ShriHax | Blogs

Home / Blogs / NTFS recovery

Dirty NTFS Recovery: Back Up First, ntfsfix Later

Sep 12, 2026 · linux, filesystems, data recovery


My DATA_HDD (/dev/sda2, NTFS) refused a read-write mount. It mounted read-only, so I backed everything up to another drive first and only then cleared the dirty bit. Along the way I also restored ~4 GB of Kali files (CTF tooling, docs, media) from an old Timeshift snapshot into ~/kali-restore-tmp/.

Cause

journalctl: ntfs3(sda2): volume is dirty and "force" flag is not set!
It is recommended to use chkdsk.

Windows Fast Startup / hibernation / an unclean shutdown left the dirty bit set, and the Linux ntfs3 driver blocks RW mounts to protect your data. No I/O errors — the sibling partitions on the same disk mounted fine, so this was purely the dirty flag.

Step 1: read-only verify (zero writes)

udisksctl mount -b /dev/sda2 --options ro
df -h /run/media/$USER/DATA_HDD  # 199G, 78G used
ls /run/media/$USER/DATA_HDD

Step 2: back up before touching anything

Target: a folder on the second drive (GAMES_HDD/DATA_HDD_backup/). Lesson learned: on one spinning HDD, rsync -avh with per-file logging was too slow (aborted at 16G) and tar re-reads everything on resume (killed at 52G). What worked was quiet cp, one copy at a time — parallel copies on the same spindle just halve the speed:

mkdir -p "/run/media/$USER/GAMES_HDD/DATA_HDD_backup"
nohup cp -a "/run/media/$USER/DATA_HDD/Redmi-Note-10-Pro" \
  "/run/media/$USER/GAMES_HDD/DATA_HDD_backup/" > /tmp/redmi.log 2>&1 &
# resume-friendly variant for big trees (skip existing without re-reading):
nohup cp -aun "/run/media/$USER/DATA_HDD/CACHYOS_MIGRATION" \
  "/run/media/$USER/GAMES_HDD/DATA_HDD_backup/" > /tmp/cachyos.log 2>&1 &

cp -aun = archive + update + no-clobber: skips existing files without re-reading their data, the fastest resume on a spinning disk.

Step 3: the actual NTFS fix (after backup)

udisksctl unmount -b /dev/sda2
sudo ntfsfix /dev/sda2
udisksctl mount -b /dev/sda2
# best long-term: boot Windows, run `chkdsk E: /f`, and disable Fast Startup

Notes


← Back to Blogs · Home


↑ Back to Top