Ubuntu – How to safely use a virus infected USB drive in Ubuntu

As others have noted, you probably do not need it. However, comodo, kaspersky and few others offer real-time antivirus protection

Ok I gotta clear a couple of things here:

1. The reverse-engineer part about NTFS does not apply here, especially for a formatted NTFS flash drive. Even if it did that would be something really out of the normal. I have worked with many NTFS formatted Flash drives, formatted in Windows XP, Vista, 7 and 8.

   So a problem with the Linux not detecting NTFS correctly is not it. the NTFS-3G proyect is not slow nor incompatible to that level, you can even see that the last update was a couple of months ago this same year. It sure has a couple of issues from time to time like caching support and huge CPU usage, but like I said, for a Flash Drive it would be something very unlikely to happen or would be with a very small chance..

2. I have had similar problems with Flash drives showing either ????? symbols or simply wrong symbols altogether (EG: !@#%$@%#@ instead of the filename). Some users recommend using ntfsfix or ntfck but if you can't fix them with that run chkdsk on Windows on the drive. The Boot record/filesystem for it might be having some issues.

3. The owner of the file/folder does not matter as long as he uses sudo. It could be any user but when he uses the sudo command rm will remove it regardless of who owns it. Again this applies to this NTFS formatted Flash drive.

4. When I first saw the question I was going to ask to run the command as sudo but I read you already did. Then was going to suggest the ntfs repair tools, but you already did. then I saw the Input/output error at the end. That and seeing how the name of the files appeared all messed up simply told me there was an actual filesystem problem which can be corrected only by:

   • Using chkdsk on Windows. Neither ntfsfix nor ntfsck will fix a couple of issues that chkdsk can only fix.

   • At this moment it does not look like a hardware problem, more likely a filesystem problem. If chkdsk does not work, then the only solution is to format the flash drive again (No need for low level). In the case a simple format does not help (and tested in Windows and gparted), then we are looking at a hardware level problem.

If a virus actually had to do anything with this problem, it would be because it affected/attached to the filesystem table (MFT). This would create problems like seeing parts of the filesystem OK and others BAD. Not seeing files on one system and seeing them in another. Seeing all files or some corrupted (eg:!@#!#!LOL!@#!) and other weird stuff that could happen if the file system table is corrupt. It could be as simple as the virus changing one of the fields in the filesystem table or it could be as horrible as the virus changing the size of the MFT or several files.

Virus aside you should know that if the problem is so bad that you can't format the drive (Fresh filesystem) which would be rare to see a virus do that, then it is more probable that you have a flash drive hardware problem caused by heat, impact, etc..

For the corruption of data on the flash drive, or in any storage unit but especially flash drives, the cause in many cases is removing the unit before all information was correctly saved. This can happen in both, Windows and Linux if a user removes the flash drive without making sure that everything has finished writing and the session for the device is closed.

In the case of Linux you will start getting warnings about read/write operations not permitted in the whole flash drive or files (like movies) missing 50% of more of the whole size (Like a 1.2GB movie weighing only 500MB and everything in it corrupted). fsck can fix this in most cases. In the case of Windows it will show input/output errors and can go as far as corrupting the whole unit because the MFT did not save correctly the info. So it is recommend to either wait for the session to close or use a "safely remove" option when available.