Gizmo's Freeware Forum

Gizmo's Freeware Forum (https://www.techsupportalert.com/freeware-forum/)
-   General Computer Support (https://www.techsupportalert.com/freeware-forum/general-computer-support/)
-   -   Corrupted drive (https://www.techsupportalert.com/freeware-forum/general-computer-support/15001-corrupted-drive.html)

sicknero 01. Mar 2015 01:05 PM

Corrupted drive
 
I have a Freecom (Samsung) 400Gb external USB drive, and at some point it has become corrupted in some way so that a lot of filenames no longer match the file content.

Basically I'll play a music track and find that it is not what the filename says it should be.

I'm guessing (wildly) that this might have happened while I was experimenting with different defraggers quite a long time ago, but I don't really know. Maybe something to do with the partition table but I'm outside of my technical knowledge there.

Does anybody know if it might be possible to fix this in any way other than the long way ... i.e. checking each file in turn and replacing/renaming those that are misnamed?

Remah 01. Mar 2015 07:58 PM

I can't get my explanation and links past the censor so this is really short. :mad: If I'm not in advanced view then I also lose what I've typed. :mad:

If FAT then AFAIK no chance but NTFS has a log file which can get quite large so the changes may still be in there.

Search for NTFS log file utility:
tracker looks better
p a r s e r (censor :mad:) not so good

sicknero 02. Mar 2015 12:16 AM

Hi Remah thanks very much for the suggestion ... I've found Tracker but it looks like a bit of a learning curve for me, so I'll give it a proper look tomorrow and see if I can work it out.

My initial hurdle is finding the actual log file ... I've found a file on the relevant drive called tracking.log (inside System Volume Information) but nothing like $LogFile. Trying to open tracking.log in Tracker returns a "There is no data" message.

It's possibly three years or more since this corruption happened and there have been many many changes to my drive since then so this might be a dead end for me, but I appreciate your input ... this is something new to me and it's always good to learn.

I'll have a proper look at it when I have more time and will post back. Thanks.

Remah 02. Mar 2015 01:07 AM

Quote:

Originally Posted by sicknero (Post 108521)
...
It's possibly three years or more since this corruption happened and there have been many many changes to my drive since then so this might be a dead end for me, ...

Yes, I'd be surprised if you can get anything back.

You probably already know this but, for anyone else reading this thread, it is good practice when when testing utilities to take a drive image and restore it when you're finished.

sicknero 03. Mar 2015 09:07 PM

Quote:

Yes, I'd be surprised if you can get anything back.
I'll be surprised too : )

It wasn't so much getting stuff back that I wanted, as some relatively easy way of finding out which files have lost their correct filenames/directory paths. I've been sorting through my mp3 collection and it seems that the problem isn't very widespread, but it will take me ages to find out which ones are corrupted, even using an audio intro scanner.

Quote:

You probably already know this but, for anyone else reading this thread, it is good practice when when testing utilities to take a drive image and restore it when you're finished.
I do have multiple back ups of important and/or unreplaceable files, but I lacked the space at the time to duplicate such a large drive. A useless excuse, I know ... I will do it now though, once I've finished sorting out the mess.

It's curious that although I had assumed it to be an artefact of some defragger or other, when I googled the problem I came across a Mac user suffering an identical issue by the sound of it. It seems that their problem arose through using a diskspace analyser, something which I'd never have previously been wary of. Although it seems that their issue came about through analysing an NTFS volume on a Mac, it's still a bit of an eye-opener. Maybe something for Mac/Linux users to be aware of although I don't think the exact software was mentioned in their post.

What has been a lesson here is the potential value of log files ... I've never had a use for them before and I suspect that many have been wiped by various temp cleaners over the years. I will persevere with the NTFS log tracker that I downloaded, as it interests me now to learn exactly what log files are all about.

Thanks again for your input.

Remah 04. Mar 2015 01:51 AM

Quote:

Originally Posted by sicknero (Post 108576)
It's curious that although I had assumed it to be an artefact of some defragger or other, when I googled the problem I came across a Mac user suffering an identical issue by the sound of it. It seems that their problem arose through using a diskspace analyser, something which I'd never have previously been wary of. Although it seems that their issue came about through analysing an NTFS volume on a Mac, it's still a bit of an eye-opener. Maybe something for Mac/Linux users to be aware of although I don't think the exact software was mentioned in their post.

It's not likely to be the same problem that you have. Mac issues with NTFS are usually due to the lack of official Apple support. At one point reading an NTFS volume was fraught with issues. Although I understand reading is OK, as far as I know, writing to NTFS volumes is still not officially supported.

Burn-IT 04. Mar 2015 03:03 PM

Have a look at TESTDISK!
I think that will rebuild file tables for you from the contents of the disk.

Remah 04. Mar 2015 11:07 PM

Quote:

Originally Posted by Burn-IT (Post 108609)
Have a look at TESTDISK!
I think that will rebuild file tables for you from the contents of the disk.

TestDisk might work but the disk and file recovery methods it uses, such as synchonizing FAT/MFT and unerasing files, aren't much help where a file has been renamed. The key information that is needed is the original filename and that was almost certainly discarded when the files were "renamed". That's why on NTFS you would have to look at the logfile which contains records that document what was changed. If too many changes have been made then the relevant log entries will have been discarded.

The other technique TestDisk could use is to unerase files.This could work if the current files were created by copying and deleting the original file then the deleted filenames might exist if the original directory entries have not been reused and overwritten.

Remah 04. Mar 2015 11:18 PM

Quote:

Originally Posted by sicknero (Post 108511)
I have a Freecom (Samsung) 400Gb external USB drive, and at some point it has become corrupted in some way so that a lot of filenames no longer match the file content.

Basically I'll play a music track and find that it is not what the filename says it should be.

sicknero,
I've thought about this further and there is a slight possibility that you might be able to identify some of the problem files by looking at the current filenames.

I assumed that the original file entries were incorrectly linked so all the original file names still existed but linked to the wrong file contents. If that is not the case then what if the changed names were duplicates of correct filenames in other folders? The presence of duplicated filenames would indicate files that need to be checked. You wouldn't have the correct original name but you would be able to identify files to check.

I also assumed that all the filenames were the names of recognizable music track. That is normal. But what if there are filenames that have been converted so they aren't. Have you checked all the filenames in all your music folders to see that they are all as expected?

J_L 05. Mar 2015 05:48 AM

In forensics, the number 1 essential step is to image the drive and work on that instead of modifying the drive itself. That means you'll have a backup and a workspace that won't corrupt any further.

sicknero 05. Mar 2015 11:25 AM

Thanks for the comments everyone :)

Ok .. the exact nature of the problem;

The hdd in question used to contain two folders ... one full of music and the other of audio books.

What happens is that when I play some of the music files, I find that I'm listening to a chapter from an audio book. According to the filename and location I should be hearing a song, but it seems that the actual content of the file has been replaced.

For example, I play "H:\AUDIO\Music\Belly - Discography\Star\01 Someone to Die for.mp3" but what I hear is a chapter from an audio book instead.

The audio book directory I moved to another drive quite some time ago, so the drive in question now contains only music. Or should, at least. As Remah says, at some point the file entries became incorrectly linked.

Quote:

The presence of duplicated filenames would indicate files that need to be checked.
This is a good suggestion, because a second issue has come to light ... some files have become duplicated without the filenames or paths changing. For example I play tracks 1 and 2 from an album but find that track 2 is actually a duplicate of track 1, although according to the filename it should be track 2.

However, as it is the file content and not the name which I need to check, it will mean running a duplicate finder set to search content but not names ... given the size of the drive and that it is close to being full, this will take hours so I'll leave it to run overnight. It will still be a time saver though compared to checking each song by ear.

Quote:

I also assumed that all the filenames were the names of recognizable music track. That is normal. But what if there are filenames that have been converted so they aren't. Have you checked all the filenames in all your music folders to see that they are all as expected?
Yes ... the filenames and apparent directory structure is are all exactly as they should be.

Quote:

In forensics, the number 1 essential step is to image the drive and work on that instead of modifying the drive itself. That means you'll have a backup and a workspace that won't corrupt any further.
What I'm doing now is checking each folder in turn using a media player set to intro scan ... if the folder is ok then I'm copying it across to a new drive, so gradually building up a new directory of uncorrupted files. It's taking some time as given the size of the collection, there are inevitably albums with which I am not sufficiently familiar so as to instantly know if a song is misnamed .....

I am pretty much resigned to the fact that there's no easier way to do it really, especially given the amount of time that has passed and the amount of changes that have been made to the drive since the corruption first happened. For example I don't think there's much hope of recovering deleted files as there has been so much over-writing in the meantime.

sicknero 05. Mar 2015 11:45 AM

... afterthought ...

Given that on the whole audio book chapters are substantially larger files compared to songs, then sorting files by size might be one easier route to finding out which files have been misnamed.

Remah 05. Mar 2015 01:51 PM

Now that many users have large quantities of data, the need for comprehensive data protection becomes more important. I regularly hear of users finding errors in their many TB of photos, music, videos, etc. They usually only find the problems when they get an error transferring the files to a new (and usually larger) drive.

For several years, my preference has been to use ZFS to ensure data integrity. ZFS is available free with FreeBSD and free products based on it, e.g. FreeNAS. Regular "scrubbing" (checking files and data) even picks up and repairs silent errors which become more common with larger volumes of data.

ZFS is not the only free file system to provide advanced data protection but it does have the longest history providing it to users like us. Most other solutions require the use of multiple products to get the breadth of features. However Linux does have a comparable solution with BtrFS. BtrFS is more actively developed and better supported than the Linux version of ZFS. It also performs many of the same functions as ZFS, i.e. a combination file-system, logical volume manager, and software RAID subsystem.

The article The Cult of ZFS explains this in more detail.

kendall.a 05. Mar 2015 03:11 PM

OMG...Remah, is there anything you don't know something about?! You are simply amazing with your knowledge-base!

Half of what you just wrote, I don't understand, but it sounds really cool.

Thank you for being here and for sharing your knowledge with us. I, for one, intend to look at this program and read your link. Interesting stuff....

sicknero 05. Mar 2015 10:52 PM

Indeed, thank you. The idea of adopting a new file system is quite intimidating and raises a lot of questions ... I shall follow up the links and try to digest all the information : )

Remah 06. Mar 2015 12:03 AM

It's worth being aware of such products and features which are often built into NAS products you buy at a computer shop.

If you are a Windows user then Microsoft's new file system ReFS provides many of the same features as ZFS abd BtrFS. ReFS will eventually become more mainstream, maybe with Windows 10. It is available with Windows Server 2012 and 64-bit Windows 8.1 but is far from a mature product and you'd really want to know what you are doing before using it.

ReFS uses Storage Spaces, Microsofts new logical volume manager which also provides software RAID. It is available for NTFS so I hear of many people using it but again it is better to have some technical understanding of it.

So comparing the Windows products with ZFS, there are three main functions that ZFS provides which you could largely match on Windows using ReFS and Storage Spaces. It's just that ZFS is still more reliable:
  1. File system provides the means to organize data into files, folders, etc. Examples are ReFS, NTFS, FAT
  2. Logical volume manager allow groups of disks and other storage devices to be organized almost any way that you like so for example, a logical drive can be spread across many physical drives and can expand and contract beyond the size of any one physical drive. Examples are Windows Logical Disk Manager which you've probably never heard of or used which is now being replaced by the more advanced Storage Spaces.
  3. Software RAID manager allows RAID data redundancy to be provided without any special hardware. Software RAID is built into Storage Spaces for example.

sicknero 10. Mar 2015 01:16 AM

Sorry if this is a little O/T but this thread has brought a related issue to mind for me on the subject of corrupted drives.

I've read at times in various forums, that the Windows diskchecker can sometimes do more harm than good ... I'm just wondering what thoughts if any people have on this..?

Remah 10. Mar 2015 04:12 AM

Quote:

Originally Posted by sicknero (Post 108790)
Sorry if this is a little O/T but this thread has brought a related issue to mind for me on the subject of corrupted drives.

I've read at times in various forums, that the Windows diskchecker can sometimes do more harm than good ... I'm just wondering what thoughts if any people have on this..?

I've not had any of the specific problems that I've read about many over the years. But I have noticed the following issues.

1. It is used when other products are better suited to the task at hand
Part of the problem is that Windows check disk is used for problems that it can't really help with. Some problems can even cause it to crash.

It is not a complete hard disk check. Rather it is a logical disk/partition check that is little or no use with partition management, boot records, and physical disks/drives.

Other products do a better job because they can recover damaged structures and data more effectively. Plus they can check the physical hard disk and recover and repair it more fully.

These two categories have some better products:
Best Free Data Recovery and Undelete utility
Best Free Hard Drive Health Monitoring and Diagnostic Programs


2. Checking can accelerate the occurrence of problems
The act of comprehensively checking an entire drive can accelerate the occurrence and discovery of problems that would not have either occurred or been discovered until a later date. This becomes more obvious the more finite the life of the media.

Specific tests also increase the stress on particular components so the failure of that component is more likely. For example, a random disk read test is more likely to induce a failure than a sequential read test which doesn't move the read heads as much.

Something similar happens with memory checks too.

sicknero 11. Mar 2015 08:55 AM

Thanks again Remah.

I was asking because my habit is always to run chkdsk in the event of drives not being properly dismounted ... e.g. a system freeze forcing me to reboot using the power switch. I was wondering if that might have been a contributing factor to my hdd problems.

Burn-IT 11. Mar 2015 10:29 PM

Running CHKDSK is never going to cause problems with any disk that didn't already have problems. That is a complete lie. CHKDSK will do no more head movements than any other tool.
Checking a disk is NOT going to stress any components. It it always going to be better to run CHKDSK if you suspect bad dismounts.

You will try telling us next that SCANDISK was a bad tool for FAT32 disks or that the old Norton Utilities were bad.

Remah 11. Mar 2015 11:55 PM

Burn-IT,
To clarify, I was not saying that CHKDSK (or even ScanDisk) is bad or that it "does more harm than good". I was pointing out two related issues that get conflated with the question sicknero asked. As I said, "I've not had any of the specific problems that I've read about many [times] over the years. But I have noticed the following issues." (Note that I added the missing word)
1. It is used when other products are better suited to the task at hand
2. Checking can accelerate the occurrence of problems


Quote:

Originally Posted by Burn-IT (Post 108879)
Running CHKDSK is never going to cause problems with any disk that didn't already have problems. That is a complete lie. CHKDSK will do no more head movements than any other tool.

I didn't say that it is "going to cause problems". You might have interpreted that I was specifying a causal relationship but I was saying that the problem was nacent, i.e. developing or ready to be discovered.

Also, my comparison isn't between check disk and other tools. It was between checking and not checking. I said "The act of comprehensively checking an entire drive can accelerate the occurrence and discovery of problems that would not have either occurred or been discovered until a later date. This becomes more obvious the more finite the life of the media."

I largely agree with your last sentence because many CHKDSK replacements perform more checks. But over the years there has been at least one tool that publicized its higher efficiency with less movement of the disk heads.


Quote:

Originally Posted by Burn-IT (Post 108879)
Checking a disk is NOT going to stress any components

I said "Specific tests also increase the stress on particular components so the failure of that component is more likely. For example, a random disk read test is more likely to induce a failure than a sequential read test which doesn't move the read heads as much."

In general, movement of mechanical components will increase the stress on them but it is common to have stress on components even when they are not moving.
An operating mechanical disk drive always has elements under stress. Every disk head movement places measurable stress on mechanical components. But even when the heads are not moving stress still exists where the heads have to be parked electromagnetically. Likewise there are stresses on the spinning disks and rotors even when they spin at a constant speed. These stresses increase when spinning up and spinning down the platters.


Quote:

Originally Posted by Burn-IT (Post 108879)
It is always going to be better to run CHKDSK if you suspect bad dismounts.

I didn't making a comparison of that sort. But if I had I would agree with you with the following provisos:
  • If you suspect that the drive has a mechanical problem then it is worth resolving that before attempting to repair logical problems.
  • If you suspect that the drive only has logical problems then it helps to know whether it is the content of the partition or the metadata supporting that partition. Check disk is useful for the former but makes no difference to the latter.


Quote:

Originally Posted by Burn-IT (Post 108879)
You will try telling us next that SCANDISK was a bad tool for FAT32 disks or that the old Norton Utilities were bad.

This is a straw man. I didn't say anything like that and certainly wouldn't say this.

By "old" Norton Utilities, do you mean the 80s Disk Doctor. I thought it was very useful at the time. I have liked and used Norton Utilities for a few decades even after Symantec bought out Peter Norton.

Burn-IT 12. Mar 2015 01:48 PM

That's fine.
I wasn't intending to criticise you, but more to promote further explanations for less knowledgeable people.

Yes I did mean Disk Doctor, which I still use.

Remah 12. Mar 2015 10:27 PM

Quote:

Originally Posted by Burn-IT (Post 108916)
That's fine.
I wasn't intending to criticise you, but more to promote further explanations for less knowledgeable people.

Yes I did mean Disk Doctor, which I still use.

At the time, Disk Doctor was a much needed addition because it was so easy to use. I'm so grateful that the situation is much improved today. Disk utilities are so much better and we don't have to use floppy disks anymore - they failed much more often.

Unfortunately, the frustration of failing storage devices still remains.

People get upset when their disk or memory fails while using a utility that was recommended for diagnosing or repairing their problem. Many blame the utility, naturally, because they don't understand that a specific disk or memory location is in the process of failing.

It is even more upsetting when they are able to repair the errors and everything seems OK for a while. Then there is a sudden catastrophic failure and they realize that the problems they were having were warnings of a more serious failure. It's a bad feeling when you realize that you've lost it all and might have saved it by getting a complete disk image before the failure is complete.


All times are GMT +1. The time now is 02:26 AM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2020, vBulletin Solutions, Inc.