NTFS Data Recovery – Unable to Delete Corrupted Files on External Hard Drive

data-recoveryfilesystemsntfs

I copied (cut & paste) some files from my netbook onto my external hard drive. While copying, the complete OS froze and did not react for a considerable amount of time, so I decided to restart. After restart, I have found that not all files were copied properly.

Now, there are corrputed files on the hard disk that cannot be removed with neither rm nor any file manager. The error message is: "File or directory not found". Just re-copying the remaining files will also result in the same error.

  • Operating system: Lubuntu 18.04 LTS
  • External hard disk file system: NTFS

How is it possible to remove those files?

EDIT: I only have Linux tools available (i.e., no chkdsk). I have tried ntfsfix -bd /dev/sdc1 as superuser, but that did not resolve my issue. Now, I'm running testdisk, which takes a considerable amount of time, so I will not know the results before tomorrow.

Best Answer

The fact your OS froze during the write may indicate some hardware is faulty. Telling if the disk is healthy should be your first concern.

The disk is external, it's possible the case is the culprit. It's reasonable to connect the disk directly. You didn't tell us the details but it's probably a SATA disk and you connect the case via USB. If you'd like to connect the disk directly via SATA, be aware of this possible issue: Why is my USB drive showing corrupted data when plugged as an internal SATA drive?

To diagnose the disk:

  1. Check S.M.A.R.T. status (smartctl -a /dev/sdX) and interpret it.
  2. Run S.M.A.R.T. tests (smartctl -t short /dev/sdX, … -t long …); check status again to see the results.
  3. Optionally use badblocks.
  4. Or use (Windows) chkdsk /r. I guess you will need chkdsk anyway, so you may as well start with it.

Depending on how the disk behaves and what the results are, at some point you may want to backup your files from it. When in doubt, do it as early as you can.

  • The disk is still mountable so you can probably save almost all files with plain cp, rsync or another tool that works on file level.
  • Or you can read the whole disk (or at least the partition with the filesystem) with ddrescue.

If the disk is healthy then you may repair the filesystem on the disk. Unfortunately as far as I know there is no tool to fix corrupted NTFS under Linux. You will most likely need chkdsk from Windows.

If the disk is not healthy then you may still try to fix the filesystem there (with chkdsk). Depending on how severe the situation is you may or may not succeed and you may or may not want to use the disk any longer.

If for whatever reason you can't or don't want to use the disk any longer and the best that's left is the image from ddrescue then you should fix the filesystem within the image; again, with chkdsk. In Windows it may be possible to work with an image file; or write the image to another physical device (if not already written to a device by ddrescue in the first place) so chkdsk works without additional tricks.

I think there's little chance you can fix your NTFS filesystem in Linux (i.e. without chkdsk). A workaround is to copy all the files elsewhere and to rebuild the filesystem from scratch on the same device (if the device is healthy).

Related Question