NTFS - Problem - Or - Not Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
dw85745
Posts: 3
Joined: 12 Jul 2017, 18:51

NTFS - Problem - Or - Not

#1 Post by dw85745 »

Any constructive advice, help, appreciated.

------------
PROBLEM
------------
I have been gradually noticing some weird things with the file system. For example when
creating a new folder (directory), I'll type one or two characters and then the cursor will jump to a
different folder. Or I'll look for a folder and it seems out of place.

I ran chkdsk on the "son" drive (see background) and supposedly files were recovered but were put in 53 chkdsk "found" directories with each chkdsk directory containing numerous folders and files.

-------------------------
WHAT I WANT TO DO
'--------------------------
"Restore" - if possible - the chkdsk "found" directories back to their original directory and file locations the EASIEST WAY possible.

-----------------
BACKGROUND:
'-----------------
OS: Windows 7; CPU: Intel i5-4690K;

I have three drives (all Drives WD Blue Label) as follows:
1) Primary (son - 250 GB), which remains on line and two backup drives
2) (father - 500 GB) a day old clone , and
3) (grandfather - 500 GB) a week old clone
The two 500 GS drives have had little use and are backup drives ONLY.

All Drives are is Running SMART and no notice of any issues from the OS.

I use Clonzilla for cloning.

The "problem" logical extended drive partition contains MANY small files.

I decided to see what results I would get using chkdsk on the "father". It was the same as the 'son".
Boat load of folders and files in 53 chkdsk directories. So obviously cloning the "son"
brought over a bad NTFS file system to the "father"

I have NOT touched the "grandfather" backup.

Cloned the grandfather to the father.
After cloning, I again ran chkdsk on the "father" and received the same 53 "found" file folders
containing directories and files. So obviously the NFTS file system issue is also on the
"grandfather".

-----------------------------------------------------------
WHAT I"VE DONE TO CHECK PRIMARY DRIVE (son)
----------------------------------------------------------
Ran WD's "Lifeguard Tools for Windows" on the "son" (Primary) and says "son" OK.
Ran "TestDisk" on the "son" and says everything OK.
So assume running "chkdsk" corrected the NTFS issues.

--------------------------------------------------------
WHAT I'VE DONE IN HOPES OF RECOVERING THE
DIRECTORIES / FILES using a "WORK" Drive
--------------------------------------------------------
Noted the file names of several files in the chkdsk "found" directory on the "son".
I then went to the "grandfather" (son offline) to see if I could find the same files and open them
since I have NOT run "chkdsk" on the "grandfather">.

I was able to locate these files, and find them in the correct directory and also open and view them.

I then cloned FROM the "grandfather" TO the "father" to obtain a "WORK" Drive..

Ran "TestDisk" on the "WORK" drive and comes back with a GREEN line and saying Structure OK.

----------------------------------------------------------------------
QUESTIONS HOPING SOMEONE CAN ANSWER Re: TESTDISK
Note: Running TestDisk v7.0 from System Rescue CD X86-5.0.2
---------------------------------------------------------------------
1) Why does "chkdsk" say NTFS is bad while TestDisk say OK
2) TestDisk created a "log" file in the root but I could NOT find it on my WORK drive.
Since I'm running from CD, is the "log" file only in Memory?
3) I figured I would manually copy each directory (assume will also copy all files in directory)
one at a time from the "WORK" drive to the "son". Have NOT gone into
TestDisk copy yet -- BUT how do I tell which is my "WORK" drive and whidh is the "grandfather"?
FWIW: Clonzilla uses the physical serial number of each drive to iD each drive)

-----------------------------------
QUESTIONS - GENERAL
----------------------------------
1) Is it possible to clone or copy partition to partition from a larger drive (500 GB) to a smaller drive (250 GB)?

2) Since I'm cloning drives, the DiskId are the same on each drive.
Windows 7 (diskmgt.msc) doesn't like this and while I can bring both drives on-line (one bootable) with
"diskmgt.msc", I wonder if having two DiskId's the same when starting the compuer may be causing issues. Should I Change the DiskId offline before I try to bring the drive on-line?

3) I'm a little confused. Why can I locate and see the files on the "grandfather" when a cloning of this partition and
re-running chkdsk finds errors?

4) With Clonzilla, do I need to unmount the drives before I "poweroff" when doing a drive to drive clone.
If so, how do I unmount the drives?

5) Is having a large number of small files possibly causing my issue?
Note that under each folder there is a small number of files, but taken together on the
entire partition there are 32 GB of small sized files?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS - Problem - Or - Not

#2 Post by cgrenier »

1) Why does "chkdsk" say NTFS is bad while TestDisk say OK

TestDisk say the NTFS boot sector is ok, not that the NTFS filesystem is ok.

2) TestDisk created a "log" file in the root but I could NOT find it on my WORK drive. Since I'm running from CD, is the "log" file only in Memory?

The file was probably written in a ramdrive.

3) I figured I would manually copy each directory (assume will also copy all files in directory)
one at a time from the "WORK" drive to the "son". Have NOT gone into
TestDisk copy yet -- BUT how do I tell which is my "WORK" drive and whidh is the "grandfather"?
FWIW: Clonzilla uses the physical serial number of each drive to iD each drive)

By default, testdisk lists the disk model but not the disk serial number.
Run "testdisk /list" to get this information.

-----------------------------------
QUESTIONS - GENERAL
----------------------------------
1) Is it possible to clone or copy partition to partition from a larger drive (500 GB) to a smaller drive (250 GB)?

By definition, the partition should be the same size, otherwise it's not filesystem cloning but file copying.

2) Since I'm cloning drives, the DiskId are the same on each drive.
Windows 7 (diskmgt.msc) doesn't like this and while I can bring both drives on-line (one bootable) with
"diskmgt.msc", I wonder if having two DiskId's the same when starting the compuer may be causing issues. Should I Change the DiskId offline before I try to bring the drive on-line?

Yes, two filesystem with the same UUID may confused the OS, Linux included.

3) I'm a little confused. Why can I locate and see the files on the "grandfather" when a cloning of this partition and
re-running chkdsk finds errors?

A real clone (ie dd copy) copy everything, errors included.

4) With Clonzilla, do I need to unmount the drives before I "poweroff" when doing a drive to drive clone.
If so, how do I unmount the drives?

You should ask your question about Clonezilla on Clonezilla forum or mailling list.

5) Is having a large number of small files possibly causing my issue?
Note that under each folder there is a small number of files, but taken together on the entire partition there are 32 GB of small sized files?

It should have no impact.

dw85745
Posts: 3
Joined: 12 Jul 2017, 18:51

Re: NTFS - Problem - Or - Not

#3 Post by dw85745 »

cgenier: Thank you for your time and effort on my behalf and excellent responses. Helps clear things up a bit.

1)
<quote>
TestDisk say the NTFS boot sector is ok, not that the NTFS filesystem is ok.
</quote>

Question:
Is there anyway -- TestDisk, other Program, commandline -- I can use to test the FileSystem integrity "other than" chkdsk
(making assumption chkdsk is checking File System integrity) ?

2) Yesterday I changed the file signature on the "son" from the Windows commandline using "diskpart".
"son" was only drive in system.

After shutting off the computer and attempting to reboot the "son", I errored -- missing key files -- and Windows wanted me
to install the installation disk.

Booted from another drive and used commandline "diskpart" to put the original "son" signature into the drive.
Put other drive offline, rebooted, and the "son" booted fine.

I was under the impression, the only thing the signature was used for was to compare two or more
drives, and only allow one to be boot.

It appears Windows is somehow using the signature for more that just comparing two or more drives.

With all this UAC and my understanding tables which are modified within the BIOS (don't call it BIOS anymore and don't recall name)
on the motherboards now, is the signature being written out to hardware for future use?

Question:
Any explanaton would be appreciated?

dw85745
Posts: 3
Joined: 12 Jul 2017, 18:51

Re: NTFS - Problem - Or - Not

#4 Post by dw85745 »

FollowUp:

I tried doing a drag/drop copy between my backup drive (work / grandfather) and Primary Drive (son).
I did it in increments and ran Chkdsk after each group move.
It appears to have worked as my file structure to be restored and a final run of Chkdsk when
done showed NO errors.

Locked