NTFS disk partly readable, seems corrupted systematically [SOLVED]

[stumpie92]

I've got a strange problem with a Windows NTFS filesystem which I can't read after using Clonezilla. I'm trying to sort it from Linux.

[ 0. I was a Unix 6 sysadmin in the 1970s, but switched to Mac and Windows, so my detailed knowledge of Linux is sketchy ]
1. Planning to install Windows 10 on a Dell laptop (Inspiron M5040).
2. For safety, clone current installation (Windows 7, NTFS) to external HDD using Clonezilla, vanilla settings, no error messages
3. Reboot laptop - Windows can't find boot files
4. Run Diagnostics from BIOS - pretty comprehensive, all OK - includes disk and boot path
5. Reboot still failing, so boot up Live Linux Mint (18.3 Sylvia) from a USB stick, all OK. Can see Windows (NTFS) files OK in the file browser, all folders and links, files and their properties. HOWEVER, cannot read any file or create a new one, error "Input/output error". Same for every file except (bizarrely) for some .ini (=text) files.
7. Looked at file systems:

Code: Select all

+++++++++++++++++++++++++++++++++++++++++
mint@mint ~ $ df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            1.8G     0  1.8G   0% /dev
tmpfs           356M   11M  346M   3% /run
/dev/sdb        1.8G  1.8G     0 100% /cdrom
/dev/loop0      1.8G  1.8G     0 100% /rofs
aufs            1.8G   89M  1.7G   5% /
tmpfs           1.8G   26M  1.8G   2% /dev/shm
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           1.8G     0  1.8G   0% /sys/fs/cgroup
tmpfs           1.8G  520K  1.8G   1% /tmp
cgmfs           100K     0  100K   0% /run/cgmanager/fs
tmpfs           356M   52K  356M   1% /run/user/999
/dev/sda2       118G   40G   79G  34% /media/mint/569266FF9266E2CB

int@mint ~ $ sudo fdisk -l
Disk /dev/loop0: 1.8 GiB, 1867780096 bytes, 3648008 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes




Disk /dev/sdb: 14.9 GiB, 16018046976 bytes, 31285248 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x568a6b74

Device     Boot   Start     End Sectors  Size Id Type
/dev/sdb1  *          0 3757279 3757280  1.8G  0 Empty
/dev/sdb2       3744328 3748999    4672  2.3M ef EFI (FAT-12/16/32)

mint@mint ~ $ sudo lsblk
NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sdb      8:16   1  14.9G  0 disk /cdrom
├─sdb2   8:18   1   2.3M  0 part 
└─sdb1   8:17   1   1.8G  0 part 
sr0     11:0    1  1024M  0 rom  
loop0    7:0    0   1.8G  1 loop /rofs
sda      8:0    0   118G  0 disk 
├─sda2   8:2    0 117.9G  0 part /media/mint/569266FF9266E2CB
└─sda1   8:1    0   100M  0 part 
mint@mint ~ $ 

mint@mint ~ $ sudo cfdisk
cfdisk: cannot open /dev/sda: Input/output error
mint@mint ~ $ 

mint@mint ~ $ sudo parted -l
Warning: Error fsyncing/closing /dev/sda1: Input/output error
Retry/Ignore? i                                                           
Error: /dev/sda: unrecognised disk label
Warning: Error fsyncing/closing /dev/sda: Input/output error
Retry/Ignore? ^C                                                          
Model: ATA Intenso SSD Sat (scsi)
Disk /dev/sda: 127GB
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags: 

Warning: The driver descriptor says the physical block size is 2048 bytes, but
Linux says it is 512 bytes.
Ignore/Cancel? c
Model:  USB DISK 2.0 (scsi)
Disk /dev/sdb: 16.0GB
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags: 

mint@mint ~ $ sudo ntfsfix -n /dev/sda
Mounting volume... Error reading bootsector: Input/output error
FAILED
Attempting to correct errors... Error reading bootsector: Input/output error
FAILED
Failed to startup volume: Input/output error
Error reading bootsector: Input/output error
Volume is corrupt. You should run chkdsk.
No change made

+++++++++++++++++++++++++++++++++++++++

Upshot seems to be that /dev/sda is the windows disk, and /dev/sda2 is the windows files (C drive) partition, and that Mint can't read it properly, and that there is some block size confusion. My naive thinking is that somehow this makes Linux unable to calculate the location of file contents correctly, hence the Input/output errors. However, Windows has the same problem and can't load the boot files.

8. I've done a lot of googling but to no avail, so decided to appeal for help! I have checked that it's not a permissions problem, and the Inspiron doesn't have a fakeraid feature.

9. Questions:
* what is actually wrong?
* can I safely repair the Windows disk from Mint, and if so how?
* how did it go wrong? Did Clonezilla alter the disk that is being cloned?

I am not ready to "restore" the Windows HDD from the clone as it may contain the altered data. I can remove the disk, put it in a caddy and work on it from Windows if needed.

Can you help? Beer offered in UK for solution, alternatives available in other jurisdictions

[rene]

Is BitLocker, i.e., Windows' disk encryption, involved? Clonezilla would not have changed anything on the source drive but if you maybe in preparation disabled TPM though the BIOS or some such thinking this would disable encryption as such that could supposedly be the issue; what you in that case have disabled is just automatic unlock.

Nothing otherwise immediately comes to mind. Do note that ntfsfix is run not on a disk but on an NFTS filesystem, i.e, that you would use e.g. ntfsfix /dev/sda2 for any such filesystem on the partition /dev/sda2 rather than /dev/sda but don't even go near that before e.g. fdisk finds all good. The block-size thing is a mere symptom of it reading garbage rather than the structures it expects.

[AndyMH]

Are you trying to boot the cloned drive in the same system with the original drive? I would not expect it to work - two identical drives, same partitions, same UUIDs = a good way to confuse BIOS. win7 so booting in legacy mode?

[stumpie92]

Thanks for your input! Apologies for the delay in responding, real world intervened.

@rene - (1) I don't think any bitlocker was running, since the folder structure is readable, and the odd file, and I didn't see any such code in the Belarc Advisor report I ran before the cloning.
(2) I haven't run ntsfix again
(3) The block size thing was Linux disagreeing with the Mint USB on its block size, but no problems with reading it, so a red herring.

@AndyMH - clonezilla (in the mode I used it) creates a set of compressed files which can be unpacked to create a clone of the original disk. So I haven't yet made a bootable clone.

I took the original disk out and tried it in Windows, but that reports I have two RAW partitions, and chkdsk can't do anything. Also tried TestDisk and EaseUS Data Recovery Wizard (ran for 36 hours!) but to no avail. So this is bizarre, that Mint can see the file structure on the disk, and Windows can't!

My next step is to create a clone from the clonezilla files, on a spare disk, and see whether the that gives me a clone of the disk state before or after the corruption.

Any and all suggestions and support still welcome! Two beers now offered.

[Hoser Rob]

... can I safely repair the Windows disk from Mint, and if so how?...

I'd never try and fix an NTFS format drive from Linux, Mint or whatever. NTFS has some of those undocumented features so beloved by Microsoft, so Linux tools aren't reliable enough.

IOW there is simply no Linux equivalent for chkdsk.

I haven't had any Windows for years but have had problems with NTFS drives before. I just iused a bootable from USB stick Windows rescue program isos. Hiren's Boot CD was what I used, which does get you real chkdsk. There are others.

Smartened up since then, all my ext HDs are now ext4 format.

[stumpie92]

I discovered that the SSD in the Dell was damaged - only partly readable/writeable - and once it was replaced everything went fine.
My apologies for missing this and wasting other users' time. Thanks for your help and patience.
I knew this SSD had been put into the laptop relatively recently, and so didn't even consider that it could be faulty. "Back to basics"!

[rene]

Thanks for noting.