I have a friend who has an external USB portable hard-drive that inexplicably seemed to develop CRC errors when reading files off the NTFS-formatted volume. This rapidly developed into full-blown drive drive shutdowns on major errors and it was evident that something was seriously wrong with it.

To address the CRC issues, the drive had CHKDSK /F run on it within Windows, and this reported a number of issues that were supposedly fixed. Unfortunately it seemed to make things far worse – you plug the drive into a Windows PC now and the drive would take several minutes to appear, and even then the Explorer window was empty! All his files were gone! Panic stations!

Not one to give up so easily, he asked me to have a look at it. First thing I did was plug it into my Ubuntu-based EeePC 701, and while still slow to appear, Nautilus popped up showing most of the files! Some entries appeared to be missing, but we put that down to CHKDSK having removed corrupted entries from the allocation table.

Unfortunately I didn’t have enough space to make an image copy of his drive which would be the preferred method of recovery (it’s a 750GB drive), so we decided to try and hit the files directly.

I tried copying a single directory of files, and they copied successfully, so I spent an evening doing drag and drop between two Nautilus windows (I tried using RSync to do it from the command line, but there are several individual files that come up as corrupt and throw RSync out). Copying one directory at a time seemed to be the best way to keep track of what was recovered and what wasn’t.

This weekend I’ll be trying to go deeper and see if I can recover the “lost” files that CHKDSK managed to hide away from us.

It’s great to see that Linux can do a better job of recovering NTFS than Windows can!

EDIT: Well, the recovery of nearly everything was successful. Unlike Windows, Linux did an admirable job of trying to copy as much of an existing file as possible before aborting at the CRC error in the file. Turns out not too much of the hard-drive was corrupted and my friend only lost half of about 5 individual movies and some of his non-essential work backups. All in all, a good recovery.

As a test, we tried plugging the drive into a Windows PC again to see if it could read any of it, and true to form, Windows Explorer remained blank – oblivious to the files that Linux was so aptly able to read and recover.

Like

Unlike