Volume not cleanly dismounted
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
I had an external drive connected to my computer with a Veracrypt container mounted. The power was suddenly cut to my computer. Next time I attempted to mount the container I got the warning that it was not cleanly dismounted last time and may be corrupted. It attempted to repair using chkdsk but then said it couldn’t be repaired using chkdsk as the filesystem was exFAT and permanently corrupted. I’m wondering if this means my files on there are in any way damaged or corrupted? The files appear to still be there but I cannot confirm if they have been in any way damaged or corrupted by this, and don’t understand why it’s telling me it is permanently corrupted if it seems to still be working fine?
What actually happens when a Veracrypt volume is uncleanly dismounted? Does anything actually happen to the files on the volume is my main concern?
What version of Windows are you using on your PC?
Chkdsk tool incorrectly reports exFAT volume file system as corrupted in Windows 7 and Windows Server 2008 R2.
https://support.microsoft.com/en-us/help/2843376/chkdsk-tool-incorrectly-reports-exfat-volume-file-system-as-corrupted
Windows 10. However it was VeraCrypt in the first instance that said the volume was not cleanly dismounted and may be corrupted. I did subsequently mount it on macOS and it took a REALLY long time to mount after which there were no more warnings about not being cleanly dismounted and may be corrupted.
I'm really just concerned about the integrity of my files and whether they would have been altered or damaged in any way - the external drive I was using to transfer them was at the time the ONLY copy so I have no way to cross check if the files have in any way changed - does any of what has happened sound like it could have damaged, corrupted or altered the files on the volume in any way?
Anytime a disk drive loses power, especially when the drive is in the process of performing reads or writes, can result in corrupted or loss of files and/or a damaged filesystem.
For exFAT disks, open the command window as Administrator, the chkdsk command should be:
chkdsk H: /f /r
OR
chkdsk H: /r
Where H is the drive letter you mounted the volume in VeraCrypt.
When using the /r switch, the /f is implied. I like being explicit in case Microsoft makes a change to the switches.
Still having concerns about this.
IF it were corrupted - would I be unable to access any of the files on there? Because I still can access all of the files. My concern is whether any of the files were lost/altered/damaged - because I have no other copies to compare to verify - is this a possibility? Or with VeraCrypt IF I can still access all the files regardless of a corrupted file system warning after power failure - is the WORST case that simply anything I was working on at the time it lost power went unsaved?
Even with the VeraCrypt volume dismounted during the power failure, it is possible that damage occurred to the VeraCrypt container which would cause loss of data for the sectors that were damaged by the power loss.
Without backup copies to compare to the existing files, there is no way of knowing if any files have been lost or altered until you run the chkdsk command on the mounted VeraCrypt volume.
EDIT: Just beacause a file exists does not mean that the file will open correctly or once opened, does not mean that the data is still intact.
Last edit: Enigma2Illusion 2018-10-24
I tried to run the chkdsk command on the mounted veracrypt volume - it said do not have sufficient privileges to run this while the volume is in use - what can I do about this?
FYI I can still open the files correctly
Google search how to open a command window as administrator.
I ran the command window as administrator, it gives me this response every time I try what you said:
''The type of the file system is exFAT.
Chkdsk cannot run because the volume is in use by another process. Chkdsk may run if this volume is dismounted first. ALL OPEN HANDLES TO THIS VOLUME WOULD THEN BE INVALID. Would you like to force a dismount on this volume? (Y/N)''
What can I do?
You can use Microsoft's Process Explorer to discover which files are open or which applications are accessing the mounted volume. The applications can be third party application like antivirus/antimalware or Windows applications such as indexing service.
https://technet.microsoft.com/en-gb/sysinternals/processexplorer
It says:
''Both copies of the boot information for this volume are corrupt.
Chkdsk cannot continue.
An error occurred while examining the boot region.''
The strange thing is I tried the volume with Disk Utility on Mac and it said everything was fine.
I'm completely stumped.
I would Google search the error message to determine what does this error message mean and what are the troubleshooting steps to resolve the problem.
OR
If possible, would it be easier to create a new file container and mount the old file container to copy the files into the new mounted file container?
I've created a new file container to test it and get exactly the same result!
As I've said I've attached the volume to a Mac and used Disk Utility and First Aid to check it and it reports everything is fine and healthy.
I'm really just super paranoid about the safety of all my files on there. Would chkdsk check if they've been in any way damaged or altered or is it just checking the health of the volume? And can I rely on the result from Mac's Disk Utility to conclude it's all fine and no damage resulted?
I created a test file container as standard (no hidden volume) as exFAT.
I was able to successfully to chkdsk the mounted volume without any errors on my Windows 10 Pro version 1803 build 17134.376 using VeraCrypt 1.23 Hotfix 2.
Last edit: Enigma2Illusion 2018-10-29
Is there some reason to use chkdsk over MAC's Disk Utility? And does chkdsk actually check all of the files to confirm if any are damaged?
I do not know if there are advantages of using chkdsk vs MAC Disk Utility. You can Google search each utility to determine what checks they perform on the disk and/or files.
There is no disk utility that can check if the content of the files on a volume have been altered - this is impossible because a filesystem doesn't 'know' what should be inside a file, it only knows where this file is located on the disk. Any disk utility only checks the health of the volume and tries to correct corrupted filesystem structures.
If you want to actually verify that the content of some files has not been altered, you will need to compare the contents of these files against copies on some other reliable source (a backup). You can use software that generates and verifies checksums to make this process easier, but keep in mind that this is not an alternative to having a backup - checksums can help you quickly detect corruption, they will not help you recover from it.
Thanks for the continued replies. I think I've got to the bottom of this. The problem was because the container was on an external drive, once I moved the container onto the Windows drive I was able to run chkdsk consistently.
The original container continued to give me the same result - ''Both copies of the boot information for this volume are corrupt.
Chkdsk cannot continue.
An error occurred while examining the boot region.''
I did what you suggested, created a new container, copied all the files to it and then ran chkdsk - it said it scanned the file system and found no problems.
Now I have this result, exactly what can I be sure of? Does it mean none of my files were in any way damaged, altered or corrupted since before the power loss?
No. It just means that the filesystem was able to link to the file for the copy. As stated, without any backup copies to compare to the original files, you will not know if a file was corrupted.
Understood. But if I can open each of the files successfully then does that mean nothing is corrupted? It wouldn't be the case that any files would have been deleted or lost would they?
Being able to open a file does not mean that the data is still correct. You can have data corruption within the opened file.
A damaged filesystem can lose its link to a file resulting in a deleted/lost file or the filesystem can have orphan references to the missing file. The chkdsk would help resolve as best it can these issues that you were unfortunately unable to run on the original mounted file container.
In short:
Is it possible that a file contains corruption even though you can open the file? Yes.
Is it possible that one or more files are missing? Yes.
I created a test file container on my external drive as standard (no hidden volume) using exFAT. I was successful in checking the mounted volume on the external drive without any errors.
I am wondering if your external drive has damage. Have you chkdsk the external drive?
I understand what you're doing and I appreciate the detailed replies and words of caution.
However, can you tell me realistically how likely there was any damage or corruption in the scenario I described? I did a test on another drive with a VC container that I had a back up copy of, and deliberately uncleanly dismounted it, went through the same process and there was no file damage afterwards.
Since I have no other way of verifying the thing in question, can you tell me is this a little more doomsday speak or in most of the cases like mine will there be likely no damage?
I can only speak from my experience. I know that anytime you lose power to a computer, loss of files or corruption can occur to the data.
Some factors that would raise the risk of loss of files and data corruption in files are:
.
How likely is the data corruption, I cannot say.
Last edit: Enigma2Illusion 2018-11-02
In addition to my comments in the above post, if it were me, I would be concerned since you were unable to run the chkdsk due to the error that you posted.
https://sourceforge.net/p/veracrypt/discussion/technical/thread/6070f6b6be/#4be1
Also when you were able to run chkdsk on the original mounted volume, you got an error "Chkdsk cannot run because the volume is in use by another process."
https://sourceforge.net/p/veracrypt/discussion/technical/thread/6070f6b6be/#33dc
The power loss could have impacted both your external drive and the mounted VeraCrypt file container on the external drive.
Did you run chkdsk on the entire external drive and did it fix any errors?