122

MY NTFS Partition has gotten corrupt somehow (it's a relic from the days when I had Windows installed).

GParted screenshot showing different partitions

I'm putting the debug output of fdisk and blkid here.

At the same time, any OS is unable to mount my root partition, which is located next to my NTFS partition. I'm not sure if this has anything to do with it, though. I get the following error while trying to mount my root partition (sda5)

mount: wrong fs type, bad option, bad superblock on /dev/sda5,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

ubuntu@ubuntu:~$ dmesg | tail
[ 1019.726530] Descriptor sense data with sense descriptors (in hex):
[ 1019.726533]         72 03 11 04 00 00 00 0c 00 0a 80 00 00 00 00 00 
[ 1019.726551]         1a 3e ed 92 
[ 1019.726558] sd 0:0:0:0: [sda]  Add. Sense: Unrecovered read error - auto reallocate failed
[ 1019.726568] sd 0:0:0:0: [sda] CDB: Read(10): 28 00 1a 3e ed 40 00 01 00 00
[ 1019.726584] end_request: I/O error, dev sda, sector 440331666
[ 1019.726602] JBD: Failed to read block at offset 462
[ 1019.726609] ata1: EH complete
[ 1019.726612] JBD: recovery failed
[ 1019.726617] EXT4-fs (sda5): error loading journal

When I open gparted (using live CD), I get an exclamation next to my NTFS drive which states GParted Screenshot showing error

Is there a way to run chkdsk without using windows ?

My attempt to run fsck results in the following :

ubuntu@ubuntu:~$ sudo fsck /dev/sda
fsck from util-linux-ng 2.17.2
e2fsck 1.41.14 (22-Dec-2010)
fsck.ext2: Superblock invalid, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open /dev/sda

The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

Update: I was able to fix the NTFS partition running chkdsk off Hiren's BootCD, but it seems that the superblock problem still remains.

Update 2: Fixed superblock issue using e2fsck -c /dev/sda5

wjandrea
  • 14,236
  • 4
  • 48
  • 98
Nemo
  • 9,460
  • 1
    Link to a related question: http://askubuntu.com/q/58755/31592 – blong Apr 10 '13 at 22:24
  • I remember there was some discussions about importing ntfs.vxd directly into a linux tool and using it for access. Whatever tool became of using the real ntfs.vxd under linux? – Justin Goldberg Oct 31 '22 at 20:43

12 Answers12

142

NOTE: THIS ANSWER IS BOTH OUTDATED, AND NOT ADVISED IF YOU HAVE READ ERRORS.

Install ntfs-3g with sudo apt-get install ntfs-3g. Then run the ntfsfix command on your NTFS partition.

For example:

ntfsfix /dev/hda6

ntfsfix v2.0.0 (libntfs 10:0:0)


Usage: ntfsfix [options] device


Attempt to fix an NTFS partition.

-h, --help             Display this help
-V, --version          Display version information






Developers' email address:


linux-ntfs-dev@lists.sf.net Linux NTFS
homepage: http://www.linux-ntfs.org

For newer Ubuntus You can use -b and -d option together. -b tries to fix bad clusters and -d to fix dirty states. So the command can be

sudo ntfsfix -b -d /dev/sda6

--help shows them

ntfsfix v2015.3.14AR.1 (libntfs-3g)

Usage: ntfsfix [options] device
    Attempt to fix an NTFS partition.


-b, --clear-bad-sectors Clear the bad sector list
-d, --clear-dirty       Clear the volume dirty flag
-h, --help              Display this help
-n, --no-action         Do not write anything
-V, --version           Display version information
davidbaumann
  • 1,887
  • 1
  • 18
  • 31
RolandiXor
  • 51,541
  • Do you have any suggestions for the superblock issue ? I've fixed the NTFS partition. – Nemo Jun 08 '11 at 20:25
  • @Capt.Nemo, I wish I did, but I'm not 100% sure on the Super Block issue. – RolandiXor Jun 08 '11 at 20:30
  • 5
    This is not a helpful answer unfortunately - the problem is not in fact how to fix the NTFS filesystem structures, but the unrecoverable read errors at the block device level (below NTFS). This means that (as psusi already said) "your disk is toast" - the only option is to buy a new hard drive and restore from backup. If you don't have up to date backups you can try using GNU ddrescue ("apt-get install gddrescue") to recover as much data as possible to a disk image file. Google for Ubuntu disk recovery for more help. – RichVel Oct 16 '11 at 06:00
  • @RichVel: thanks for the informative wall of text, but I don't think unhelpful answers get accepted and upvoted thrice... – RolandiXor Oct 16 '11 at 11:21
  • 3
    @RolandTaylor: I'm sure it was intended to be helpful, but telling someone to run a filesystem check when there is a visible unrecoverable read error in the logs is not going to help them. They might be able to fix their error temporarily but the disk hardware really is failing and the ntfix isn't helping that. – RichVel Oct 17 '11 at 08:01
  • @RichVel: Rich while that may be true, do realize that when the question was posted (as well as my answer) there was no known reason to replace the drive (as understood between myself and the OP). Also, I have had the experience of fixing a similar error on a laptop hard drive that was supposedly dead. I used that drive without issue for years after. I again was able to do the same with a desktop hard drive. Not saying it always works, but sometimes the error isn't what it seems to be. – RolandiXor Oct 17 '11 at 15:25
  • 6
    Sorry, that's not correct: the first version of the question included the line "sd 0:0:0:0: [sda] Add. Sense: Unrecovered read error - auto reallocate failed" in the logs - the Unrecovered Read Error (URE) is what indicates the drive is failing. If you get unrecovered write errors, that can be lived with for a while (drive remaps the blocks), but UREs are not OK. See http://superuser.com/questions/114675/external-hard-drive-is-no-longer-recognized-gives-buffer-i-o-errors for a similar error. See http://en.wikipedia.org/wiki/S.M.A.R.T.#cite_note-labs.google.com-1 - huge Google analysis. – RichVel Oct 19 '11 at 06:57
  • 1
    One more good link on the URE issue is this answer on another Stack Exchange site: http://unix.stackexchange.com/questions/1869/how-do-i-make-my-disk-unmap-pending-unreadable-sectors/1928#1928 – RichVel Oct 19 '11 at 07:01
  • Although as I have discovered, ntfsfix can't fix some errors which chkdsk on windows can (my particular problem was Record 10 has no FILE magic (0x44414142) – fbence Jan 14 '16 at 10:55
  • @fbence for Record … has no FILE magic I should not expect a fix to the file system. Please consider my answer to linux - How to fix corrupted NTFS - Super User. – Graham Perrin Jul 16 '16 at 13:55
  • According to the man page, ntfsfix is very limited compared to chkdsk. It seems to be intended to force Windows to run chkdsk on next boot. Also note that -b and -d does not fix bad clusters and dirty states. It seems to just clear the list of bad clusters that has been found previously (probably by chkdsk) and to remove the flag that causes Windows to run chkdsk on next boot. – JojOatXGME Apr 17 '18 at 12:33
  • You never want to use the -b option, as it'll clear all prior records of remapped bad blocks. Very bad option. – heynnema Aug 26 '19 at 15:34
  • ntfsfix just says: Unrecoverable error. Volume is corrupt. You should run chkdsk. – rustyx Oct 05 '21 at 14:46
  • 1
    RolandiXor, as someone who has many helpful votes to earn your reputation, I'd still advise you to reconsider your stance. Your advice plays with other people's data. I've recovered corrupted encrypted filesystems (that took 15+ days of slowly reading a damaged hard disk) and frankly have enough recovery experience to suggest that "may be, just may be" you're being too vain in arguing with a much more sane and much more helpful/accurate/appropriate advice by @RichVel. Please be a bigger person and edit your answer and warn people not to ntfsfix when their drive has any type of read errors. – LMSingh May 27 '22 at 16:06
  • 1
    @LMSingh first of all, I do hope you realize that this answer is over 10 years old. Therefore, your approach is unfounded. Secondly, I haven't responded since 2011. Did you consider the possibility that rather than being vain, I was responding to the situation as it was at the time, and since then - haven't even been active on this site? Just asking you to consider your approach next time. – RolandiXor May 28 '22 at 17:08
  • 1
    RolandXor, since you've updated your answer with a clear warning on top, I appreciate your addressing my concern. Since Stax won't let me edit my previous comment, this comment/acknowledgement is in place to show my appreciation for you being a bigger person :-) (I've +1, your comment as well) – LMSingh Jun 01 '22 at 05:25
  • 1
    Outdated and not advised or not, fact is that it still fixed three of all-of-a-sudden so-called corrupted external drives on 23.04. – Jacob Vlijm Jul 06 '23 at 08:56
  • This answer may be old, but still works in 2024. I just saved a NTFS partition on my disk using ntfsfix. Definitely worth the try! – Yoann Pageaud Feb 10 '24 at 17:52
23

I've just fixed my USB drive using "testdisk", a Linux command line (yet friendly) utility. My drive was not even mounting in Windows and Windows 8 discovered like 6 partitions (when the drive had only one).

To use the utility, install it:

sudo apt-get install testdisk

Then run it:

sudo testdisk

and follow the instructions. You must search for partitions and then write the changes.

Hope this help anyone.

Diego Jancic
  • 475
  • 4
  • 9
15

Just to clear some of your points up.

My attempt to run fsck results in the following :

ubuntu@ubuntu:~$ sudo fsck /dev/sda

...

fsck.ext2: Bad magic number in super-block while trying to open /dev/sda

Now, thats not wonder, because you are trying to fsck the disk, and not its partition. What fsck does is, it tries to recognize the FS type. Because you have given it raw disk surface, it fails to recognize and resorts to default type - ext, calling fsck.ext.

fsck.ext does not find any FS signature in the location and tries to find superblocks. Ultimately it fails, because its disk with only NTFS partition type.

This is why you have this error.

The correct command would be:

sudo fsck /dev/sda1

That would feed the FIRST partition of first sata hard drive, not the first sata disk itself.

muru
  • 197,895
  • 55
  • 485
  • 740
Who cares
  • 151
9

In Ubuntu 14.04 Just try this

sudo ntfsfix /dev/sdXY

Where XY is your partition. (/dev/sda2 in your case)

αғsнιη
  • 35,660
user335969
  • 101
  • 1
  • 1
7

I agree with @psusi: the disk needs replacing, see my comment under accepted answer. Doing an ntfsfix will not help at all, and just delays the essential action of:

  1. backing up all data on the disk ASAP
  2. replacing the disk with a new one

There's no need really to check the SMART diagnostics - they only pick up a percentage of errors anyway. The red flags are the two lines:

[ 1019.726558] sd 0:0:0:0: [sda]  Add. Sense: **Unrecovered read error** - auto reallocate failed
[ 1019.726602] JBD: **Failed to read block** at offset 462

As soon as a disk starts giving unrecoverable read errors (UREs), it should be replaced immediately and only used for data recovery. (An excessive level of non-UREs also indicates replacement is needed.)

Disks should be viewed as consumables that must be replaced every few years, hence having really good backups (automated, daily, complete, and at least to an external drive) is crucial.

RichVel
  • 214
  • I have hard disks that have been working without any error since last 12 years!! they should not be viewed as consumables!! they are designed to last for decades!! I agree with backup but considering disks to be consumable is nonsense!! – Gulshan Chaurasia Apr 23 '20 at 07:33
  • moreover, people ask for help after some mistake has occurred and need solution , not the suggestion of what would have prevented it!! – Gulshan Chaurasia Apr 23 '20 at 07:39
  • It's great that you have long-lasting hard drives. My experience is very different, many have lasted only a few years. In any case, both our experiences are anecdotal. Backblaze has been publishing their failure statistics for about 7 years now, and show annual failure rates of 1 to 2% - consistent with both our experiences since I guess we don't have 100K disks as samples. Generally, once a drive shows UREs, the only safe thing to do is to replace it. – RichVel Apr 23 '20 at 11:07
  • 1
    @GulshanChaurasia, hard drives are mechanical devices. They fail. Newer SSD devices have also a finite number of write operations. Power failures occur. Brownouts happen. Just because you have not been hit with murphy's law doesn't mean the whole world doesn't and shouldn't properly address those situations. While your point about what people ask for is valid, at the same time yourself giving opinions not based on a broader experience is going against the spirit of helping. – LMSingh May 27 '22 at 16:15
6

Your disk is toast. Check the SMART diagnostics in the disk utility to confirm; it should say you have a ton of bad sectors and need to replace the drive.

psusi
  • 37,551
  • The only sane advice to this question, IMHO. I found this answer while researching before filing a bug report for an obscure corruption by ntfs-3g. Even though this thread is not relevant, I'm shocked at the callous nature of so many responses and comments and only the few good ones, like (@)psusi, @RichVel and eug. But those have very limited attention. Most people who follow the other suggestions, will end up frying their data even more and chalk it up to their own fault and never know to report back here to say the advice was wrong, when better advise could have given much better outcome. – LMSingh May 27 '22 at 16:26
5

fsck and gparted apps cannot be used to fix a problem with a ntfs partition. ntfsfix should not be used to try and fix this problem.

Windows tools should normally be used. However, chkdsk is not helping here.

You might try using testdisk from the Ubuntu OS.

sudo apt-get update # update the software databases

sudo apt-get install testdisk # install testdisk

sudo testdisk # start testdisk

Go to http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step for help in using this tool.

heynnema
  • 70,711
  • Might want to add that I/O errors usually mean a dying drive or section of drive. Esp. if NTFS is so corrupt you can't fix it with chkdisk or any Windows tools. – Thomas Ward Aug 26 '19 at 15:18
  • @ThomasWard you're absolutely correct... I/O errors usually means more trouble. "@karel" had me add this here as a follow on to a link he placed in another question... so I didn't read all of the details here... and the question already has an accepted answer, with updates. – heynnema Aug 26 '19 at 15:29
2

Unfortunately the free tools available on Linux are very limited with regards to fixing NTFS partitions.

Most likely you can still recover your data by using the secondary MFT stored at the end of the disk. It is usually not used, but it should contain an up-to-date version of your directory structure. There is a good chance it was not affected by the disk errors.

In the past, I have used Runtime Software's (commercial, 79$) product GetDataBack NTFS with great success for this. It is one of the few NTFS tools (the only?) that runs in WINE and as a Linux LiveCD, and the free demo should be enough to see if your data is still there. If it is, your data might just be worth buying the tool.

The LiveCD runs Knoppix Linux and has all their tools preinstalled. Note that you'll still need a license key to actually use the tools, but it should be enough to see if it works on your computer.

Disclaimer: I have no affiliation with Runtime software other than having bought their product a few years ago.

jmiserez
  • 4,964
  • +1 not because I have experience with what's in this answer; the up is for raising awareness of lesser known alternatives to things such as Parted Magic. – Graham Perrin Jul 16 '16 at 14:23
1

As of 15Jul2020, there is no option to check filesystem integrity of a Hard disk formatted as NTFS under Linux.

What I did?

  • I downloaded the free trial of Windows Enterprise as ISO
  • sudo apt-get remove Virtualbox virtualbox-dkms virtualbox*
  • Install the latest Virtualbox from here
  • Download the matched version of Virtualbox extpack
  • Add to disk group, me, as user, due to access deny hard disk error
    • sudo usermod -a -G disk $USER
    • sudo usermod -a -G vboxusers $USER
  • Run sudo /sbin/vboxconfig
  • Run VirtualBox, and add Virtualbox extpack at File -> Preferences -> Extentions
  • Restart your Computer
  • Create a link to your physical Hard Disk which is NTFS (either usb or not) using VBoxManage internalcommands createrawvmdk -filename "</path/to/file>.vmdk" -rawdisk /dev/sdX
  • Create Machine -> New -> Windows 10 (64bit) (whatever match) -> Create a Virtual Disk
  • Attach the Downloaded Windows Enterprise Free trial ISO image
  • At your newly created Virtual Windows Image --> preferences -> Storage -> attach the vmdk image of your ntfs hdd
  • It may fail. Dont worry. To me failed too. I refer to it, because I found it. It may work for you.
  • Go to Virtual Windows Image --> preferences -> USB, check USB 3, add your NTFS HDD
  • Run your Virtual "Windows Enterprize Free Trial" machine.
  • Click Continue, Repair your computer (at left down side), Troubleshooting, Run Command Prompt
  • Go to your disk by writing eg. C:
  • Check that it is your disk somehow eg. dir
  • Run chkdsk /f when you are on your disk

This process fixed my NTFS filesystem that it was fault. I hope it helpt you too.

If you find any easier solution, only under Linux, please post it.

UPDATE: After fixing NTFS, i formatted to Ext4, entire disk. Bye bye NTFS problem. As I read, it does not need defragmation as NTFS.

Estatistics
  • 551
  • 1
    VBoxManage internalcommands createrawvmdk -filename "</path/to/file>.vmdk" -rawdisk /dev/sdX was what I was looking for. Thanks – chubock Mar 27 '22 at 17:59
1

As the other answers have said, in this case it's probably a bad disk..

But for the benefit of others facing actual NTFS corruption - unfortunately the ntfsfix tool is very limited compared to Microsoft's chkdsk. Try to get a Windows install going - preferably with the newest version of Windows as Microsoft is presumably constantly improving chkdsk (I hope..) Newer versions of Windows are often available for free as trials. If the problem is in a USB disk you can try installing Windows in something like VirtualBox and give the VM control of the USB device.

eug
  • 300
0

I just had the same problem on a 3TB NTFS USB. Big drama, as you can imagine.

I first tried to fix it on my wife's Windows box. No joy.

sudo ntfsfix /dev/sdcx extremely quickly fixed it.

Hooray! Back in business. Really must get a new disk and promptly re-format it to a proper, adult filesystem.

Monkeybus
  • 141
  • Thanks for your answer @Monkeybus ! I'm not sure what it adds to the accepted one. Can you please detail which part is specific to yours and is not covered in the other one? – Ciprian Tomoiagă Dec 28 '21 at 10:55
0

This answer will probably just work for 10.04 (lucid) and later versions of Ubuntu!

Try sudo ntfsfix -b /dev/sda2.

  • You need ntfs-3g Install ntfsprogs installed. If you don't have it, you can install it in the Software Center by clicking that link, or from the Terminal (Ctrl+Alt+T) by running these commands:

    sudo apt-get update
sudo apt-get install ntfs-3g
Community
  • 1
DeGe
  • 17
  • 4
    Why use NTFSProgs when NTFS-3g is installed by default? NTFSProgs is dead, as it has been completely merged into NTFS-3g. Switching to the former might cause more problems than it solves. – TSJNachos117 Sep 21 '13 at 20:16
  • 1
    NTFSProgs is no longer part of the package archives after 12.04 precise. – kynan Jan 03 '15 at 16:43