Removing corrupt NTFS file

[jaapengel79]

Hi,

We received a call from one of the endusers about how to delete a specific file. The file, when tried to delete normally, says 'Cannot read from source file or disk'.

The file is named /&510L~1 (note the leading / !) according to Windows, and has no properties, size, owner or ACL. I've tried hooking up a Linux machine, connecting through SMB, and rm -rf the file but that also didn't work, I receive an error of the same stretch. (Although Linux doesn't list the file, it gives me an error 'File not found' when just trying to ls the directory!)

Anyway... is there any method of killing off this file? Tools like Ultraedit won't open it either, I tried that.. and it's not like the file is in use (there are plenty of tools for that one) but the file simply won't get read..

Greets
Jaap

 

[itsp1965]

Have you tried going to the command prompt and type DEL *.~1 from the directory where the file resides. It prob didn't work in linux since to linux it looks like a folder '/'. Hope this helps.

 

[jaapengel79]

Just tried that from a commandline, it said it couldn't find <directory>\*.~1 ..

I also tried:

del *.*
<directory>\*.* Are you sure? (yes, obviously I am)
--> \directory\/&510L~1 The system could not find the file specified

del "*.*"
--> (same error as above)

del "/&510L~1"
--> Could Not Find F:\/&510L~1 (and the file is in a subdir of a subdir of a subdir, too.. not in the root of F.

The file btw is 7 dirs deep.. nothing major, no huge path lengths or anything..

 

[itsp1965]

Try this;

del \\.\f:\subdir1\subdir2\/&510L~1

Hope this works for you.

 

[jaapengel79]

I'm sorry to say it didn't...

It says:

Invalid switch - "".
'510L~1' is not recognized as an internal or external command, etc. etc.

Using the same command you gave me but using

\subdir2\*

instead, gives me an error indicating:

\\.\f:\directory1\directory2\..\/&510L~1 The system cannot find the file specified.

 

[itsp1965]

Okay what is your complete path.. the one I sent is an example. Your command would be del \\.\<your full path incl subdirs\/&510L~1

 

[Roadki11]

You should run chkdsk /F on the volume, might have a slight filesystem curruption. Then try to delete the file. On a side note how is your disk space on that volume? is this machine exposed to the internet at all(HTTP, FTP)? ive seen compromised machines exibit this behavor.

RoadKi11

 

[jaapengel79]

@ITSP1965:
I did ofcourse substitute 'subdir1' and 'subdir2' with the complete, 7-folder-deep structure but for completeness:

f:\nd306p\OFC\UIL\UG\Norplast\Changes\Norplast-000412\/&510L~1

(Where the last bit is the filename with a trailing /& thingie)

@Roadki11:
We tried chkdsk /f, no result, everything seemed fine. I could still try chkdsk /c /i /f but it would force an unmount and/or since the filesystem is in use (it's a dataserver) we need to go through the change-approval-process, scheduling downtime, etc. etc. which is a bit of a nuisance.

The machine is not directly connected to the internet in any way, 'safely' behind our firewalls and proxies.. (which doesn't always means much, I know..)

 

[itsp1965]

Jaap try the following;
Go to a command prompt and type the following;

1. SUBST W: "F:\ND306p\\OFC\UIL\UG\Norplast\Changes\Norplast-000412" and press ENTER
This will create a substituted drive to this path

2. Go to W: and then proceed to type the command as follows;
del \\.\w:\*.~1

Give this a try. Hope it helps.

 

[jaapengel79]

@Itsp1965:

Thanks again; but..

Output was:

del \\.\w:\*.~1
Could not find \\.\w:\*.~1

So then I tried:

W:\>del \\.\w:\*
\\.\W:\*, Are you sure (Y/N)? y
\\.\w:\/&510L~1
The system cannot find the file specified.

(Same goes for when I try the del \\.\w:\* command from C

 

[itsp1965]

wow.. what a pain. Jaap I take that renaming the file didn't work for you either right? As an exercise can you;

1. Try using the attrib command to remove all file properties ie attrib -s -r -h (assuming attrib can see the file)

2. Check to see if the file is encrypted using EFS using the cipher command

 

[karlisi]

You cannot delete this file because of invalid filename. Slash is not allowed in Windows, so Windows file utilities don't see this file properly, this is why you don't see any attributes. You cannot delete it from Linux trough network because the real operations are made by Windows on Linux requests.

Just an idea - install IIS with ftp service enabled on your server, AFAIK there is no restart needed. Then make new ftp site from directory where this invalid file is. Connect to this ftp site with any ftp client and try to delete this file.

===
Karlis
ECDL; MCSA

 

[jaapengel79]

@Itsp1965:

Yeah it is a pain file was not encrypted btw.

@Karlisi:

Thanks, good idea. FTP is already enabled on this server though it's using a different directory/disk. I'll create a new ftp directory pointing to the corrupt file dir and try to delete it that way. Will keep you posted.

 

[jaapengel79]

@Karlisi:

Tried, but alas, to no avail. I used FTP Commander and it also said that the file could not be found... though it was listed as ^&510L~1 this time (with trailing ^-thingie). Tried both the 'MS-DOS' directory listing as well as the Unix way; both didn't work.

Right now I'm trying the chkdsk /c /i /f, the machine was scheduled for a reboot today anyway. My colleague did a chkdsk /f this morning and though Windows did fix something in the MFT, the file was not corrected..

 

[jaapengel79]

The chkdsk /c /i /f took over 2,5 hours to complete (!!) but didn't solve the issue either

 

[jaapengel79]

Defrag also didn't resolve anything... file is still there, and still can't be (re)moved or renamed.

 

[itsp1965]

well Jaap, I didn't want it to come to this but have you considered using a sector editor something like Diskprobe in order to rename the file to something "windows friendly" It's a bit drastic but if you really want the file removed.... Be very careful though in using it.

 

[jaapengel79]

I did actually consider that, but couldn't find a suitable disk editor. Thanks for the tip for diskprobe, don't know that one but I've got the feeling it might work..

And well, the customer wants it removed, therefore I want that too

Currently we've got other pressing issues so it might take me some time to follow up on that one. Thanks for the tip anyway and I'll post as soon as I can.

 

[Lemon13]

did u try to boot from linux live-cd with ntfs support and delete it then?

 

[jaapengel79]

Hi Lemon,

No haven't yet.. the server is on a remote site and haven't had the time to go there physically yet (currently in the process of some serious outage on other machines).

Not sure which Live CD to use either though, I'd need a CD that will support the ServeRAID adapter in the machine (don't know exactly what hardware, probably a 4Lx or so). Anyway, Linux itself can't delete the file through SMB because doesn't accept the leading \& thingies..