Undoing chkdsk recovery for "invalid file names"?

July 4, 2015 10:48 AM

I accidentally deleted the System Volume Information folder in an external NTFS formatted drive. Today after a reboot to install updates windows 7 automatically ran chkdsk, which flipped over the table in rage. Specifically, it did the following for thousands of files generated on linux with names it considers invalid:

Deleted invalid filename 1196537776.5405.lgv7c:2,S (57703) in directory 55091.
The NTFS file name attribute in file 0xe167 is incorrect.
31 00 31 00 39 00 36 00 35 00 33 00 37 00 37 00 1.1.9.6.5.3.7.7.
37 00 36 00 2e 00 35 00 34 00 30 00 35 00 2e 00 7.6...5.4.0.5...
6c 00 67 00 76 00 37 00 63 00 3a 00 32 00 2c 00 l.g.v.7.c.:.2.,.
53 00 53 00 53 00 e3 52 16 52 00 00 00 80 22 00 S.S.S..R.R....".
68 00 65 00 20 00 4e 00 54 00 46 00 53 00 20 00 h.e. .N.T.F.S. .
File 57703 has been orphaned since all its filenames were invalid
Windows will recover the file in the orphan recovery phase.
Correcting minor file name errors in file 57703.

and later:

Unable to locate the file name attribute of index entry 1196537776.5405.lgv7c:2,S
of index $I30 with parent 0xd733 in file 0xe167.
Deleting index entry 1196537776.5405.lgv7c:2,S in index $I30 of file 55091.

I am pretty sure those are all emails from an old evolution install (it stored emails as individual files). There are some more obvious files:

Deleted invalid filename I Love Rock & Roll: Hits of the 60s, Volume Two (351979) in directory 351978.

At the end:
418279 index entries processed.
Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
17694 unindexed files scanned. ^M
CHKDSK is recovering remaining unindexed files.
Too much lost data to recover it all.
17695 unindexed files recovered. ^M
CHKDSK is verifying security descriptors (stage 3 of 3)...
380299 file SDs/SIDs processed. ^M
Cleaning up 17 unused index entries from index $SII of file 0x9.
Cleaning up 17 unused index entries from index $SDH of file 0x9.
Cleaning up 17 unused security descriptors.
Security descriptor verification completed.
18990 data files processed. ^M
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

1465136000 KB total disk space.
1200810992 KB in 349259 files.
86036 KB in 18993 indexes.
0 KB in bad sectors.
543364 KB in use by the system.
65536 KB occupied by the log file.
263695608 KB available on disk.

4096 bytes in each allocation unit.
366284000 total allocation units on disk.
65923902 allocation units available on disk.

Internal Info:
8b cd 05 00 86 9e 05 00 31 a8 05 00 00 00 00 00 ........1.......
35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5...............
14 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 ................

Notably,
$grep -c "Deleted invalid filename" chkdsklog.txt
17694

and,
found.000$ find . -type f | wc -l
10065

So I think that not all the unindexed files actually got recovered.

I have two questions
1) is there an automated tool for parsing this log output and repairing where possible?
2) How can I map the directory numbers in the output to something readable? I think based on the raw output that none of the affected data is actually important, but it would be nice to know for sure. I see forum postings suggesting that this is more or less impossible unless you guess it correctly, and the links they gave for the legendary Microsoft Disk Editor are dead. There are more and more NTFS tools for linux and ntfswalk, maybe one of them can do it?

posted by a robot made out of meat to Computers & Internet (2 answers total)

You can use find to scan a hard disk, in Linux, for files with names that chkdsk will object to:

find /path/to/mount/point -regex $'.*[\x01-\x1f"*:<>?\\|].*'

Sorry that this is a bit closing-door-after-horse-bolted, but given that the numbers in your log will be describing the state of the filesystem before chkdsk "fixed" it, I have strong doubts that they will mean anything useful after it's done. As a working netadmin and PC fixit guy, I don't recommend putting any more time into this. Take it as an object lesson on the indispensability of backups.
posted by flabdablet at 7:06 AM on July 5, 2015

By the way, in case it makes you feel better: I regularly delete System Volume Information from external ntfs-formatted drives, and never even once has this prompted Windows to run an unsolicited chkdsk. Windows Update, on the other hand, is a law unto itself.
posted by flabdablet at 7:11 AM on July 5, 2015