FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Tue May 11, 2021 19:32



Post new topic Reply to topic  [ 5 posts ] 
NTFS indexes get corrupted 
Author Message

Joined: Wed Jun 15, 2016 09:38
Posts: 3
Post NTFS indexes get corrupted
Hello,
I am porting ntfs-3g on Android, using latest version 2016.2.22 ( also tried cynogenmod ntfs-3g ).
Sometimes when recording video, the NTFS flash drive get corrputed and can't be read on Windows ( prompted to format the stick ).
But it still can be read on Android or Linux.
I use chkdsk to see what happened,

C:\Users\James>chkdsk h:
The type of the file system is NTFS.
Volume label is NTFS8K.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
73 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.
0 EA records processed.
The file name in system file record segment 9 contains errors.
0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
71 percent complete. (74 of 83 index entries processed)
Index entry $Quota in index $I30 of file 5 is incorrect.
73 percent complete. (77 of 83 index entries processed)
Index entry $ObjId in index $I30 of file 11 is incorrect.
74 percent complete. (78 of 83 index entries processed)
Index entry $Quota in index $I30 of file 11 is incorrect.
75 percent complete. (79 of 83 index entries processed)
Index entry $Reparse in index $I30 of file 11 is incorrect.
76 percent complete. (80 of 83 index entries processed)
Index entry $RmMetadata in index $I30 of file 11 is incorrect.
83 index entries processed.
Index verification completed.

Errors found. CHKDSK cannot continue in read-only mode.

Is this some kind of bug in ntfs-3g?
Any hints?
Regards!


Wed Jun 15, 2016 10:15
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: NTFS indexes get corrupted
Hi,

Quote:
I am porting ntfs-3g on Android,...

Is this a user space port ?
Quote:
Sometimes when recording video, the NTFS flash drive get corrputed and can't be read on Windows ( prompted to format the stick ).

No such bug reported so far. First thing which comes to mind : was the drive unmounted properly before accessing it from Windows ?
Quote:
Any hints?

If you can read the drive on Linux, you can also make a metadata image and post it so that I can examine it :
Code:
ntfsclone -mst -O - /dev/sdxx | gzip > metadata.gz

(you may have to add the option --ignore-fs-check)

Regards

Jean-Pierre


Wed Jun 15, 2016 17:56
Profile

Joined: Wed Jun 15, 2016 09:38
Posts: 3
Post Re: NTFS indexes get corrupted
Quote:
Is this a user space port ?

Yes
Quote:
First thing which comes to mind : was the drive unmounted properly before accessing it from Windows ?

Whether it unmounted or not, the result is the same and is reproducible.

I tried
sudo ntfsclone -mst -O - /dev/sdc | gzip > metadata.gz
ntfsclone v2013.1.13AR.1 (libntfs-3g)
ERROR: Volume '/dev/sdc' is scheduled for a check or it was shutdown
uncleanly. Please boot Windows or use the --force option to progress.

So finally I dump with --force and --ignore-fs-check, and the file is attached

sudo ntfsclone --force --ignore-fs-check -mst -O - /dev/sdc | gzip > metadata.gz
ntfsclone v2013.1.13AR.1 (libntfs-3g)
NTFS volume version: 1.2
Cluster size : 8192 bytes
Current volume size: 8040996864 bytes (8041 MB)
Current device size: 8041005056 bytes (8042 MB)
Scanning volume ...
100.00 percent completed
Accounting clusters ...
Cluster accounting failed at 388036 (0x5ebc4): missing cluster in $Bitmap
Cluster accounting failed at 388037 (0x5ebc5): missing cluster in $Bitmap
Cluster accounting failed at 388038 (0x5ebc6): missing cluster in $Bitmap
Cluster accounting failed at 388039 (0x5ebc7): missing cluster in $Bitmap
Cluster accounting failed at 388040 (0x5ebc8): missing cluster in $Bitmap
Cluster accounting failed at 388041 (0x5ebc9): missing cluster in $Bitmap
Cluster accounting failed at 388042 (0x5ebca): missing cluster in $Bitmap
Cluster accounting failed at 388043 (0x5ebcb): missing cluster in $Bitmap
Cluster accounting failed at 388044 (0x5ebcc): missing cluster in $Bitmap
Cluster accounting failed at 388045 (0x5ebcd): missing cluster in $Bitmap
Totally 33 cluster accounting mismatches.
WARNING: The NTFS inconsistency was overruled by the --ignore-fs-check option.
Space in use : 1 MB (0.0%)
Scanning volume ...
100.00 percent completed
Accounting clusters ...
Cluster accounting failed at 388036 (0x5ebc4): missing cluster in $Bitmap
Cluster accounting failed at 388037 (0x5ebc5): missing cluster in $Bitmap
Cluster accounting failed at 388038 (0x5ebc6): missing cluster in $Bitmap
Cluster accounting failed at 388039 (0x5ebc7): missing cluster in $Bitmap
Cluster accounting failed at 388040 (0x5ebc8): missing cluster in $Bitmap
Cluster accounting failed at 388041 (0x5ebc9): missing cluster in $Bitmap
Cluster accounting failed at 388042 (0x5ebca): missing cluster in $Bitmap
Cluster accounting failed at 388043 (0x5ebcb): missing cluster in $Bitmap
Cluster accounting failed at 388044 (0x5ebcc): missing cluster in $Bitmap
Cluster accounting failed at 388045 (0x5ebcd): missing cluster in $Bitmap
Totally 33 cluster accounting mismatches.
WARNING: The NTFS inconsistency was overruled by the --ignore-fs-check option.
Num of MFT records = 73
Num of used MFT records = 21
Wiped unused MFT data = 0
Wiped deleted MFT data = 328
Wiped resident user data = 0
Wiped timestamp data = 0
Wiped totally = 328


One thing to note, why the NTFS volume version is 1.2?
I format the stick with Windows 7 for sure.
Regards!


Attachments:
File comment: Corrupted NTFS dump file
metadata.gz [139.23 KiB]
Downloaded 778 times
Thu Jun 16, 2016 10:27
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: NTFS indexes get corrupted
Hi,

Quote:
One thing to note, why the NTFS volume version is 1.2?

This is the main issue. When I run chkdsk, all errors relate to metadata files which were added to NTFS 1.3 and were not present in NTFS 1.2 :
Code:
.....
The file 0x9 has file name $Secure when it should be $Quota.
Correcting file name errors in system file record segment 9.
  0 reparse records processed.
Index entry $ObjId of index $I30 in file 0xb points to unused file 0x19.
Deleting index entry $ObjId in index $I30 of file 11.
Index entry $Quota of index $I30 in file 0xb points to unused file 0x18.
Deleting index entry $Quota in index $I30 of file 11.
Index entry $Reparse of index $I30 in file 0xb points to unused file 0x1a.
Deleting index entry $Reparse in index $I30 of file 11.
Index entry $RmMetadata of index $I30 in file 0xb points to unused file 0x1b.
Deleting index entry $RmMetadata in index $I30 of file 11.
.....

Quote:
I format the stick with Windows 7 for sure.

It has been reported earlier that the Windows format command does not fully format a partition. The full formatting is done when you subsequently mount the partition and unmount it (safely). This is useful you when you do a factory formatting without knowing which Windows variant will use the device.

ntfs-3g tries to keep the compatibility with NTFS 1.2, but Windows had dropped it years ago.

If you run chkdsk with option /F, the files needed by NTFS 1.3 are created, but the boot information still mentions NTFS 1.2 and this will lead to different behaviors in ntfs-3g and Windows. So you have to format the device again. Maybe you also create a file on Windows before mounting on Linux, so that the device gets fully formatted as NTFS 1.3.

If you still get problems, you should partition the device, as most tools expect the devices to be partitioned.

Regards

Jean-Pierre


Thu Jun 16, 2016 16:52
Profile

Joined: Wed Jun 15, 2016 09:38
Posts: 3
Post Re: NTFS indexes get corrupted
Quote:
Maybe you also create a file on Windows before mounting on Linux, so that the device gets fully formatted as NTFS 1.3.

Thank you for your help. The problem is exactly what you explain.
Quote:
ntfs-3g tries to keep the compatibility with NTFS 1.2, but Windows had dropped it years ago.

Is it possible to add an option that force ntfs-3g to use NTFS 1.3?
Asking user to copy a file to complete formating is a little bit ridiculous.
Any flash drive formatted by Windows ( usually the use case ) written later by ntfs-3g will not be readable by Windows.
The worse thing is that Windows can't recognize the stick and prompt you to format it.

Regards


Mon Jun 20, 2016 04:52
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 5 posts ] 


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.