cgsecurity.org

Hi,

I'm not all that tech savvy when it comes to this end of things and am hoping someone might be able to help me decide which option to choose to repair an NTFS filesystem.

On a Windows 7 PC I was manually backing up files to an external 2 GB USB drive formatted NTFS that should have had 1 single primary partition. The software I was using, Beyond Compare, complained that a folder on the target USB drive was either corrupted or for some reason just wasn't accessible.

It's been a while since I checked the filesystem on the drive. So from an administrator's prompt I ran: chkdisk F: /f

But it quickly stalled for a long time before eventually exiting with the message:
That left Windows Explorer unable to access the drive, showing just the drive letter and no data contents info. Windows asked if I wanted to reformat the drive a couple of times, but hasn't since.

But running TestDisk from a command prompt did find the drive. So I read through "TestDisk Step By Step" trying to refresh my memory of repairing a partition table with TestDisk from way back in the early 00s. But I got stuck a few menus into the process.

Loading TeskDisk and finding the drive when well:



Choosing 'Analyze' got me to the next step:



I don't understand what the '2 E extended LBA' partition is. Googling it comes back with hits on it being related to FAT systems. Reading through 'Step by Step' it looks like I see the same thing there, and am guessing it might just be a different way of confirming the '5 L HPFS - NTFS' partition below. That partition is labeled L for Logical, but it seems it ought to be Primary non-bootable. When I bought the drive I just mounted it in an external USB case and plugged it into my W7 PC. Every other drive I've add that way have become Primary non-bootable.

At this point I chose 'Quick Search' and got this:



That looks right except for the partition being shown as Logical. I hit P, and got a screen showing all the files and folders on the drive. I navigated through a few to confirm they look right. So a Q put me back to the previous screen (above)

It seems when I lost all access to the file system for that drive back in the 00s, I chose 'L: load backup' to rewrite the partition table from a backup. So I'm not sure if I should do that here or proceed to the next step where I hit 'Enter' to continue. That gets me this:



This is where I'm tempted to choose 'Write'. But I haven't found the documentation that explains exactly what this will do. From the 'Step By Step' example I see both those 'LBA' and 'HPFS - NTFS' partitions listed where I don't understand what LBA is all about. And I'm wondering if I should back up and change the NTFS partition from L-logical to P-primary.

Thanks for any feedback on this. I hope I've laid out the problem properly.

Please post your Testdisk log file and upload your images to this site.

Thanks for you input recuperation. Here's the log. I've edited my original post and inserted all images with ones uploaded to the forum

<deleted>

sbramguy wrote: 22 Jan 2024, 11:44 Hi,

I'm not all that tech savvy when it comes to this end of things and am hoping someone might be able to help me decide which option to choose to repair an NTFS filesystem.

On a Windows 7 PC I was manually backing up files to an external 2 GB USB drive formatted NTFS that should have had 1 single primary partition. The software I was using, Beyond Compare, complained that a folder on the target USB drive was either corrupted or for some reason just wasn't accessible.

It's been a while since I checked the filesystem on the drive. So from an administrator's prompt I ran: chkdisk F: /f

But it quickly stalled for a long time before eventually exiting with the message:

Code: Select all

99 percent complete. (225280 of 8572168 USN bytes processed)
Unable to read the Usn Journal $J data stream.

That left Windows Explorer unable to access the drive, showing just the drive letter and no data contents info. Windows asked if I wanted to reformat the drive a couple of times, but hasn't since.

But running TestDisk from a command prompt did find the drive. So I read through "TestDisk Step By Step" trying to refresh my memory of repairing a partition table with TestDisk from way back in the early 00s. But I got stuck a few menus into the process.

Loading TeskDisk and finding the drive when well:



Choosing 'Analyze' got me to the next step:



I don't understand what the '2 E extended LBA' partition is. Googling it comes back with hits on it being related to FAT systems.

The extended LBA partition is an extension of the old MS-DOS partition table allowing for multiple partitions on a disk. The original MBR scheme just contained one partition table with four entries. One of the four entries was marked "active" and was the only visible one. The extended (LBA) partition contains so-called "logical partitions". That scheme does not relate to what is inside of a partition. The content could be raw or any file system possible.

Reading through 'Step by Step' it looks like I see the same thing there, and am guessing it might just be a different way of confirming the '5 L HPFS - NTFS' partition below. That partition is labeled L for Logical, but it seems it ought to be Primary non-bootable.

For what reason should it be "primary non-bootable"? At least the legacy windows version assigned drive labels to primary partitions first and logical partitions later. When dealing with a data drive I guess one would rather prefer that label not messing around with the usual order of partition labels.

When I bought the drive I just mounted it in an external USB case and plugged it into my W7 PC. Every other drive I've add that way have become Primary non-bootable.

Either your disk was already partitioned or you partitioned it yourself. By the way, it is better to say disk instead of drive because a drive is often associated with a partition, for instance, the C-drive, the D-drive etc. A disk refers to the whole physical entity regardless of the partitions inside.

At this point I chose 'Quick Search' and got this:



That looks right except for the partition being shown as Logical. I hit P, and got a screen showing all the files and folders on the drive. I navigated through a few to confirm they look right. So a Q put me back to the previous screen (above)

It seems when I lost all access to the file system for that drive back in the 00s, I chose 'L: load backup' to rewrite the partition table from a backup.

If you did not create a backup yourself, there is no backup, but there is no reason to change this partition table anyway.

So I'm not sure if I should do that here or proceed to the next step where I hit 'Enter' to continue. That gets me this:



This is where I'm tempted to choose 'Write'. But I haven't found the documentation that explains exactly what this will do. From the 'Step By Step' example I see both those 'LBA' and 'HPFS - NTFS' partitions listed where I don't understand what LBA is all about.

Please use a search engine to learn about "LBA"! It does not matter in your case.

And I'm wondering if I should back up and change the NTFS partition from L-logical to P-primary.

Thanks for any feedback on this. I hope I've laid out the problem properly.

You laid out the problem very well!

Your are suspecting the problem in the wrong area.
You could copy the content of your disappeared partition to another disk using Testdisk using the "p"-key ("list files").

A smarter way would be to

1. Post your SMART parameters as described here
viewtopic.php?f=5&t=10910
2. Depending on the result, cloning the disk using ddrescue as described in the manual.
3. Running TestDisk against the clone and extracting your data to another disk.

Cloning a full disk is stressing the disk less than copying its content file-wise except for a pretty empty disk. On the other hand, TestDisk is not equipped with code to deal with broken sectors, but ddrescue is.

Repairing the file system of a broken disk is rather the exception than the rule.

recuperation wrote: 23 Jan 2024, 01:41 The extended LBA partition is an extension of the old MS-DOS partition table allowing for multiple partitions on a disk. The original MBR scheme just contained one partition table with four entries. One of the four entries was marked "active" and was the only visible one. The extended (LBA) partition contains so-called "logical partitions". That scheme does not relate to what is inside of a partition. The content could be raw or any file system possible.

I had a rough understanding of this way, way back, but it's all a bit fuzzy to me now. Thanks for explaining it.

Please use a search engine to learn about "LBA"! It does not matter in your case.

Thanks. The Wikipedia page on 'Logical block addressing' helped refresh my memory a bit.

Reading through 'Step by Step' it looks like I see the same thing there, and am guessing it might just be a different way of confirming the '5 L HPFS - NTFS' partition below. That partition is labeled L for Logical, but it seems it ought to be Primary non-bootable.

For what reason should it be "primary non-bootable"? At least the legacy windows version assigned drive labels to primary partitions first and logical partitions later. When dealing with a data drive I guess one would rather prefer that label not messing around with the usual order of partition labels.

My mistake. I should have just said it ought to be labeled Primary.

Either your disk was already partitioned or you partitioned it yourself. By the way, it is better to say disk instead of drive because a drive is often associated with a partition, for instance, the C-drive, the D-drive etc. A disk refers to the whole physical entity regardless of the partitions inside.

'Disk' > Whole drive. 'Drive' > Partitions. Got it!

It seems when I lost all access to the file system for that drive back in the 00s, I chose 'L: load backup' to rewrite the partition table from a backup.

If you did not create a backup yourself, there is no backup, but there is no reason to change this partition table anyway.

I thought maybe 'L load backup' might have been referring to what I did back in the 00s when I used TeskDisk to restore, I think an MBR (or partition table?) from a backup copy that it seems is written to the very end of the disk or partition. I've yet to find that process that must be detailed somewhere in cgsecurity's documentation. Back then the gurus over in the Compuserve Windows support forums all told me the disk was a lost cause. Boy were they surprised!

So are you saying it wouldn't matter at this point if the data on the disk was originally on a Primary or Logical partition? And that you don't see an option here to get the disk recognized in Windows again?

Your are suspecting the problem in the wrong area.
You could copy the content of your disappeared partition to another disk using Testdisk using the "p"-key ("list files").

A smarter way would be to

1. Post your SMART parameters as described here
viewtopic.php?f=5&t=10910

That was pretty easy to figure out. I'll attach 2 versions. One using the -a switch as described there, and one using the -x switch as what was suggested at the end of the report generated with the -a switch. It all looks like Greek to me. Do they tell you anything that'd help here?

2. Depending on the result, cloning the disk using ddrescue as described in the manual.

Figuring how to install and run ddrescue got pretty convoluted. I have a copy of the Windows command line dd-0.5 from 2009 I used to clone a USB drive ages ago. I can't find any freely available copies of ddrescue that will run in a Windows GUI or command line. And for Linux there's seems to be 2 versions: 'GNU ddrescue' or just 'gddrescue', and 'ddrescue' that have been developed independently of each other. I've read some say ddrescue by Kurt Garloff might be more aggressive at imaging corrupted sectors.

I have 2 copies of Linux on bootable USB sticks. An 8 year old copy of Mint I love. The only other version I could get to boot and operate quickly recently is a flavor of Puppy Linux. The latter includes PuDD (Puppy Universal DD). And I was able to use Puppy's package installer to download and install gddrescue command line files.

99% of the files on this disk are just backups for ones on my W7 PC. But there are 1 or 2 I wrote to the disk I never backed up anywhere. I was able to copy them to another disk with TestDisk, but those copies fail to be read properly and open. I was hoping TeskDisk would have a "one click" option to get the disk recognized again in Windows, and that running chkdsk on it again might repair the damaged files. I did that successfully with another disk a while back.

3. Running TestDisk against the clone and extracting your data to another disk.

That would involve 3 disks?

Cloning a full disk is stressing the disk less than copying its content file-wise except for a pretty empty disk. On the other hand, TestDisk is not equipped with code to deal with broken sectors, but ddrescue is.

So I'm working on ddrescue. I haven't had luck cloning disks in Linux. My attempt cloning a Linux Mint USB stick with Clonezilla was a disaster. From what I wrote above, maybe you can clear a few things up and make some suggestions on the best path(s) forward.

Repairing the file system of a broken disk is rather the exception than the rule.

That's why I amazed myself and the CServe gurus when Christophe told me how to restore the MBR (partition table?) on that failed disk so many, many years back!

sbramguy wrote: 23 Jan 2024, 08:09

recuperation wrote: 23 Jan 2024, 01:41 The extended LBA partition is an extension of the old MS-DOS partition table allowing for multiple partitions on a disk. The original MBR scheme just contained one partition table with four entries. One of the four entries was marked "active" and was the only visible one. The extended (LBA) partition contains so-called "logical partitions". That scheme does not relate to what is inside of a partition. The content could be raw or any file system possible.

I had a rough understanding of this way, way back, but it's all a bit fuzzy to me now. Thanks for explaining it.

Please use a search engine to learn about "LBA"! It does not matter in your case.

Thanks. The Wikipedia page on 'Logical block addressing' helped refresh my memory a bit.

Reading through 'Step by Step' it looks like I see the same thing there, and am guessing it might just be a different way of confirming the '5 L HPFS - NTFS' partition below. That partition is labeled L for Logical, but it seems it ought to be Primary non-bootable.

For what reason should it be "primary non-bootable"? At least the legacy windows version assigned drive labels to primary partitions first and logical partitions later. When dealing with a data drive I guess one would rather prefer that label not messing around with the usual order of partition labels.

My mistake. I should have just said it ought to be labeled Primary.

I was asking you why you thought that it should have been labeled Primary as there is no need for that at all.

Either your disk was already partitioned or you partitioned it yourself. By the way, it is better to say disk instead of drive because a drive is often associated with a partition, for instance, the C-drive, the D-drive etc. A disk refers to the whole physical entity regardless of the partitions inside.

'Disk' > Whole drive. 'Drive' > Partitions. Got it!

It seems when I lost all access to the file system for that drive back in the 00s, I chose 'L: load backup' to rewrite the partition table from a backup.

If you did not create a backup yourself, there is no backup, but there is no reason to change this partition table anyway.

I thought maybe 'L load backup' might have been referring to what I did back in the 00s when I used TeskDisk to restore, I think an MBR (or partition table?) from a backup copy that it seems is written to the very end of the disk or partition. I've yet to find that process that must be detailed somewhere in cgsecurity's documentation. Back then the gurus over in the Compuserve Windows support forums all told me the disk was a lost cause. Boy were they surprised!

So are you saying it wouldn't matter at this point if the data on the disk was originally on a Primary or Logical partition? And that you don't see an option here to get the disk recognized in Windows again?

Your are suspecting the problem in the wrong area.
You could copy the content of your disappeared partition to another disk using Testdisk using the "p"-key ("list files").

A smarter way would be to

1. Post your SMART parameters as described here
viewtopic.php?f=5&t=10910

That was pretty easy to figure out. I'll attach 2 versions. One using the -a switch as described there, and one using the -x switch as what was suggested at the end of the report generated with the -a switch. It all looks like Greek to me. Do they tell you anything that'd help here?

Thank you so much for doubting my competence!
Your disk is broken with roughly 2000 sectors either being replaced or unreadable "pending", even your report tells you explicitly that it is failing. So far for "Do they tell you anything that'd help here?"
I apologize for being careful and giving you advice beyond the TestDisk package. Please ignore point 1 und 2 und just run TestDisk.