After a restore, unable to delete 'corrupt and unreadable' files

Max:

Create an empty file in Notepad and then save it on top of the rogue file in the exact same location and with the exact same name. Re-writing the file will often write a new entry to the MFT, thus fixing the broken entry. Then you can try deleting the file.

Thanks KOLO:

Good idea - but unfortunately XP won't play ball (it comes up with exactly the same message when I try to save the dummy file).

It appears I am not alone: via Google, I have found one other identical report (http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_23095079.html)  

'Killbox' also won't work, so I guess I am going to attack the hard way with WinHex (unless Acronis Inc have some other suggestions)

Max:

You may be able to delete the corrupt files using a Linux boot CD. Most of the recent distributions can read/write to NTFS partitions, so you could download Knoppix or Ubuntu or your favorite distribution that offers a Live Linux (bootable) CD. If you use Knoppix, for example, all of your Windows partitions will be already mounted and viewable on the desktop after booting so it's easy, even for someone unfamiliar with Linux, to do this.

The root of the problem is NTFS files with Alternate Data Streams. All versions of TI up to TI Home 2009 had this problem. There is a big thread on the old forum describing the issue. Supposedly it was fixed in TI 2009. It only affects files and folders restores done from the Linux boot environment. Files and Folders restores done from Windows should never have the problem, nor should partition image restores or clones.

The root of the problem is NTFS files with Alternate Data Streams. All versions of TI up to TI Home 2009 had this problem. There is a big thread on the old forum describing the issue. Supposedly it was fixed in TI 2009. It only affects files and folders restores done from the Linux boot environment.

Many thanks. Sounds spot on! My restore was standalone using the Linux Acronis and was a file by file (not sector) restore of the entire disk. And all the affected files have ADSs (as WinHex tells me). 

I already run UBUNTU under VMWARE under XP, but did burn a bootable disk as well, so will give this a whirl. 

I guess my final decision - for future use (a bit late now...) - is whether to jump to TI 2009 (and hope Acronis got it right) or burn myself a BartPE version.

But why on earth Acronis Inc - who have presumably known about this for ages -  never warned users to avoid standalone Linux-based restores of files with ADS info appended is beyond me.    

Max:

I suspect that they didn't know. This is just a hunch, but since the recovery environment is Linux-based, they were probably just using some of the open-source NTFS packages, and those packages probably contained the bug. It has been pretty difficult for the open-source community to get NTFS implemented correctly. Microsoft never published a standards document, so all of their work has been reverse engineering and guessing games. However, from what I've read, the current NTFS-3g is pretty good.

Personally, I still don't trust Linux to write to an NTFS file system, so I avoid doing so. For the past couple of years I have only used VistaPE for restores, skipping the Linux implementation of TI and DD completely. If you know how to build a BartPE or one of the WinPE variants, I would recommend doing so. I wish Acronis would adopt a WinPE based recovery environment; there are too many posts on here from users with compatibility issues in the Acronis Linux recovery environment. Using a Windows-based recovery environment would eliminate most of these issues.

Mark:

Decided to try Knoppix per your earlier suggestion (normally use UBUNTU). Downloaded and burned V6.0.1  Worked like clockwork - hosed files* now gone - and easier than UNBUNU to get straight to a file list.

* or more probably hosed file index records

I have the same problem - but in my case I want to copy, not delete, those "corrupted or unreadable" files.

I ended up using the boot environment because TrueImage is crashing every time I try to restore from within Windows. Now it appears to have restored, but some of the files are unreadable.

This is VERY poor design. Backup software should not silently write files which are "corrupt or unreadable" - at the very least Acronis should be warning us that this can happen!

Still no fix from Acronis?

I'm having a horrible time with various corrupted files after copying them from my last tibfile (full partition backup - verified) mounted as a drive by the management console.

The same thing happened when I restored selected files from the tib.

Can't delete the files in DOS prompt or safe mode. Windows wants to run a scandisk every time it starts, but can't fix the problem, which seems to be short / longname related according to advice around the web.

I downloaded the latest Ubuntu, ran from CD and copied the ones I've found so far to a new location then deleted the corrupted files.

It works, but it's painful! Is there some way I can raise a ticket with Acronis to address this problem when restoring files?

Windows 7
Acronis Backup & Restore 10.0.11133

Chris:

I've never encountered a problem extracting files from a mounted image in Windows; only when restoring individual files in the Linux recovery environment. If you have, that's a very serious issue indeed. You should raise a ticket with Acronis Support.

At the top of this page (in the header and on the right side) is a link to Support. Follow the link to the Acronis Web Site and go to the "Contact Support" area to be connected to Live Chat.

After looking at many forums and trying a delete utility, the "old forum" link referred above by Mark Wharton which points to http://www.wilderssecurity.com/showthread.php?t=218437 worked for me. Basically in that thread it says to just boot using Acronis and then start the restore files procedure. But at the point where it asks the location to restore the files just navigate to corrupted folders & files and click on "Delete" at the top of the folder pane. Even though it was the Acronis/Linux software that corrupted it, it will delete it properly.

I had a corrupt folder:
C:\Documents and Settings\USER\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active

This caused C: to become dirty whenever that user ran Internet Explorer 8.

Deleting from Knoppix didn't work for me (I tried versions 6.0.1 and 6.2.1). I finally managed to get rid of it by attaching the disk to a Windows 7 PC and doing a chkdsk & delete from there. I didn't try delete before the chkdsk, so I don't know which it was that made the difference.

It probably wasn't caused by Acronis in this case.

I'm having the same problem, running chkdsk through Acronis finds no problems with the drive,
I've everything everything I knew to delete the corrupt folder, and then learned a bunch of new stuff and tried that too.

No luck at all.

I've tried deleting the file through ubuntu, but it also says it's corrupt.
How did you delete the file using linux? (Is there a special command? I'm kinda a noob still)
I have access to ubuntu installed on a computer, and also a knoppix live CD, so I an try something in either one.

I found the microsoft knowledgebase article also. It seems so strange that there's still no solution from them after more than 8 years of this being a known problem!

user 452:

Ubuntu has a graphical file manager, so deleting a file works the same as in Windows. Select the file by clicking on it and then press Delete, or right-click and choose Delete. You can also use a text-based terminal command to delete files. Start the Terminal program and then navigate to the file's location using the cd (change directory) command. Then delete the file using the rm (remove) command. You can find a description of various Linux terminal commands here: http://oreilly.com/linux/command-directory/

Thank you.

I'm familiar with the basic use of Ubuntu, but that doesn't help me delete corrupt files.

shift-delete gives a corrupt message.
deleting the file normally only moves to the trash, where it is still just as corrupt when attempting to empty the trash.
(I was initially elated that the file disappeared, before I realised it had just been moved)

"sudo rm -rf ./corrupt/" gives a "directory is not empty" message.

What I'm looking for is a specific command or method to delete corrupt files outlined in MSoft KB 246026

I've also tried deleting it in a windows cmd prompt via the 8.3 filename, the trouble is that it doesn't have one. (dir /x shows nothing, and the expected 8.3 filename just isn't found)

Linux will normally not allow you to delete a directory unless it's empty. Can you delete individual files in the directory? There's a command to force deletion of a directory and all of its contents; I believe it's "sudo rmdir --ignore-fail-on-non-empty" followed by the name of the directory.

Was the information in reply #10 helpful? That has worked for some forum users in the past.

There are no files in the directory. :/

The "r" in "sudo rm -rf" means recursive, which would delete any files that are there, similar to /s under windows.

I also tried "--ignore-fail-on-non-empty", and it didn't tell me the directory was non-empty or corrupt, but it also didn't delete the directory :(

I don't have a backup containing the corrupt folder.
One thing I'd like to try is doing a full partition copy using acronis and seeing if the corrupt folder is in the same state on a new drive. I can't do this though, because the drive with the corrupt folder is a 1.5tb, and I don't have any that large that are empty.
I also don't have enough free space to move all but the corrupt folder, so I'm still trying to look for answers.

If I haven't found any solutions by the time I get a new larger drive, I'll try moving all the but the folder and attempt to copy the corrupt folder to a smaller, expendable drive. Maybe if I can resize the partition to practically nothing, I can upload a backup image for others to investigate. Maybe I'll send it to Microsoft and they can create a fix for it.

I've sent Max Stewart a PM asking the exact way he managed to delete his file, just in case he's not subscribed to notifications to the thread.

user 452 wrote:

I've sent Max Stewart a PM asking the exact way he managed to delete his file

His statement that it 'Worked like clockwork' suggests he didn't have to do anything out of the ordinary.

Mine wouldn't delete in Knoppix or another Linux build, so I'd suggest trying other methods.

Could you give the methods you've tried so far? In particular, have you tried chkdsk and delete in Windows 7, which is what worked for me?

Malwarebytes FileASSASSIN might be worth a try. It deleted a file for me that I could not remove, even from BartPE. That was not a KB246026 problem, but who knows, you might have multiple problems.

I have never heard of FileASSASSIN, thank you for the suggestion, I'll try it immediately!
Oh, damn. FileASSASSIN doesn't do directories. Using FA from the commandline just gives an error about it not being visible to FA, which I assume is because it's a directory.
But thanks for the suggestion!

Lets see how may I can remember :)
I've tried:
winxp normal delete
winxp shift-delete
winXP cmd rd
winXP cmd rd using 8.3 filename
winXP cmd rd using \\?\file:\\
winXP cmd creating a new file/folder with the same name
winXP unlocker 1.8.3
winXP unlocker 1.8.3 with rebootting
winXP acronis chkdsk (option 2, not 3)
winXP cmd chkdsk /f (strangely, it stayed on 1% for 5 hours, then jumped to 43% rather fast and stayed there for another several hours, at that point I went to bed and it was finished in the morning, but didn't say it found any errors)
winXP safemode (I was really hoping this one would work after finding the suggestion online!)

ubuntu standard delete (moved to trash, but trash wouldn't empty)
ubuntu shift-delete
ubuntu sudo rm -rf
ubuntu gparted disk check (kinda unsafe, but I didn't read about the possibility of huge failure until I'd already started the check.)

I've downloaded a couple of windows programs I had never heard of, but they didn't work either so I deleted them.

I do have a bunch of boot cds and usb loaders, inc BartPE, but the folder is on an external drive meaning it's not a problem with the file being locked, so i don't think there's much hope of deleting it just by booting from USB/CD
One thing I haven't tried, that I could easily do, is seeing if Windows 7 has any better luck, perhaps the NTFS driver is updated or something.

edit: no luck with shift-delete under WinXP. Trying chkdsk now.

edit: haha. windows 7 chkdsk is much better than Winxp chkdsk apparently.
It found problems that winxp didn't find, fixed them and the folder now deletes without an error.

Thank you for your help, and if anyone else finds this, the answer is Windows 7 chkdsk!

Further to my much earlier comment in this thread "just worked like clockwork" [using Knoppix], I simply did a file delete usign Knoppix's file manager (like Windows Explorer).
Perhaps the more recent posters with similar-sounding probpems had files which were not corrupt as far as Windows is concerned (corrupted by Acronis Linux-based restore) because their directory entry contained contained ADS information but corrupt for some other reason.

I made the mistake of purchasing the upgrade of Acronis TIH 2011, despite the problems described above - it took me a week to fix the random corrupted files and directories in a restore I had to do in the summer on 2009, but believed it had been fixed by now. (what backup system can't restore its own files? puzzling.) Unfortunately, the same problem just happened on a restore from TIH 2011, with a backup made with the same version (2011) just a few days ago. Corrupted directories are difficult to find and to fix, and booting to linux to fix these things is pretty much defeating the purpose of having a backup solution in the first place.
Does anyone know how to detect these corruptions across the system, or do I have to wait to crash an application to detect them on my disk?

Thanks.
Thomas