkdsk on my USB drive and I wasn't around when it started. When I came back to my computer I noticed that chkdsk was "Fixing" all my files on the USB drive by deleting them. As I was watching my life and data go down the tubes, my only option was to do a hard shutdown.

So..
after removing the drive and booting into Windows, I immediately went to check the logs to see if I could find a record of this heinous action. The logs I found showed a bunch of errors but said it was unable to fix the errors as the disk was in read-only mode. (I am not in Windows right now but I can hunt down and attach those logs if needed.)
Problem is, that I clearly saw when chkdsk was running that it was deleting the files.

Now I attached the drive in linux and of course it was unmountable so I moved to try testdisk. I analysed the disk,
then did the Deeper Search which took most of the day bad came back with zero errors.

I looked over this page, http://www.cgsecurity.org/wiki/Advanced ... MFT_Repair
but wasn't confident enough to go any further. From what I can tell, the disk seems structuraly sound, but something got fubar'd along the way before chkdsk started, or from the hard rebbot to stop chkdsk.

Here's my log
Could anyone please advise how I should proceed? The data on this is already a backup of possibly corrupted data and I feel I keep burrowing further down the rabbit hole. The TestDisk program is still open in my terminal and won't do anything until I hopefully hear back.

Many Thanks,
akovia

akovia
Posts: 2
Joined: 23 Sep 2014, 23:43

Re: Bad NTFS Boot Partition?

#2 Post by akovia »

I'm getting the feeling I'm screwed here.
I'm also thinking that my USB controller might have caused this. I have another large drive that was attached previously but It had connection problems when hooked into the USB3 port. When I removed it from the enclosure to put inside my machine, It wasn't readable anymore either. I haven't investigated that one yet, but now I'm thinking it's probably the same thing. It's like my computer keeps killing my disks,

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Bad NTFS Boot Partition?

#3 Post by Fiona »

Is your file system still accessible or does it appear as RAW?
If it's accessible, did you find some folders like found000 containing files like file1234.chk?
Normally if chkdsk modified your file system and data, you'll need datarecovery software.
I only recommend Repair MFT in conjunction with chkdsk, if chkdsk stops working or hangs.
But it's only a try to repair a file system and not intended to recover data.
Intel MBR only supports partitions up to 2.2 TB.
For larger disks GPT is recommended.
Although disks containing 4 k sectors can support more.
But my experience is, it's not as stable.
Something to try might be:
In TestDisk please use EFI GPT as your partition table type.
Go to the Menu Advanced.
Your partition should be marked.
Your partition should appear as MS Data.
Confirm at Boot.
Run Rebuild BS.
It's a diagnose only and as long as you don't confirm at Write, nothing will be changed.
Have another try to list your data using the menu List.
In case if it was successful, I recommend to copy your data to another healthy partition/disk.
If the menu boot is not available, you can use the the menu Type to add NTFS to your partition and boot should be available.

Fiona

Locked