Corrupt NTFS volume...

[Fallen Kell]

I have a 4 1TB disk RAID 5 volume in my server. It is/was partitioned with a 3TB GPT (GUID Partition Table) partition due to its size. Unfortunately it was corrupted somehow. The RAID volume is fine, so it is not an issue with that. The GPT partition table was corrupted, which I was able to recover using the alternate/backup table that exists at the end of the drive. However, windows still does not recognise the NTFS filesystem that was on the volume.

I started using "GetDataBack for NTFS" and it has been able to detect the actual files on the volume (it is still scanning the disk). But knowing that the data is there, is there some method to repair the NTFS filesystem, or am I going to have to use in essence undelete programs to recover individual files one by one?

I didn't think about trying to use Knoppix to see if it was able to properly mount the NTFS filesystem. I know that it is more forgiving to issues in the filesystem metadata and might be able to properly mount the disk so that I can copy the data elsewhere (and possibly keep the original filenames, which is something that most undelete software does not do).

Any suggestions? For an idea of the hardware, it is the "server" in my signature.

 

[corkyg]

The first thing I would do is run CHKDSK on reboot with the /f/r switches.

 

[Fallen Kell]

I can give that a try. However, I was always told running a chkdsk in a non-read-only mode will potentially irreversibly damage the filesystem if it can't figure things out properly, as it will attempt to write data onto the disk, potentially overwriting important real data.

 

[RebateMonger]

Originally posted by: corkyg
The first thing I would do is run CHKDSK on reboot with the /f/r switches.

I'd do a file recovery first. Or recover from backups. Chkdsk can cause files to disappear. And you don't necessarily know which ones disappeared. It tries to "fix" the logical corruption as well as bad sectors (if "/r" is used), but it'll take out anything that it sees as an "error" in the logical structure. This can include data files.

 

[Fallen Kell]

Thanks RebateMonger, that confirms what I was always taught about NTFS and chkdsk. I'm primarily a Unix/Linux guy (I'm a sysadmin for them). But I run a couple Windows systems at home, and this just happens to be the first time I personally had to deal with a corrupt NTFS volume. I was fine for fixing/dealing with the partition table since I have done that probably a hundred times at work (not necessarily on a GPT, but the general concept is the same, but in fact easier with GPT since there is the backup copy that you can compare against to figure out if the primary was corrupt). I'll continue with my file recovery until I make sure I have the important stuff that I don't have on a recent backup.

The main thing that sucks is that I don't have a ton of free disk space, so I will be burning lots of DVDs I guess...