2TB External USB RAID 1 - how to verify integrity

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
DellAnderson
Posts: 2
Joined: 10 Jun 2015, 17:49

2TB External USB RAID 1 - how to verify integrity

#1 Post by DellAnderson »

I am attempting to go paperless and scanning old documents to PDF (Fujitsu ScanSnap S1500) onto a RAID 1 in external USB enclosure (NextStar MX) with Windows 7 Pro laptop.

Occasionally a few random directories on the drive would disappear. Rebooting fixed that but only temporarily. It would happen again. Occasionally I would receive "cannot access..." type messages for particular directories that I could see, but not enter. I would get occasional warnings essentially telling me I needed to run chkdsk (sorry I did not write down the exact phrases but I googled them at the time and essentially it seemed to be a MFT corruption issue). As it was a 2TB RAID 1, I cancelled the chkdsk /f option and re-ran chkdsk with the default. I later learned runnign checkdsk with /f option is dangerous, but files seemed OK after overnight chkdsk. I still had intermitten disappearing directories issue which was only solvable by rebooting each time. Somewhere early yesterday afternoon I turned off search indexing for all drives, thinking perhaps something was out of sync and I have issues with indexing on other computers in the past. No improvement.

Then while shutting down to regain access to these directories, I was greeted with 15 Microsoft Tuesday updates, which after allowing installation required yet another reboot, upon which time I was informed this drive was corrupted and needed to run chkdsk, which I allowed it to do. This process created scary messages like

"Recovering orphaned file ... "
"Deleting and index entry with id 288 from index SII of file..."

All seemed well at first after final reboot, but then I noticed that everything I had scanned yesterday had (6/9/15) disappeared. I don't know what else may be missing. Drive had maintained some directory name changes I had edited yesterday, but absolutely no pdf's created 6/9/15 were retained.

I can rescan the documents, but not only is this tedious, they are no longer as organized as they once were (now in the 'to shred' bin in a big pile). AND I am not sure I can trust this drive.

I have run TestDrive -- initially I wrongly chose the drive letter option, which generated lots of strange errors (unable to detect partition type etc) and was unable to restore partition despite overnight deep scan.

Then saw Fiona's post about choosing "DISK" instead of "DRIVE" and reran testing and partition seems to be "OK" NTFS partition. I then tried to use the second option (file utilities) to UNDELETE, and although I was able to scroll thru a huge list of potentially recoverable files, I did not see any I wanted to recover and none from yesterday.

So my question is this:
What steps can I take to verify that this RAID 1 volume partition is actually OK. How can I find out why directories are randomly disappearing then reappearing after a reboot? Is there any hope that the files I scanned yesterday are hiding somewhere? Ideas?

Thanks much in advance!

DellAnderson
Posts: 2
Joined: 10 Jun 2015, 17:49

Re: 2TB External USB RAID 1 - how to verify integrity

#2 Post by DellAnderson »

The relevant testdisk.log section for this USB RAID is:

Code: Select all

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1862 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243195 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 P HPFS - NTFS              0  32 33 243194 205 19 3906922496
No partition is bootable
At one point, I received a message that some files were moved to a folder with a numbered name at the root of the drive, but I have been unable to find that folder anywhere on the drive (or elsewhere for that matter) despite showing hidden & system files in view options under Windows 7.

Presumably the previously deleted chkdsk files are deleted more thoroughly or completely than if a user deletes them? Frankly, I am not happy with Windows chkdsk if that is the case. But somehow I doubt it.

** Not sure how to determine whether the deleted files are with TestDisk. I did run the utility 'undelete' but did not find the missing files. Is there anyother function? I did not really understand the dialog that came up after my first analysis deep search where it found a "." and ".." and offered to "copy" them for me. I presume these were the folder and super folder references but did not find anything obviously my deleted files.

Incidentally, I have been in communication with the RAID enclosure tech support, and their assessment so far is that the problem is originally due to intermittent USB connection interruptions due to use of the drive on a HUB or possible loose connection, bad cable, etc. So I have switched to eSATA connection for now. I have not had the strange 'you need to run chkdsk' type errors since, but I am hesitating to write anything to that drive until I know for sure that the deleted files are not recoverable AND that the drive is trustworthy.

I also discovered that I had actually not disabled indexing on the drive, so I did that in drive properties. I also enabled "Quick Removal" to avoid any future problems with unsafe disconnecting although I know that disables the efficiencies of caching.

Locked