NTFS drive corrupt

Question

I have a 2TB external WD drive that I use for backup and movies/music such and so forth since back when I had windows running on my laptop. To be on the safe side, I unmounted the drive and ran a short test using smartctl which gave a result of completed: read error at 90%

$ sudo smartctl -l selftest /dev/sdc
smartctl 6.5 2016-01-24 r4214 [x86_64-linux-4.4.0-36-generic] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org


=== START OF READ SMART DATA SECTION ===
SMART Self-test log structure revision number 1
Num  Test_Description  Status        Remaining LifeTime(hours) LBA_of_first_error
 1  Short offline   Completed: read failure    90%      4876         9938552
 2  Short offline   Completed: read failure    90%      4876         9938552

Trying to fix the issue, I ran ntfsfix

$ sudo ntfsfix /dev/sdc
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
The alternate bootsector is usable
Set sector count to 3906963455 instead of 3906961407
Rewriting the bootsector
The boot sector has been rewritten
ntfs_mst_post_read_fixup_warn: magic: 0xffffffff  size: 1024   usa_ofs: 65535  usa_count: 65534: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
Volume is corrupt. You should run chkdsk.

Now the drive is no longer mountable on Disks utility.

dmseg | tail returned the following result:

[ 1697.980340] scsi 7:0:0:1: Enclosure         WD       SES Device       1019 PQ: 0 ANSI: 6
[ 1697.982222] sd 7:0:0:0: Attached scsi generic sg3 type 0
[ 1697.982287] sd 7:0:0:0: [sdc] 3906963456 512-byte logical blocks: (2.00 TB/1.82 TiB)
[ 1697.982518] ses 7:0:0:1: Attached Enclosure device
[ 1697.982673] sd 7:0:0:0: [sdc] Write Protect is off
[ 1697.982684] sd 7:0:0:0: [sdc] Mode Sense: 47 00 10 08
[ 1697.982686] ses 7:0:0:1: Attached scsi generic sg4 type 13
[ 1697.983481] sd 7:0:0:0: [sdc] No Caching mode page found
[ 1697.983490] sd 7:0:0:0: [sdc] Assuming drive cache: write through
[ 1711.399946] sd 7:0:0:0: [sdc] Attached SCSI disk

I thought about mounting the drive directly from the terminal, but I really cant afford to loose the data on this drive and didn't want to make another mistake. What can I do to fix the issue? please keep in mind I am very new to linux. Thanks

Solution

I've fixed the issue and gotten the drive to mount.

Posting how I fixed it in case someone else has a similar issue.

I installed testdisk and ran it

sudo apt-get install testdisk sudo testdisk

and basically followed the instructions choosing first to analyze which showed me the problem and applied the fix. Reboot system and the external harddisk is running fine. Data intact.

Comments

[jawtheshark]

This drive is dying... There is no question. You can always mount read-only from terminal. That should never damage the filesystem, but honestly, I don't give it much chance. You might already have lost your files. Mainly because you used /dev/sdc for ntfsfix. That is almost certainly wrong (and you might have destroyed your disk in the process). /dev/sdc represents the whole disk. /dev/sdc1 represents the first partition. In most cases partitions have filesystems. Not disks.

[Karan K]

@jawtheshark the entire drive is formatted to one partition only since its meant to just store files. I'll get a replacement harddisk in a couple of days, but anything I can do to get it back to normal now?

[jawtheshark]

Yes, but a partition is not a drive. /dev/sdc is not equal to /dev/sdc1... Even if /dev/sdc1 comprises the whole disk. /dev/sdc would contain the partition table plus all data in the partition. /dev/sdc1 is only the filesystem.

[jawtheshark]

You could try to recreate the partition table, if you know or can guess what it was.

[Karan K]

@jawtheshark I see where I went wrong. Anyway, though I clearly know that the entire disk was on one partition, fdisk -l gave me the result saying it has 4 partitions . two labeled as unknown and one labeled as Novel Netware 386 and the fourth partition as empty. The last partition is also the same size as the free space I had on the disk .

[jawtheshark]

Yes, sounds like ntfsfix wrote garbage there (Duh!). Try deleting them, and recreate 1 partition with type HPFS/NTFS.

[davegallant]

Running testdisk will likely help recover the lost partitions. After the partitions are recovered, run chkdsk /f on the drive. youtube.com/watch?v=EncqYP1ijFg

[Ahmad Ismail]

Dear brother, following your unspecific instructions, I just lost 4TB data.

[Monkeybus]

This works. Thanks. You taught me something. Though I now have to mount via command line, Nautilus still refuses to mount it. Regardless, testdisk allowed me to actually view the files and copy them out if needs be. Very good, thanks again.

[Saddam Meshaal]

could you please state the followed instructions. Please, Please Please.