[NTFS] Files disappearing and empty files

[voidvoid]

Hello there,

hopefully someone can help me
with my hard drive I've got some serious problems.
> Since yesterday files are disappearing
> some files are nearly empty now, like 0KB and 1KB
> there are some NTFS errors logged at the system console
> chkdsk is stuck at 72% and fixed over 1 million errors so far
> SMART is okay and the hdd sectors are 100% healthy
> the occupied capacity did not change, it is still 1.8TB of 3TB, but the summarized size of the files on the hard disk doesn't match 1.8TB
> there were made no changes at the partition or the system at all

Hardware: Western Digital WD30EFRX Red (GPT-Partition)
MSI Z87I
Drivers and OS are up to date
OS: Windows 7 Home Premium 64 Bit

There errors everywhere ( I guess it is 20.000 times the same error ):

Thanks in advance!

Dominik

 

[drescherjm]

See if the disk thinks it is operating abnormally with CrystalDiskInfo.

Edit:

> SMART is okay and the hdd sectors are 100% healthy

What did you use to determine this? I do not recommend drive manufacturer tools (WDDIAG, SeaTools ...) . Did you look at the raw SMART values.

 

[voidvoid]

See if the disk thinks it is operating abnormally with CrystalDiskInfo.

Edit:


What did you use to determine this? I do not recommend drive manufacturer tools (WDDIAG, SeaTools ...) . Did you look at the raw SMART values.

HD Tune and Crystal Disk Info - everything looks just fine and the temperature is okay (29°C - This is like 83°F)

 

[dandragonrage]

This is a shot in the dark.

Do you have other drives that you can spare to try and recover this one to? Try something like ddrescue and see if it can recover your files.

Also, as a side-note, SMART is not very good. It's definitely better than nothing at all, but still kinda crap.

 

[omniscence]

This could be a >2.2 TB problem (32bit LBA wraparound).
Although this is unusual for a recent Intel chipset with an up-to-date driver.
You should stop writing to the disk, backup all files or even better, do a block level image to another 3TB drive, and do a full format to this disk.

 

[voidvoid]

just checked everything and now I confirmed the wraparound
Well, I don't know how this happend, but actually it happend ...
So is all the huge stuff lost or can I revert this somehow?

 

[dandragonrage]

If the drive actually did overwrite data that way, you're screwed.

I find this an odd situation and this is the first that I've heard about wraparound. It makes some sense logically, but as far as real-world goes, I'm surprised you were able to install and boot Windows 7 at all in such a buggered-up configuration.

By the way, is this your OS drive? Are you using UEFI boot? GPT?

 

[omniscence]

It's the D: drive, so probably not the OS drive.
This is the usual >2.2 TB HDD error, I just called it wraparound because that is what actually happens with the sector address.

Just to know, how did you confirm it?
Unless you absolutely need something of it I would just write off what you can't simply copy.
Do you have a backup?

I can only recommend to ALWAYS do a full format the first time you use a >2 TB drive on any installation.

 

[drescherjm]

I would have expected the whole drive being unreadable after the wraparound when the first part of the disk was overwritten.

 

[MrCaffeineX]

I would have expected the whole drive being unreadable after the wraparound when the first part of the disk was overwritten.

Doesn't it just start re-writing the file table or have I got it wrong? If the file table is screwed up, but the sectors haven't been rewritten, then a recovery program may get your info back. It can be a very slow process though.

 

[devman]

Doesn't it just start re-writing the file table or have I got it wrong? If the file table is screwed up, but the sectors haven't been rewritten, then a recovery program may get your info back. It can be a very slow process though.

If it truly is LBA wrap-around it is actual data being overwritten. Basically the filesystem asks the the underlying block device to write sector 4295479296 and instead it writes sector 512000. The file system records the file being written at 4295479296. If another file had content at 512000, and you try to read that file you get the corrupted content. Worse is that this can be completely silent until something important gets overwritten like a partition table or an important OS library. It is also possible that 512000 had nothing in it as modern file systems leave gaps between files to reduce fragmentation, but eventually something important for system stability gets overwritten.

 

[omniscence]

Doesn't it just start re-writing the file table or have I got it wrong? If the file table is screwed up, but the sectors haven't been rewritten, then a recovery program may get your info back. It can be a very slow process though.

Since it is NTFS it is a bit more complex as there is a backup of the master file table.
And it is extent based as far as I know, so the metadata is all over the place.
And they just do not fill up linearly like the FAT based filesystems.
You could try to restore some data, but especially if there are big files there is a chance some blocks in the center of those files are overwritten, which could be hard to detect.

 

[MrCaffeineX]

If it truly is LBA wrap-around it is actual data being overwritten. Basically the filesystem asks the the underlying block device to write sector 4295479296 and instead it writes sector 512000. The file system records the file being written at 4295479296. If another file had content at 512000, and you try to read that file you get the corrupted content. Worse is that this can be completely silent until something important gets overwritten like a partition table or an important OS library. It is also possible that 512000 had nothing in it as modern file systems leave gaps between files to reduce fragmentation, but eventually something important for system stability gets overwritten.

Since it is NTFS it is a bit more complex as there is a backup of the master file table.
And it is extent based as far as I know, so the metadata is all over the place.
And they just do not fill up linearly like the FAT based filesystems.
You could try to restore some data, but especially if there are big files there is a chance some blocks in the center of those files are overwritten, which could be hard to detect.

Cool. Well, not for people that this happens to, but for the explanation. I didn't realize it was rewriting the data sectors, I thought it had more to do with the limitation of addressing said sectors in the file table(s). There's always more to learn as they say.

It is like the information got placed in the wrong filing cabinet and then someone torched the right one. That sucks.

I haven't run into this yet because I haven't moved beyond 2TB on a single drive, but it is good to know for when that day comes about.

 

[voidvoid]

yea it is a bad situation, I know - it started while I was reconfiguring and working at my pc system - well took out the hard drive and temporary into an external drive bay - now I know this was the bad mistake. The controller of the external drive bay works with the 32Bit system and the intel controller with the new system. See there: http://en.wikipedia.org/wiki/Master_boot_record#Partition_table_entries

Well, I could see nearly all files and I could access the files I needed, so the first situation I noticed the failure was while I started Steam and Windows said that some files are corrupt. But I ignored it first, now I know that was actually really bad ... Well, I had some pictures on it and I could recover nearly all of them (while it was inside the external drive bay), but yea most of the large files are lost, I know - well next I will try recovering some more data and I'll post updates here for anyone else that may encounter the same problems.