Ntfs3 keeps corrupting my ntfs partitons

Support
1

one month ago i updated from kernel 5.10 to 6.1. so i automaticaly switched from ntfs-3g to ntfs3.
thought thats a good thing ;-(
for compatitbility with other os i have some large external disks with ntfs.
last week while copying from one of those disks, the copying process dropped from ~> 100mb/s to ~< 1mb/s.
i waited patiently to finish the process and unmounted the disk. after that the ntfs partiton appears corrupted. under windows 10 shown as raw.
same happend with another disk today ! thats realy bad !
each of those disks also have ext4 partitions that are intact.

sudo mount /dev/sda1 /media/ext
leads to:

ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 4096   usa_ofs: 0  usa_count: 0: Das Argument ist ungĂĽltig
Corrupt index block signature: vcn 40 inode 5
Failed to open $Secure: Datei oder Verzeichnis nicht gefunden
Failed to mount '/dev/sda1': Datei oder Verzeichnis nicht gefunden

testdisk is able to look into that ntfs partiton but one realy large folder is missing.

i am able to mount with

sudo mount -t ntfs3 -o force /dev/sda1 /media/ext

but can only look into the partition with the terminal. dolphin is showing an blank folder.
sudo ls -al /media/ext
again some files and folders are missing
for an example:

ls: Zugriff auf '/media/ext/$RECYCLE.BIN' nicht möglich: Das Argument ist ungültig
ls: das Verzeichnis '/media/ext' wird gelesen: Das Argument ist ungĂĽltig

dmesg
[110673.566308] ntfs3: sda1: ino=5, "/" directory corrupted

so i wonder whats the best method in this particular case to recover those large ntfs partitions ?
just to rebuild a file index, partition table with testdisk ?
i dont dare to use windows chkdsk as it always seemed to be unpredictable.

and whats the proper procedure to revert back to ntfs-3g ?

thank you


Kernel: 6.1.41-1-MANJARO arch: x86_64 bits: 64 compiler: gcc v: 13.1.1
Desktop: KDE Plasma v: 5.27.6 tk: Qt v: 5.15.10 wm: kwin_x11 vt: 2 dm: SDDM
2

Throwing yourself into a DIY data rescue operation - when you have to ask how to do it - is unwise - especially if the data is valuable.

If it is for your own education use testdisk - be sure you have a second disk available to store the rescued data.

2 Likes
3

@linux-aarhus thank you for the quick answer

yes. shure. thats why i ask what could be the best method (unlike windows chkdisk) to do an nondestructive recovery. tomorrow i buy a new disk.

as it obviously has to with the switch from ntfs-3g to ntfs3 by upgrading the kernel from 5.10 to 6.1 i need to revert back to ntfs-3g asap.
i use ntfs-3g with my internal ntfs disk since 3+ years all the time without any problems.
(Reddit - Dive into anything
NTFS3 driver is orphan already. What we do?)

could you please tell me or point me to the proper method how revert back to ntfs-3g on manjaro/kde ?

thank you very much,

4

or would this be simply done with ?
sudo mount -t ntfs-3g /dev/sdx1 /mnt/mountpoint/

5

and in fstab ?
UUID=1234567xxxx /run/media/$user/windata ntfs-3g rw 0 0

but automatically system wide ?

6

To me accessing NTFS partition from Linux is just some kind of convenience. Don’t expect it to work as in Windows. You should NOT use NTFS at all on Linux.

Once you start to work/write to NTFS from Linux, you open a whole can of worms… Read-Only your NTFS partition, and use something supported on ALL OS you use if needed (FAT32, EXFAT, things like that), not NTFS.

2 Likes
7

@omano thank you. that doesn’t answer any of my questions.
in an ideal world i would use ext4 only but for some reasons i am forced to be compatible with ntfs.
and that worked out very well for 3+ years till now. but since the kernel update my os switched automaticaly to a new diffrent and faulty ntfs driver.
and now i want to revert back to the old one.
so. any hints how to do that ?

8

I am in a similar situation where I “have” to use ntfs on one drive.

I still use ntfs-3g to mount. Windows sometimes reports fs as “corrupt” but after running a check on the drive in windows, no errors ever detected (touch wood).

I opted to not change what has been working for a long time, ie stay with ntfs-3g, no idea if that is the issue here though.

9

I know it doesn’t solve the issue. But if you are forced to work with other OS you should think about the file system you use, because NTFS is no good on the long run.

For your issue, fix the file system in Windows with chkdsk (don’t use Linux tool to do that, please, I know many here will tell you to, but DO NOT), and in Linux edit the /etc/fstab file to use the ntfs-3g driver for that NTFS partition if you want to go back.

//EDIT: wiki for fstab Fstab - Manjaro

Also post your fstab file here if you want help.

10

Very true.
In my situation I have everything on the ntfs drive backed up, so if the drive fails, that is when I reformat it to exFAT (witch is the one that I think would be most appropriate)

I would also extend that to use systemd to mount instead of fstab, really nice to be able to journalctl errors AND I think it sometimes can treat the fileystem a little better if errors were to occur on your os that would involve the partition.

So for op, recommendation is to try to solve the data corruption (if possible) IN WINDOWS!

11

I think you are facing some issue as me.
And I think to retrieve the files, you need to work in Windows environment, and perform repair.

The suggestion by @servimo is to disable ntfs3:
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/disable-ntfs3.conf

12

I guess disabling ntfs3 is another solution that would not need to configure anything, it will then use the ntfs-3g driver by default I assume. :+1:

13

Solving buggy code, is not my forte.
Since many senpai already indicated ntfs3 as buggy, i just heed their advice and stay away - revert back to ntfs-3g.
Afterall, I already lost hundreds GB of data.
Enough is enough.

14

thank you for all the input !!!

now i am getting confused:
sudo mount | grep ntfs
doesnt say anything because auto mounted ntfs disks markes as type fuseblk

ls /sbin/mount.ntfs* -l

lrwxrwxrwx 1 root root 16 31. Okt 2022  /sbin/mount.ntfs -> /usr/bin/ntfs-3g
lrwxrwxrwx 1 root root 16 31. Okt 2022  /sbin/mount.ntfs-3g -> /usr/bin/ntfs-3g

how do i find out what driver is realy running ?

15

That’s ntfs-3g (when for a NTFS partition). The default.

I told you to configure your fstab if you want to set the “driver” (the module).

Check mounts:

cat /proc/mounts

example:

/dev/sdb2 /media/HDD_300_Go ntfs3 ro,noatime,uid=0,gid=0,iocharset=utf8 0 0
16

cat /proc/mounts results also always in fuseblk.
so if its ntfs-3g all the time and not ntfs3 even if my problems fit to other people reports with ntfs3 ?
am i probably looking at the wrong spot ?
ntfs-3g has not changed since last november extra/ntfs-3g 2022.10.3-1.
so what could possibly cause corruped filesystems on two external disks in one week ?
we had no earthquakes over here :wink:

ps. well still reading the fstab wiki (thanks omano)

17

Bad disks.

I didn’t see reports of ntfs3 destroying people’s disk, but at the same time back to what I said, NTFS is not supported properly on anything else than Windows.

18

wiki for fstab Fstab - Manjaro
Also post your fstab file here if you want help.

thats very kind. to be honest i always used the OS automount. im not very firm with fstab flags. so i start simple. please correct me if you see something crucial missing or wrong.
UUID=xxxx /run/media/username/data ntfs-3g defaults,uid=1000,gid=1000 0 0

19

That’s not read only, you have been warned already though, do as you wish.

I would add the noatime options to not write useless info on file when you access them (it reduces useless writes), the noauto option so it doesn’t auto mount on boot, and nofail option too in case you want to mount it on boot, and if there is an issue, it would boot instead of going into emergency mode (and use ro without uid and gid but you seem to want to write to it at all cost). I would use the ro option to not touch the file system but I could still read it.

# simple Read-Only
 UUID=xxxx /run/media/username/data ntfs-3g defaults,ro,noauto 0 0
# Read-Write
 UUID=xxxx /run/media/username/data ntfs-3g defaults,noatime,noauto,windows_names,fmask=133,dmask=022,uid=1000,gid=1000 0 0

Also use a proper mount point, /run/media is not intended for that it is for auto mounting from desktop, not to define static mount points. Create a folder, example /media/data, give yourself permission on it, and use that folder to mount your partition.

If you’re sure everything is correct, you can try the mount with mount -a (will not work if partition has noauto option)

https://wiki.archlinux.org/title/NTFS-3G

Options defined in fstab will be used when mounting the partition.

//EDIT: forgot about it, but if you insist on writing on it, make sure to add the option windows_names so it would not allow illegal windows file/folder names.

20

noatime is a good option to add on aswell,

This is my goto ntfs options: nofail,noatime,uid=USERNAME,gid=GROUP,dmask=0022,fmask=0133

So you get those directories and files having the correct permissions. (unless you want it read only like above example)
gid can be number like you did or your actual username.

Edit
Never really bothered with the windows names, only use my ntfs for “normal” files so to say, but yes, that is also a good option to add.