Recovering data and fixing the drive from unclean unmount of disk from windows

By | 9 October 2026
0 Comment

Here’s the full procedure from start to finish. Replace /dev/sdc with your disk if it shows up under a different name, which can happen after replugging.

1. Identify and check the disk

lsblk                                   # find the disk by its size (1.4T)
sudo smartctl -d sat -a /dev/sdc        # -d sat is needed for this USB enclosure

In the attribute table, check that these raw values are 0: Reallocated_Sector_Ct (5), Reported_Uncorrect (187), Current_Pending_Sector (197), Offline_Uncorrectable (198) and UDMA_CRC_Error_Count (199). If they’re not, image the disk with ddrescue before doing anything else.

2. Find the partition

sudo sgdisk -p /dev/sdc

If your NTFS partition is listed, offset and sizelimit aren’t needed. Skip step 3 and use /dev/sdc1 wherever the steps below say /dev/loop24.

If it’s missing, as in your case, run sudo testdisk /dev/sdc and choose Analyse → Quick Search. Note the Start and Size (in sectors) of the NTFS partition, then quit without writing anything.

3. Find the partition with TestDisk and create a read-only loop device

Run TestDisk:

sudo testdisk /dev/sdc

Navigate the menus with the arrow keys and Enter:

  1. Log file: choose No Log.
  2. Disk selection: /dev/sdc is selected, so choose Proceed.
  3. Partition table type: accept the one it detects (EFI GPT) and press Enter.
  4. Choose Analyse, then Quick Search.

Read the values. You’ll see a line like this:

     Partition               Start        End    Size in sectors
>P MS Data                     2048 2930272255 2930270208 [Seagate Expansion Drive]

Write down the Start (2048) and Size in sectors (2930270208).

Quit without writing. Press Enter to continue, then choose Quit on the next screen, and keep choosing Quit until you’re back at the shell. Don’t choose Write, because that changes the disk. You’ll do the partition table fix later, in step 7, with sgdisk.

Calculate offset and sizelimit. The sector size is 512 bytes, from sgdisk -p:

offset = Start × 512 = 2048 × 512 = 1048576
sizelimit = Size × 512 = 2930270208 × 512 = 1500298346496

Create the read-only loop device. The shell can do the arithmetic:

sudo losetup --find --show --read-only \
     --offset $((2048*512)) --sizelimit $((2930270208*512)) /dev/sdc

This prints the loop device name, for example /dev/loop24. Use that name in steps 4 to 6.

The offset is required, because it tells Linux where the filesystem starts. The sizelimit is optional but recommended, because it keeps reads inside the partition.

4. Mount read-only

sudo mkdir -p /mnt/recover
sudo mount -t ntfs-3g -o ro /dev/loop24 /mnt/recover   # try this first
sudo mount -t ntfs3   -o ro /dev/loop24 /mnt/recover   # if ntfs-3g fails
ls /mnt/recover

“Trying to write to read-only block-device” in dmesg is harmless. The read-only loop device is blocking the write, as intended. If neither mount works, use DMDE on /dev/loop24 instead.

5. Copy and verify

rsync -avh --progress /mnt/recover/ /path/to/backup/ 2>&1 | tee rsync.log
du -sh /mnt/recover /path/to/backup
find /mnt/recover -type f | wc -l ; find /path/to/backup -type f | wc -l

The sizes and file counts should match, and rsync.log should have no errors.

6. Unmount and disconnect

sync
sudo umount /mnt/recover
sudo losetup -d /dev/loop24
sudo udisksctl power-off -b /dev/sdc

7. Fix the partition table (Linux)

Only do this after the backup is verified.

sudo sgdisk --backup=$HOME/sdc-gpt-before-fix.bin /dev/sdc
sudo sgdisk -d 1 /dev/sdc
sudo sgdisk -n 1:2048:2930272255 -t 1:0700 -c 1:"Seagate Expansion Drive" /dev/sdc
sudo partprobe /dev/sdc
sudo blkid /dev/sdc1          # should show TYPE="ntfs"

The end sector is Start + Size − 1, which here is 2048 + 2930270208 − 1 = 2930272255. To undo this step, run sudo sgdisk --load-backup=$HOME/sdc-gpt-before-fix.bin /dev/sdc.

8. Repair the filesystem

On Windows, open Command Prompt as Administrator and run chkdsk E: /f, replacing E: with the drive’s letter. Then use Safely Remove before unplugging.

Without Windows, reformat and copy the data back. This erases the disk:

sudo mkfs.ntfs -Q -L "Seagate Expansion Drive" /dev/sdc1
sudo mount /dev/sdc1 /mnt/recover
rsync -avh --progress /path/to/backup/ /mnt/recover/

9. Identify the disk in windows

Open an elevated Command Prompt (cmd as administrator) and run:

diskpart

list disk

select disk N

detail disk

Match the disk by size. A RAW disk or one with no partitions confirms that the partition table is damaged.

10. Restore the partition table with TestDisk

Run testdisk_win.exe as Administrator, then:

  1. Select Create to start a log, then select the disk.
  2. Choose the partition table type (Intel for MBR, EFI GPT for GPT).
  3. Choose Analyse, then Quick Search. If the partition is not listed, run Deeper Search.
  4. Select the partition found earlier on Linux and press P to confirm that the files are listed.
  5. Set the partition to P (primary) and choose Write.
  6. Unplug and replug the drive.

11. Repair the boot sector (only if the partition shows up but won’t mount)

In TestDisk, go to Advanced, select the partition, then Boot. Choose Rebuild BS, or Org. BS to restore from the backup boot sector stored at the end of the partition, then Write.

12. Check the filesystem

Replace E: with the drive letter:

chkdsk E: /f

Use /r only if bad sectors are suspected, because it is slow. To check whether the volume is flagged dirty, run fsutil dirty query E:.

13. Assign a drive letter (if none appears)

diskpart

select volume X

assign letter=E

14. Fallback: wipe and reformat

If the repair fails, run the commands below. clean erases the entire disk, so confirm the disk number with list disk first.

diskpart

select disk N

clean

create partition primary

format fs=ntfs quick label=Backup

assign

15. Verify disk health

Check SMART status with CrystalDiskInfo or wmic diskdrive get status. A disk that lost its partition table may be failing and should not hold the only copy of important data.

From now on

Always unmount and power off before unplugging: Safely Remove on Windows, step 6 on Linux. If Windows ever asks to initialize the disk, click Cancel.