USB Hard Drives, NFTS, and MFT

USB Hard Drives, NFTS, and MFT

Seems to be an interesting issue that should become more common in the near future. Large USB and firewire based drives… and data corruption. Why?

Many people have data. They want it backed up. Tapes are (usually) slow and legacy technology, CDs are small nowadays almost to the point of floppy drives in the late ‘90s. DVDs are still pricy and also somewhat slow. Today you can buy a 120, 250, 300, or larger external drive and have fast movable storage. Great, eh?

Perhaps, as long as you plan for how to use it. Remember this is just a normal hard drive in an enclosure, of which almost none of them offer any sort of shock absorption. Most manufacturers are concerned with heat dissipation. Now you have a normal computer hard drive in an easily movable format... and one which people may actually move while the drive is spinning… eGads!

We began to explore the usage of these drives to get around a data storage crunch. Images of drives made for service grow exponentially each year along side Moore’s Law. Each year drives are bigger and people cram more files onto them, however even as drive sizes increase and prices fall, truly redundant network storage is still expensive.

We bought six (6) external USB/Firewire enclosures and large drives to store images on until the network groups are able to upgrade the SAN arrays (They just did this past year). To support the images and document storage needed. Great, fast portable drives to store and move data. Simple and cost effective right?

Well the first drive took a vacation. Not a terribly big issue, we plan on the drives failing usually not this soon (less than six weeks out). It is easily recoverable just means a loss of time to replicate the work which generated the data.

However, we are also looking deeper into the function of external drives. A drive failure could be just a manufacturing flaw, damage from shipping after manufacture, improper usage practices by the user, or some other uncataloged flaw. In this case with external drives there are 4-6 more points of failure which we needed to look into. Many we have not checked out before based on no actual need.

On the drive that failed the issue is a more problematic one… the partition structure was completely corrupted and in the first trace of the problem actually wiped out.

The drive was moved to a known good configuration; none of the partitions were seen. A blank drive according to the CPU. We used some hard drive recovery tools to recover the partition information. This worked, however mere minutes later the drive was corrupted again.

At this point we checked into the connection of the drive to the PC,

Was the cable damaged or loose?
What drive policies were assigned to the USB device?
Is the drive overheating?

All checks provided no answers. We then swapped USB cable just to be sure.

We were able to recover the logical partition not the primary, which is present and has a corrupted MFT (Master File Table) thus rendering any of the data inaccessible.

All check disk tools report the disk is fine (No impending hardware failures) all partition tools report the partition as either fine or corrupted, however those that report it corrupt (e.g. Partition Magic) are not able to reconstruct the data they just toss up a nifty little error message.

The drive was scanned with Ontrack to see if that would repair the MFT structure or if the data is lost from conventional (non-service related recovery) recovery means. This would not repair the MFT; however we were able to successfully extract data from the drive to another drive.

Based upon some quick research the some of the following are areas which can cause or contribute to these types of errors when used in a Windows environment.

Drive Policies
System Restore
Safe Hardware Removal

Proper planning and usage of these external large storage media is required to save yourself from a rather large data recovery bill or a lot of lost time and data… Take the time to think about what you are putting on the drives and whether you can afford to loose it when the drive fails. If not, come up with a different solution.

The following keyword search on Google, will generate a listing of results, the following are some of the interesting ones,

How do I repair a corrupt master file table?
Error Message: The File or Directory Is Corrupt...
Inside NTFS