Mdthbs

TL;DR:

1TB NTFS secondary drive. Using GParted, resized main partition to be ~800GB. Created and wrote to new partition in the newly-unallocated space. Deleted new partition, attempted to resize new partition back to new size. GParted says:

Outside of the volume reference for inode 1248344 at 226331322:4014

Outside of the volume reference for inode 1248344 at 226352067:3749

.

.

.

Outside of the volume reference for inode 1248344 at 226380468:1506

100.00 percent completed

ERROR: Filesystem check failed!

ERROR: 236884 clusters are referenced outside of the volume.

NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!

The usage of the /f parameter is very IMPORTANT! No modification was

and will be made to NTFS by this software until it gets repaired.

What do?

Not sure how much background information is relevant, so I'll start from the beginning.

Several years ago, I had a 1TB hdd with windows 10 on it. I later obtained a 240GB SSD, stuck windows on the first ~140GB of it, linux on the last ~100GB, and used the hdd as a secondary drive. Last spring, windows broke (I forget exactly how, but it didn't boot). I switched over to linux as my primary OS, and that was fine. I could still access all of the files on both the hdd and the windows partition.

Later, I finally ran out of room on the 100GB partition, so I "backed up" the windows partition with dd if=/dev/sdb1 of=/media/hdd/backuup/win10ssd.image (don't quote me on the exact names, but I'm 99% sure I used dd if=win10_partition of=path_on_hdd). Recently, I finally needed to access something that was on the windows partition, so I decided to get around to sticking that image onto a new partition. I had ~300 GB free on my hdd, so I had enough room to do it there.

Situation at this point: 1TB hdd has a 999GB NTFS partition on it (sde1). 136GiB image is stored on that as a regular file.

Here is the approximate sequence of events from that point onward:

• In GParted, I shrunk sde1 by ~150GiB.


• GParted needed to move data on sde1, I assume since it didn't have 150 contiguous GiB free at the end. It didn't give any major warnings, so I assumed that this was a relatively save operation (as much as messing around with raw drive data can be safe). This took a few hours.


• In GParted, I created a new partition (sde3) at the end of the unallocated space, and sized it to what I thought was the correct number of MiB.


• 
  sudo dd if=win10backup.image of=/dev/sde3. I realize now that this may have been doomed to fail regardless, due to differences in the original partition and the new partition (still don't really know much about this, idk what differences there would be, but it seems that it probably wouldn't have been that simple).


• Turns out that this failed after copying most of the image because I made sde3 slightly too small. Probably made a dumb miscalculation with MiB vs MB or something like that.


• I wanted to resize sde3 to exactly the right size. With fdisk -l I can see the exact byte count of the image, it's not an integer number of MiB, and GParted doesn't appear to work with increments smaller than MiB.


• I closed GParted, and opened Ubuntu's Disks utility. This let me create a partition that was the right size, but I couldn't create it at the end of the unallocated space, only the beginning.


• 
  

  I think I created the partition, ran dd again to put the image on that partition, and then attempted to mount it. Unfortunately, the terminal that had all the output from most of this disappeared overnight. The only output that I still have is

  
  
  

  redacted@redacted:~$ sudo mount -o ro /dev/sde3 /mnt
  
  [sudo] password for redacted: 
  
  Failed to read last sector (285778390): Invalid argument
  
  HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
  
     or it was not setup correctly (e.g. by not using mdadm --build ...),
  
     or a wrong device is tried to be mounted,
  
     or the partition table is corrupt (partition is smaller than NTFS),
  
     or the NTFS boot sector is corrupt (NTFS size is not valid).
  
  Failed to mount '/dev/sde3': Invalid argument
  
  The device '/dev/sde3' doesn't seem to have a valid NTFS.
  
  Maybe the wrong device is used? Or the whole disk instead of a
  
  partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
  
  

  
  



• At this point, I read about loop devices. It seemed far simpler than messing around with partitions and whatnot, so I tried mounting the image directly with sudo mount -t ntfs win10backup.image /mnt. This worked like a charm, and it looked like I could access all my files.



• After seeing that work, I now planned to just temporarily mount the image whenever I needed to copy over a document from it to my main linux SSD. Not needing any new partitions anymore, I tried to resize sde1 to take up the currently-unallocated ~150GB again.


• 
  

  While GParted was running ntfsresize -i -f -v '/dev/sde1', it spit out a bunch of errors, mostly saying "Outside of volume reference for inode 1248344 at #########:####". After several dozen of those lines, it said

  
  
  

  
  

  ERROR: Filesystem check failed!
  
  ERROR: 236884 clusters are referenced outside of the volume.
  
  NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
  
  The usage of the /f parameter is very IMPORTANT! No modification was
  
  and will be made to NTFS by this software until it gets repaired.

  
  

  
  
  

  This was the first indication I had seen so far that anything was wrong.

  
  

At this point, I realized that I may be in over my head. I have not touched a single drive-related thing (mounting, unmounting, gparted, etc.) since then.

My current main goal is to make sure that as many as possible of my useful files on the hdd and the image stored on the hdd are safe. None of them are of critical importance, but many cannot be replaced. I consider getting everything back to a normal state a stretch goal.

Current situation: 1TB hdd with very old installation of win10 on ~800MB partition, may be corrupted to some extent. Image of newer win10 partition stored in that partition. ~150GB unallocated space after that partition. 240GB SSD with Ubuntu on it, this drive is 100% fine as far as I know.

Ideal situation: All files that were stored on the hdd are freely accessible, and all free space on that drive can be used.

Less-than-ideal-but-still-okay situation: Important files on 1TB drive are accessible in some way, even if only to copy to another stable drive. The important files take up probably only a few of the ~500GB of files on there, so it's unlikely that more than a few of them are completely irrecoverable at this point.

Current things I'm considering doing:

1. Buy a new hard drive, see if I can access the files on the old hard drive, and if so, copy the important ones to the new hard drive.
   
   
   
   
   • Pros: should be likely to succeed, shouldn't have even a chance of making the current situation worse.
   
   
   • Cons: need to buy a new drive, and wait for it to arrive.
   
   
   
   


2. Attempt to boot up the windows 10 installation on sde1, and then probably run chkdsk /f as GParted recommends.
   
   
   
   
   • Pros: may work? It's what GParted says to do.
   
   
   • Cons: may not work at all, may screw stuff up even more.
   
   
   
   


3. Stop touching stuff, continue as if nothing happened, hope nothing important was corrupted.
   
   
   
   
   • Pros: easy to do, shouldn't make the current situation worse.
   
   
   • Cons: doesn't fix anything, leaves 150GB unallocated and unusable.
   
   
   
   


4. Continue screwing around with dd, gparted, etc. in the hopes that I manage to fix stuff somehow.
   
   
   
   
   • Pros: fun, I'll learn things.
   
   
   • Cons: relatively likely to break stuff even more, or at least prevent me from ever recovering stuff that may be recoverable right now.
   
   
   
   

How should I proceed? At this point, what is safe to do and what may not be safe? Is there any way to tell what inode 1248344 is, and is that the only thing that might be irrecoverable?

Ubuntu 18.04.

Here's the full GParted log from my attempt to resize sde1:

GParted 0.30.0 --enable-libparted-dmraid --enable-online-resize



Libparted 3.2



Delete /dev/sde3 (ntfs, 136.27 GiB) from /dev/sde  00:00:01    ( SUCCESS )

  calibrate /dev/sde3  00:00:01    ( SUCCESS )

    path: /dev/sde3 (partition)

    start: 1605038080

    end: 1890818047

    size: 285779968 (136.27 GiB)

  delete partition  00:00:00    ( SUCCESS )



========================================



Grow /dev/sde1 from 765.34 GiB to 931.07 GiB  00:00:34    ( ERROR )

  calibrate /dev/sde1  00:00:00    ( SUCCESS )

    path: /dev/sde1 (partition)

    start: 63

    end: 1605038079

    size: 1605038017 (765.34 GiB)



  check file system on /dev/sde1 for errors and (if possible) fix them  00:00:34    ( ERROR )

    ntfsresize -i -f -v '/dev/sde1'  00:00:34    ( ERROR )

      ntfsresize v2017.3.23 (libntfs-3g)

      Device name : /dev/sde1

      NTFS volume version: 3.1

      Cluster size : 4096 bytes

      Current volume size: 821779464704 bytes (821780 MB)

      Current device size: 821779464704 bytes (821780 MB)

      Checking for bad sectors ...

      Checking filesystem consistency ...

      Outside of the volume reference for inode 1248344 at 217445823:4033

      Outside of the volume reference for inode 1248344 at 217455407:2641

      Outside of the volume reference for inode 1248344 at 217470379:702

      Outside of the volume reference for inode 1248344 at 217495177:842

      Outside of the volume reference for inode 1248344 at 217511561:2185

      Outside of the volume reference for inode 1248344 at 217536006:11

      Outside of the volume reference for inode 1248344 at 217568711:167

      Outside of the volume reference for inode 1248344 at 217597453:208

      Outside of the volume reference for inode 1248344 at 217630118:156

      Outside of the volume reference for inode 1248344 at 217654724:4028

      Outside of the volume reference for inode 1248344 at 217675211:4021

      Outside of the volume reference for inode 1248344 at 217679346:3982

      Outside of the volume reference for inode 1248344 at 217695707:223

      Outside of the volume reference for inode 1248344 at 217724338:335

      Outside of the volume reference for inode 1248344 at 217740744:865

      Outside of the volume reference for inode 1248344 at 225333850:4022

      Outside of the volume reference for inode 1248344 at 225342046:4018

      Outside of the volume reference for inode 1248344 at 225354383:3969

      Outside of the volume reference for inode 1248344 at 225358503:3945

      Outside of the volume reference for inode 1248344 at 225374941:3891

      Outside of the volume reference for inode 1248344 at 225395366:3946

      Outside of the volume reference for inode 1248344 at 225407666:3934

      Outside of the volume reference for inode 1248344 at 225432169:4007

      Outside of the volume reference for inode 1248344 at 225464904:4040

      Outside of the volume reference for inode 1248344 at 225469000:4040

      Outside of the volume reference for inode 1248344 at 225501762:4046

      Outside of the volume reference for inode 1248344 at 225505858:4046

      Outside of the volume reference for inode 1248344 at 225534530:4046

      Outside of the volume reference for inode 1248344 at 225542715:4053

      Outside of the volume reference for inode 1248344 at 225555012:4044

      Outside of the volume reference for inode 1248344 at 225579592:4040

      Outside of the volume reference for inode 1248344 at 225608260:4044

      Outside of the volume reference for inode 1248344 at 225616457:4039

      Outside of the volume reference for inode 1248344 at 225636958:4018

      Outside of the volume reference for inode 1248344 at 225669721:4023

      Outside of the volume reference for inode 1248344 at 225702472:4040

      Outside of the volume reference for inode 1248344 at 225710843:3861

      Outside of the volume reference for inode 1248344 at 225723433:3559

      Outside of the volume reference for inode 1248344 at 225751680:3984

      Outside of the volume reference for inode 1248344 at 225776218:4022

      Outside of the volume reference for inode 1248344 at 225800795:4021

      Outside of the volume reference for inode 1248344 at 225808992:4016

      Outside of the volume reference for inode 1248344 at 225813090:4014

      Outside of the volume reference for inode 1248344 at 225821341:3955

      Outside of the volume reference for inode 1248344 at 225854689:3375

      Outside of the volume reference for inode 1248344 at 225882712:4024

      Outside of the volume reference for inode 1248344 at 225915651:3853

      Outside of the volume reference for inode 1248344 at 225948247:4025

      Outside of the volume reference for inode 1248344 at 225956444:4020

      Outside of the volume reference for inode 1248344 at 225976946:3998

      Outside of the volume reference for inode 1248344 at 225993333:3995

      Outside of the volume reference for inode 1248344 at 226021994:4006

      Outside of the volume reference for inode 1248344 at 226030186:4006

      Outside of the volume reference for inode 1248344 at 226060971:4029

      Outside of the volume reference for inode 1248344 at 226089666:4006

      Outside of the volume reference for inode 1248344 at 226106041:4015

      Outside of the volume reference for inode 1248344 at 226134703:4025

      Outside of the volume reference for inode 1248344 at 226167491:4005

      Outside of the volume reference for inode 1248344 at 226175685:4003

      Outside of the volume reference for inode 1248344 at 226204338:4022

      Outside of the volume reference for inode 1248344 at 226212528:4024

      Outside of the volume reference for inode 1248344 at 226224829:4011

      Outside of the volume reference for inode 1248344 at 226257583:4025

      Outside of the volume reference for inode 1248344 at 226261687:4017

      Outside of the volume reference for inode 1248344 at 226278072:4016

      Outside of the volume reference for inode 1248344 at 226306727:4033

      Outside of the volume reference for inode 1248344 at 226331322:4014

      Outside of the volume reference for inode 1248344 at 226352067:3749

      Outside of the volume reference for inode 1248344 at 226380468:1506

      100.00 percent completed

      ERROR: Filesystem check failed!

      ERROR: 236884 clusters are referenced outside of the volume.

      NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!

      The usage of the /f parameter is very IMPORTANT! No modification was

      and will be made to NTFS by this software until it gets repaired.



========================================

I wish I had more logs and stuff, but all the terminals with the output of commands I ran have for some reason disappeared since last night.