Verifying file integrity on NTFS under linux

08
2014-07
  • Antonio2011a

    I have an NTFS volume that I share between a linux machine and a windows machine. Recently I have had a couple of strange problems where files have become corrupted. This has affected some media files, but also some archive files. It isn't a major disaster as I did have some old backups, so I could recover the data, although more recent backups were also corrupt.

    The weird thing with one of the archive files is that some of the backups, that now appear corrupt, predate times where I had successfully accessed and updated the data in question on the live volume. That issue is really messing with my head and I wonder if there is some other issue going on as well.

    But in any event what I would like is a simple solution that will calculate a hash such as MD5 on all the files in the file system, and then enable me to periodically run a comparison so I can detect any changes (corruption). If possible I would prefer a linux solution. Potentially this could be done using some sort of shell script, but I would prefer a more robust / tested solution. Also since I have over 1TB in files it will need to be fast.

    I have found programs such as fcheck and aide. Are they appropriate for this? Are there any other recommended solutions? Thanks.

    • Answers
  • Tom

    The best way to fix any volume is with its native host OS. For NTFS, that means Windows. You might want to schedule a daily or weekly scan from Windows.

    The real problem here is why is the corruption happening in the first place. How are the file systems linked? With samba? Are there any errors in the samba logs?


    • Related Question

    NTFS symlinks in linux
  • hasenj

    I have an NTFS formatted drive (from a previous windows installation) and it contains some symlinks (reparse points),

    For some reason, I can't do anything with these symlinks: I can't go to where they link to, I can't even delete them.

    I guess the reason has to be that the link contained C:\ as a part of it.

    How can I deal with this issue?

    UPDATE:

    To clarify, these links are junctions/reparse points.

    For instance, I had C:\progs be a symlink to C:\Program Files

    If I try to remove it, I get:

    $ rm /media/disk/progs/ -rf
rm: cannot remove directory `/media/disk/progs': Operation not supported

    I actually removed /media/disk/Program Files/ anyway.

    UPDATE2:

    My system is linux mint (ubuntu based)


    • Related Answers
  • Pascal Thivent

    As explained in the Questions & Answers of the NTFS-3G support section, deleting a Reparse Point is not fully supported by the NTFG-3G driver. You might have to install the Advanced NTFS-3G driver:

    Why do I get an "Operation not supported" message when deleting a file?

    The NTFS-3G 1.5012 driver has solved this issue, or you're trying to delete an NTFS Reparse Point which is not fully supported yet in Stable NTFS-3G, only in the Advanced NTFS-3G version of the driver.

    I can't provide more specific guidance without more informations on your Linux distribution, version, etc.

  • Martin v. Löwis

    Try using ntfs3g. You may have to create a file /.NTFS-3G if you have symlinks to a different drive letter.