9mo ago

external hdd disapeared

I have a hdd attached to my server. It's sda but has 2 partitions so sda1 @16M and sda2 @3.6T It defaulted to being in the location /media/devmon so I kept that and it worked for ages. Suddenly the data is gone. I had files located here: /media/devmon/4tb_drive/kiwix/zim and that directory is now empty. But I put the drive into a Windows box, and everything was there.

When I run mount /dev/sda2 /media/devmon/ it says:

    
The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
Falling back to read-only mount because the NTFS partition is in an
unsafe state. Please resume and shutdown Windows fully (no hibernation
or fast restarting.)
Could not mount read-write, trying read-only

I originally formatted this drive in Windows, is that the issue? Ideally I'd use btrfs or zfs not ntfs, but here we are.

How do I get access again?

13 comments

I find if I have NTFS problems, throw it back on windows, do a disk repair then come back to Linux.
Also remember to fully shut down (not sleep or hibernate) windows before removing the disk so windows doesn't lock up anything
Edit: the error actually tells you the latter of what I mentioned... So back to windows you go for a shutdown before removal

@Dust0741 @linux also you should disable fast boot in windows which is similar to hibernate and cause this issue.

Did you perform a full shutdown of Windows (Windows doesn't fully release the partition on a normal shutdown)?
- Yes

@Dust0741 sometimes this can help - in a linux console: ntfsfix -b -d /dev/sda1 oder ntfsfix -b -d /dev/sda2.
- root@skynet:~# ntfsfix -b -d /dev/sda1 Mounting volume... NTFS signature is missing. FAILED Attempting to correct errors... NTFS signature is missing. FAILED Failed to startup volume: Invalid argument NTFS signature is missing. Trying the alternate boot sector Unrecoverable error Volume is corrupt. You should run chkdsk. root@skynet:~# ntfsfix -b -d /dev/sda2 Mounting volume... OK Processing of $MFT and $MFTMirr completed successfully. Checking the alternate boot sector... OK NTFS volume version is 3.1. Going to un-mark the bad clusters ($BadClus)... No bad clusters...OK NTFS partition /dev/sda2 was processed successfully.
  turned off windows quick start ran chkdks D: and waited...then shut down and put drive back into linux and reboot. still no
  any ideas? clearly not the larger partition, which is good.
- I used this when my son's computer wouldn't boot after a Windows update. None of Microsoft's tools would repair the disk.
  I attached it to mine and ran ntfsfix on it. Success!

If you really need the data on it, get another disk and make an image of the failed drive asap.
If not, skip that step.
See if testdisk can detect your partitions and read data from them.
- I can see the data on windows, but not on linux
  
  It is NTFS after all, support has been flaky over the years. Are you running modern Linux NTFS drivers? If there's no other messages and chkdsk repair (on Windows) doesn't fix it I would assume the filesystem is alright and look at trying different NTFS drivers versions on Linux.
  Have you verified that Windows can actually read all of the files? It may show them and not be able to read some of the files if the filesystem is corrupted.

If you can access it on Windows, that's a good thing and all you need is a disk repair there. If you cannot access it even on Windows, you'll need file recovery (and another 4TB disk).
However, note that there is a good chance for NTFS disks to get corrupted on Linux if you unmount them without getting the notification that indicates it's safe to remove the disk.
So I really recommend you to find a temporary disk (or buy a new one) and copy everything to it and format your disk as a Linux file system of your choice and move your files to it, before you get a real headache with NTFS (talking out of experience).
Also note that, it's possible for NTFS disks become inaccessible if fastboot option is enabled for Windows on BIOS, if so disable it.

Read the error and do what it says? Lol
- i mean i did

13 comments