{"id":625,"date":"2026-10-09T17:01:28","date_gmt":"2026-10-09T11:31:28","guid":{"rendered":"https:\/\/www.bhuvankrishna.in\/blog\/?p=625"},"modified":"2026-10-13T19:18:06","modified_gmt":"2026-10-13T13:48:06","slug":"recovering-data-and-fixing-the-drive-from-unclean-unmount-of-disk-from-windows","status":"publish","type":"post","link":"https:\/\/www.bhuvankrishna.in\/blog\/2026\/10\/09\/recovering-data-and-fixing-the-drive-from-unclean-unmount-of-disk-from-windows\/","title":{"rendered":"Recovering data and fixing the drive from unclean unmount of disk from windows"},"content":{"rendered":"\n

Here’s the full procedure from start to finish. Replace \/dev\/sdc<\/code> with your disk if it shows up under a different name, which can happen after replugging.<\/p>\n\n\n\n

1. Identify and check the disk<\/h2>\n\n\n\n
lsblk                                   # find the disk by its size (1.4T)\nsudo smartctl -d sat -a \/dev\/sdc        # -d sat is needed for this USB enclosure\n<\/code><\/pre>\n\n\n\n
In the attribute table, check that these raw values are 0: Reallocated_Sector_Ct (5), Reported_Uncorrect (187), Current_Pending_Sector (197), Offline_Uncorrectable (198) and UDMA_CRC_Error_Count (199). If they’re not, image the disk with ddrescue<\/code> before doing anything else.<\/p>\n\n\n\n
2. Find the partition<\/h2>\n\n\n\n
sudo sgdisk -p \/dev\/sdc\n<\/code><\/pre>\n\n\n\n
If your NTFS partition is listed, offset and sizelimit aren’t needed. Skip step 3 and use \/dev\/sdc1<\/code> wherever the steps below say \/dev\/loop24<\/code>.<\/p>\n\n\n\n
If it’s missing, as in your case, run sudo testdisk \/dev\/sdc<\/code> and choose Analyse \u2192 Quick Search. Note the Start and Size (in sectors) of the NTFS partition, then quit without writing anything.<\/p>\n\n\n\n
3. Find the partition with TestDisk and create a read-only loop device<\/h2>\n\n\n\n
Run TestDisk:<\/strong><\/p>\n\n\n\n
sudo testdisk \/dev\/sdc\n<\/code><\/pre>\n\n\n\n
Navigate the menus with the arrow keys and Enter:<\/p>\n\n\n\n
    \n
  1. Log file: choose No Log<\/strong>.<\/li>\n\n\n\n
  2. Disk selection: \/dev\/sdc<\/code> is selected, so choose Proceed<\/strong>.<\/li>\n\n\n\n
  3. Partition table type: accept the one it detects (EFI GPT<\/strong>) and press Enter.<\/li>\n\n\n\n
  4. Choose Analyse<\/strong>, then Quick Search<\/strong>.<\/li>\n<\/ol>\n\n\n\n
    Read the values.<\/strong> You’ll see a line like this:<\/p>\n\n\n\n
         Partition               Start        End    Size in sectors\n>P MS Data                     2048 2930272255 2930270208 [Seagate Expansion Drive]\n<\/code><\/pre>\n\n\n\n
    Write down the Start (2048) and Size in sectors (2930270208).<\/p>\n\n\n\n
    Quit without writing.<\/strong> Press Enter to continue, then choose Quit<\/strong> on the next screen, and keep choosing Quit until you’re back at the shell. Don’t choose Write<\/strong>, because that changes the disk. You’ll do the partition table fix later, in step 7, with sgdisk<\/code>.<\/p>\n\n\n\n
    Calculate offset and sizelimit.<\/strong> The sector size is 512 bytes, from sgdisk -p<\/code>:<\/p>\n\n\n\n
    offset = Start \u00d7 512 = 2048 \u00d7 512 = 1048576
    sizelimit = Size \u00d7 512 = 2930270208 \u00d7 512 = 1500298346496<\/p>\n\n\n\n
    Create the read-only loop device.<\/strong> The shell can do the arithmetic:<\/p>\n\n\n\n
    sudo losetup --find --show --read-only \\\n     --offset $((2048*512)) --sizelimit $((2930270208*512)) \/dev\/sdc\n<\/code><\/pre>\n\n\n\n
    This prints the loop device name, for example \/dev\/loop24<\/code>. Use that name in steps 4 to 6.<\/p>\n\n\n\n
    The offset is required, because it tells Linux where the filesystem starts. The sizelimit is optional but recommended, because it keeps reads inside the partition.<\/p>\n\n\n\n
    4. Mount read-only<\/h2>\n\n\n\n
    sudo mkdir -p \/mnt\/recover\nsudo mount -t ntfs-3g -o ro \/dev\/loop24 \/mnt\/recover   # try this first\nsudo mount -t ntfs3   -o ro \/dev\/loop24 \/mnt\/recover   # if ntfs-3g fails\nls \/mnt\/recover\n<\/code><\/pre>\n\n\n\n
    “Trying to write to read-only block-device” in dmesg<\/code> is harmless. The read-only loop device is blocking the write, as intended. If neither mount works, use DMDE on \/dev\/loop24<\/code> instead.<\/p>\n\n\n\n
    5. Copy and verify<\/h2>\n\n\n\n
    rsync -avh --progress \/mnt\/recover\/ \/path\/to\/backup\/ 2>&1 | tee rsync.log\ndu -sh \/mnt\/recover \/path\/to\/backup\nfind \/mnt\/recover -type f | wc -l ; find \/path\/to\/backup -type f | wc -l\n<\/code><\/pre>\n\n\n\n
    The sizes and file counts should match, and rsync.log<\/code> should have no errors.<\/p>\n\n\n\n
    6. Unmount and disconnect<\/h2>\n\n\n\n
    sync\nsudo umount \/mnt\/recover\nsudo losetup -d \/dev\/loop24\nsudo udisksctl power-off -b \/dev\/sdc\n<\/code><\/pre>\n\n\n\n
    7. Fix the partition table (Linux)<\/h2>\n\n\n\n
    Only do this after the backup is verified.<\/p>\n\n\n\n
    sudo sgdisk --backup=$HOME\/sdc-gpt-before-fix.bin \/dev\/sdc\nsudo sgdisk -d 1 \/dev\/sdc\nsudo sgdisk -n 1:2048:2930272255 -t 1:0700 -c 1:\"Seagate Expansion Drive\" \/dev\/sdc\nsudo partprobe \/dev\/sdc\nsudo blkid \/dev\/sdc1          # should show TYPE=\"ntfs\"\n<\/code><\/pre>\n\n\n\n
    The end sector is Start + Size \u2212 1, which here is 2048 + 2930270208 \u2212 1 = 2930272255. To undo this step, run sudo sgdisk --load-backup=$HOME\/sdc-gpt-before-fix.bin \/dev\/sdc<\/code>.<\/p>\n\n\n\n
    8. Repair the filesystem<\/h2>\n\n\n\n
    On Windows, open Command Prompt as Administrator and run chkdsk E: \/f<\/code>, replacing E:<\/code> with the drive’s letter. Then use Safely Remove before unplugging.<\/p>\n\n\n\n
    Without Windows, reformat and copy the data back. This erases the disk:<\/p>\n\n\n\n
    sudo mkfs.ntfs -Q -L \"Seagate Expansion Drive\" \/dev\/sdc1\nsudo mount \/dev\/sdc1 \/mnt\/recover\nrsync -avh --progress \/path\/to\/backup\/ \/mnt\/recover\/\n\n<\/code><\/pre>\n\n\n\n
    9. Identify the disk<\/strong> in windows<\/h2>\n\n\n\n
    Open an elevated Command Prompt (cmd as administrator) and run:<\/p>\n\n\n\n
    diskpart\n\nlist disk\n\nselect disk N\n\ndetail disk<\/code><\/pre>\n\n\n\n
    Match the disk by size. A RAW disk or one with no partitions confirms that the partition table is damaged.<\/p>\n\n\n\n
    10. Restore the partition table with TestDisk<\/strong><\/h2>\n\n\n\n
    Run testdisk_win.exe<\/code> as Administrator, then:<\/p>\n\n\n\n
      \n
    1. Select Create<\/code> to start a log, then select the disk.<\/li>\n\n\n\n
    2. Choose the partition table type (Intel<\/code> for MBR, EFI GPT<\/code> for GPT). <\/li>\n\n\n\n
    3. Choose Analyse<\/code>, then Quick Search<\/code>. If the partition is not listed, run Deeper Search<\/code>.<\/li>\n\n\n\n
    4. Select the partition found earlier on Linux and press P<\/code> to confirm that the files are listed.<\/li>\n\n\n\n
    5. Set the partition to P<\/code> (primary) and choose Write<\/code>.<\/li>\n\n\n\n
    6. Unplug and replug the drive.<\/li>\n<\/ol>\n\n\n\n
      11. Repair the boot sector (only if the partition shows up but won’t mount)<\/strong><\/h2>\n\n\n\n
      In TestDisk, go to Advanced<\/code>, select the partition, then Boot<\/code>. Choose Rebuild BS<\/code>, or Org. BS<\/code> to restore from the backup boot sector stored at the end of the partition, then Write<\/code>.<\/p>\n\n\n\n
      12. Check the filesystem<\/strong><\/h2>\n\n\n\n
      Replace E:<\/code> with the drive letter:<\/p>\n\n\n\n
      chkdsk E: \/f<\/code><\/pre>\n\n\n\n
      Use \/r<\/code> only if bad sectors are suspected, because it is slow. To check whether the volume is flagged dirty, run fsutil dirty query E:<\/code>.<\/p>\n\n\n\n
      13. Assign a drive letter (if none appears)<\/strong><\/h2>\n\n\n\n
      diskpart\n\nselect volume X\n\nassign letter=E<\/code><\/pre>\n\n\n\n
      14. Fallback: wipe and reformat<\/strong><\/h2>\n\n\n\n
      If the repair fails, run the commands below. clean<\/code> erases the entire disk, so confirm the disk number with list disk<\/code> first.<\/p>\n\n\n\n
      diskpart\n\nselect disk N\n\nclean\n\ncreate partition primary\n\nformat fs=ntfs quick label=Backup\n\nassign<\/code><\/pre>\n\n\n\n
      15. Verify disk health<\/strong><\/h2>\n\n\n\n
      Check SMART status with CrystalDiskInfo or wmic diskdrive get status<\/code>. A disk that lost its partition table may be failing and should not hold the only copy of important data.<\/p>\n\n\n\n
      From now on<\/h2>\n\n\n\n
      Always unmount and power off before unplugging: Safely Remove on Windows, step 6 on Linux. If Windows ever asks to initialize the disk, click Cancel.<\/p>\n\n\n\n
      <\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
      Here’s the full procedure from start to finish. Replace \/dev\/sdc with your disk if it shows up under a different name, which can happen after replugging. 1. Identify and check the disk In the attribute table, check that these raw values are 0: Reallocated_Sector_Ct (5), Reported_Uncorrect (187), Current_Pending_Sector (197), Offline_Uncorrectable (198) and UDMA_CRC_Error_Count (199). If\u2026 Read More: Recovering data and fixing the drive from unclean unmount of\u2026 »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-625","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/posts\/625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/comments?post=625"}],"version-history":[{"count":4,"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/posts\/625\/revisions"}],"predecessor-version":[{"id":629,"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/posts\/625\/revisions\/629"}],"wp:attachment":[{"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/media?parent=625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/categories?post=625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bhuvankrishna.in\/blog\/wp-json\/wp\/v2\/tags?post=625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}