external hdd disapeared

Dust0741@lemmy.world to Linux@lemmy.ml – 20 points –

I have a hdd attached to my server. It's sda but has 2 partitions so sda1 @16M and sda2 @3.6T It defaulted to being in the location /media/devmon so I kept that and it worked for ages. Suddenly the data is gone. I had files located here: /media/devmon/4tb_drive/kiwix/zim and that directory is now empty. But I put the drive into a Windows box, and everything was there.

When I run mount /dev/sda2 /media/devmon/ it says:

The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
Falling back to read-only mount because the NTFS partition is in an
unsafe state. Please resume and shutdown Windows fully (no hibernation
or fast restarting.)
Could not mount read-write, trying read-only

I originally formatted this drive in Windows, is that the issue? Ideally I'd use btrfs or zfs not ntfs, but here we are.

How do I get access again?

13

I find if I have NTFS problems, throw it back on windows, do a disk repair then come back to Linux.

Also remember to fully shut down (not sleep or hibernate) windows before removing the disk so windows doesn't lock up anything

Edit: the error actually tells you the latter of what I mentioned... So back to windows you go for a shutdown before removal

Did you perform a full shutdown of Windows (Windows doesn't fully release the partition on a normal shutdown)?

@Dust0741 sometimes this can help -> in a linux console: ntfsfix -b -d /dev/sda1 oder ntfsfix -b -d /dev/sda2.

root@skynet:~# ntfsfix -b -d /dev/sda1  
Mounting volume... NTFS signature is missing.  
FAILED  
Attempting to correct errors... NTFS signature is missing.  
FAILED  
Failed to startup volume: Invalid argument  
NTFS signature is missing.  
Trying the alternate boot sector  
Unrecoverable error  
Volume is corrupt. You should run chkdsk.  

root@skynet:~# ntfsfix -b -d /dev/sda2  
Mounting volume... OK  
Processing of $MFT and $MFTMirr completed successfully.  
Checking the alternate boot sector... OK  
NTFS volume version is 3.1.  
Going to un-mark the bad clusters ($BadClus)... No bad clusters...OK  
NTFS partition /dev/sda2 was processed successfully.

turned off windows quick start ran chkdks D: and waited...then shut down and put drive back into linux and reboot. still no

any ideas? clearly not the larger partition, which is good.

I used this when my son's computer wouldn't boot after a Windows update. None of Microsoft's tools would repair the disk.

I attached it to mine and ran ntfsfix on it. Success!

If you really need the data on it, get another disk and make an image of the failed drive asap.

If not, skip that step.

See if testdisk can detect your partitions and read data from them.

I can see the data on windows, but not on linux

It is NTFS after all, support has been flaky over the years. Are you running modern Linux NTFS drivers? If there's no other messages and chkdsk repair (on Windows) doesn't fix it I would assume the filesystem is alright and look at trying different NTFS drivers versions on Linux.

Have you verified that Windows can actually read all of the files? It may show them and not be able to read some of the files if the filesystem is corrupted.

If you can access it on Windows, that's a good thing and all you need is a disk repair there. If you cannot access it even on Windows, you'll need file recovery (and another 4TB disk).

However, note that there is a good chance for NTFS disks to get corrupted on Linux if you unmount them without getting the notification that indicates it's safe to remove the disk.

So I really recommend you to find a temporary disk (or buy a new one) and copy everything to it and format your disk as a Linux file system of your choice and move your files to it, before you get a real headache with NTFS (talking out of experience).

Also note that, it's possible for NTFS disks become inaccessible if fastboot option is enabled for Windows on BIOS, if so disable it.