Recovering data from broken (NTFS) partition

data-recoveryhard-diskntfstestdisk

I'm trying to recover data from a Windows (NTFS) disk that became unreadable for some reason. I'm doing this from within a Linux Mint environment.

I can see the partitions normally, and I also see the correct free space of the disk. However, mounting it gives problems:

> sudo ntfs-3g -o force,rw /dev/sdc1 /media/windows2
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x43425355  size: 4096   usa_ofs: 33488  usa_count: 34671: Invalid argument
Actual VCN (0x8000020b5080000) of index buffer is different from expected VCN (0x0).

> ls /media/windows2 
ls: cannot access /media/windows2: Input/output error

I already tried running testdisk:

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
     Partition               Start        End    Size in sectors
>* HPFS - NTFS              0  32 33    25 126 37     407552
 P HPFS - NTFS             25 126 38 60797  59 62  976297984

If I choose list files, I see a couple of files/directories but far from all. If I go to undelete, I see some files, mainly temporary internet files, which likely indeed were removed. I don't seem to have a way to see the remaining actual files.

I already tried to rebuild the boot sector and check the MFT in checkdisk, but this didn't help.

I also tried running ntfsfix:

> sudo ntfsfix /dev/sdc1
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sdc1 was processed successfully.

There seems to be nothing physically wrong with the disk:

> sudo badblocks /dev/sdc -sv
Checking blocks 0 to 488386582
Checking for bad blocks (read-only test): 
done                                                 
Pass completed, 0 bad blocks found. (0/0/0 errors)

Is there anything else I could try to get access to the files?

Best Answer

In the end, I gave up solving the problem from Linux, and tried it from Windows. That turned out to be a good idea: running chkdsk solved the problem.

Related Question