我同时启动 Ubuntu 和 Windows 7,并在两者之间共享一个 3TB GUID NTFS 分区。这很长时间以来都运行良好。
昨天我从一个可疑的(可能有故障的)ext3 分区复制了一个大文件:
sudo cp -rp /media/user/failing_ext3/* /media/user/3TB/tmp/
sudo cp -rp /media/user/3TB/tmp/* /media/user/new_ext4_drive/
这工作得很好,但我现在认为从 ext3 -> NTFS -> ext4 复制是一个愚蠢的想法,导致 chkdsk 运行。我稍后启动 Windows 7,几乎没有注意到 chkdsk 在启动时正在运行。Windows 和 Linux 现在在 3TB 驱动器上看到一个(几乎)空的分区。经过一番研究,我认为 chkdsk 可能破坏了分区和主文件树。在名为 /System Volume Information/Chkdsk 的文件夹中有一个 Chkdsk 日志:
Checking file system on I:
The type of the file system is NTFS.
Volume label is 3TB.
One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
Unable to query LCN from VCN 0x5 for attribute of type 0x80.
The non resident attribute of type 0x80 is inconsistent. The valid data
length is 0x1f380000, file size 0x1f380000, and allocated length 0x4000.
The non resident attribute of type 0x80 is inconsistent. The valid data
length is 0x1f380000, file size 0x4000, and allocated length 0x4000.
CHKDSK is verifying files (stage 1 of 3)...
Deleted corrupt attribute list entry
with type code 48 in file 0.
Unable to find child frs 0x10 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x17 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x11 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x12 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x13 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x14 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x15 with sequence number 0x1.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to find child frs 0x16 with sequence number 0x1.
The attribute of type 0x80 and instance tag 0x1 in file 0x0
has allocated length of 0x1f380000 instead of 0x4000.
Deleted corrupt attribute list entry
with type code 128 in file 0.
Unable to locate attribute with instance tag 0x1 and segment
reference 0x1000000000000. The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 0.
16 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.
0 EA records processed.
Correcting file name errors in system file record segment 0.
0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
An index entry of index $I30 in file 0x5 points to file 0x47aa5
which is beyond the MFT.
Deleting index entry $RECYCLE.BIN in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x23
which is beyond the MFT.
Deleting index entry 1TB in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47aa1
which is beyond the MFT.
Deleting index entry System Volume Information in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47aa1
which is beyond the MFT.
Deleting index entry SYSTEM~1 in index $I30 of file 5.
An index entry of index $I30 in file 0x5 points to file 0x47f78
which is beyond the MFT.
Deleting index entry tmp in index $I30 of file 5.
Index entry $ObjId of index $I30 in file 0xb points to unused file 0x19.
Deleting index entry $ObjId in index $I30 of file 11.
Index entry $Quota of index $I30 in file 0xb points to unused file 0x18.
Deleting index entry $Quota in index $I30 of file 11.
22 index entries processed.
Index entry $Reparse of index $I30 in file 0xb points to unused file 0x1a.
Deleting index entry $Reparse in index $I30 of file 11.
Index entry $RmMetadata of index $I30 in file 0xb points to unused file 0x1b.
Deleting index entry $RmMetadata in index $I30 of file 11.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
Creating object id file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 17.
The object id in file 0x3 does not appear in the object
id index in file 0x11.
Inserting an index entry into index $O of file 17.
Creating reparse point file.
Inserting an index entry into index $I30 of file 11.
Creating index $R for file 18.
Creating quota file.
Inserting an index entry into index $I30 of file 11.
Creating index $O for file 19.
Creating index $Q for file 19.
Inserting default quota record into index $Q in file 19.
CHKDSK is verifying security descriptors (stage 3 of 3)...
24 file SDs/SIDs processed.
Cleaning up 27 unused index entries from index $SII of file 0x9.
Cleaning up 27 unused index entries from index $SDH of file 0x9.
Cleaning up 27 unused security descriptors.
Security descriptor verification completed.
Inserting data attribute into file 0.
4 data files processed.
The MFT mirror is different from the MFT.
Correcting errors in the Master File Table (MFT) mirror.
Correcting errors in the master file table's (MFT) DATA attribute.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
2861458 MB total disk space.
12 KB in 8 indexes.
0 KB in bad sectors.
155403 KB in use by the system.
65536 KB occupied by the log file.
2861307 MB available on disk.
4096 bytes in each allocation unit.
732533503 total allocation units on disk.
732494650 allocation units available on disk.
Internal Info:
10 00 00 00 10 00 00 00 0b 00 00 00 00 00 00 00 ................
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00
这个问题之前已经有人问过,参见:
我在跑TestDisk/PhotoRec并且它正在查找文件,尽管没有文件名或目录;对于 1.2TB 的数据,需要一段时间才能遍历整个驱动器。TestDisk 没有找到任何已删除的 NTFS 分区(糟糕!)。部分数据已备份,但如果能完整地恢复文件树就太好了。是否有一些不错的恢复工具可以从数百万个完整的文件中推断出文件树?我并不抱希望,但也许一些好心人可以建议在这种特殊情况下可能有用的方法。
答案1
我使用“MiniTool Power Data Recovery 6.8”取得了不错的效果。大约 90% 的文件名及其正确的文件夹结构都已恢复。