Beware of NTFS drives shared with Windows!

NTFS is an undisclosed secret proprietary file format created by Microsoft for its Windows operating systems.

In the distant past, Linux couldn't read nor write to NTFS drives. Some Linux programmers attempted to reverse engineer NTFS to allow us to read and write Windows hard drives.

This breakthrough was an important one, as NTFS is the only relatively modern filesystem that works on both Windows and Linux.

The problem is that this implementation, while good enough, is not 100% complete. There are some things that Linux do to NTFS drives that Windows wouldn't do and vice-versa. Practical result?

When plugging in an NTFS drive that Linux "messed with", the windows user is sometimes met with scary warnings like this:

picture

If it only happens with you and happens too often, it's quite easy for someone to get scared and not trust you. In a professional setting, it might make you look unprofessional.

The second problem is that the Linux repair tools for NTFS drives are not as good as Microsoft chkdsk "scan and repair" that only runs on Windows, it is especially relevant if you have a "complicated" problem with NTFS drives. But Linux can still do basic repair on NTFS drives if needed.

Thirdly, it's possible that Windows or Linux might end up corrupting the drive. In practice, the probability is very low, and it has probably not happened too often, but the potential is there, especially when you consider that both OS don't have the same implementation of NTFS.

Solutions

  1. Backup, backup, backup, always. We never know.
  2. Using Microsoft scan and repair tool in a Windows virtual machine or dual boot to either fix damaged drives or suppress warnings.
5 Likes

I moved this to Tutorials & Guides as a bit better fit.

The Chat about Zorin has become a bit of a catch-all, though understandably so.

On the other hand just to be fair if you have all your drives .... internal ..... external and thumb formatted to Ext4 you will sometime or other find a file folder called Lost&Found on your system .... this folder can't as far as I know be removed even with the Root command and is not recommended by anything I have read for you to do so ....

I have about 30 GB in this folder and what few files I was able to remove were reinstalled the next time fsck ran ..... I might add this is the way it is designed to operate .......

I now have this folder on 5 different HD's and the only way I have found to remove it from a drive is to format it to NFTS .... even my 64 GB thumb drives had it on them until I formatted them back to Fat32 ....

3 of my drives are external and used for back-ups and other duties but all three have the Lost&Found folder of 30 GB on them .....

Spent the last 2 weeks trying to find a solution to at least remove it from the external drives rather than reformat to NTFS ...... but so far nada ..... thank god they are all of the 1 TB size except one brand new one of 2 TB .... as soon as I formatted the new 2 TB drive from NTFS to Ext4 the Lost&Found folder appeared .....

So my conclusion is that NTFS does have it's place on Linux and as I no longer have Windows installed or dual booted on my laptop I don't worry about what will or will not run on Windows any more .....

3 Likes

Hello, thanks for the information. I'm aware that NTFS is a proprietary file system, and I've seen messages like this in the past (moving from Linux back to Windows) What can I do to use NTFS in Linux only for storing data, and I will have a Win 10 USB drive just in case. Because I'm planning to definitely moving to Zorin, MS tired me with the things they do in recent years (Win11, TPM requirement, ads, subscription for everything, etc) and I want to do things right

1 Like

If dual booting with Windows 11 there is now the issue of the August update from Microsoft that would prevent you from booting into GNU/Linux. Shims for Ubuntu are due to be implemented and hopefully this will feed through to Zorin. So until that happens, this video is a bit dated:

2 Likes

Hello, I don't like dual booting so much, I prefer testing with full install, now I disabled these fast boot, fast startup and secure boot (what I doubt they have a benefit on Linux)

1 Like

Hey there! I feel you! Nothing like discovering the lost+found folder has taken over your drives like a squatter. 30 GB? That’s not a folder, that’s a full-blown tenant refusing to pay rent! Unfortunately, it’s not just there to annoy you, it’s actually a part of ext4's built-in safety net.

If I found 30 GB of data in lost+found, I’d be more than a little worried about how the hard drive was still running. That’s a sign that something is seriously wrong under the hood. I’d be gearing up to run every test I could think of, even a run with memtest86 to rule out any memory issues on my PC.

And it’s super important to remember this: lost+found isn’t a temp folder or a glorified recycle bin. It’s damage control. It’s where the filesystem dumps bits of files when it can’t figure out where they belong anymore, like a digital lost-and-found for scrambled data. If your fsck keeps throwing stuff in there, it’s because the filesystem is basically waving a white flag and saying, "I can’t sort this out." The filesystem is sad, it is a sign of despair.

Switching to NTFS won’t fix this, it just hides the problem without solving it and it may bring in a new set of issues. The real fix here is to find out what’s causing all this damage in the first place.

Make sure your drives are properly unmounted, check their health, and keep your system in good shape.

Ext4, or other native Linux filesystems like BTRFS, are usually the best choice for Linux unless you specifically need compatibility with other operating systems or have a really niche reason to switch.

1 Like

USB sticks are usable in a pinch, but we have to remember that they can be slow and clunky at times, depending on what you are doing.
Even "slow" hard drives will be considerably faster than most budget usb sticks.

Ideally, it would have been better to have a spare hard drive, but it's not always needed, especially if your usage is very light and rare. You don't need the fastest nvme ssd on the planet just to open notepad, or to update the firmware of a device, once in a while.

If you wanted a generic rescue os, most live Linux distributions can do the job on a USB stick, and are probably more adapted to your use case.

If you are worried about compatibility and need Windows for specific apps, a virtual machine can be adequate for light usage depending on your PC. For example, if you need to send a document using a proprietary Windows-only format from time to time, a virtual machine can do the job.

A virtual machine won't be adequate for intensive usage such as Windows-only games, or Windows-only CAD software (with a few exceptions, of course). In these cases, you really need a Windows install on a hard drive or SSD.

If you are talking about wanting to format your /home partition as NTFS, I strongly advise you against it, because NTFS doesn't support the Unix permission systems and it can cause all kinds of problems.

It would be better and simpler to format an external hard drive as NTFS by using gparted, gnome disks, the nautilus file app, or simply installing Windows on the external hard drive.

If you want to encrypt this external hard drive in a cross-platform way, you can use Veracrypt.


To create a bootable Windows USB

Well, in the past Windows-to-go was the way to do it, but Microsoft discontinued it. Back in the day, Windows-to-go also didn't work on all usb sticks, it needed some specific "certified" Windows-to-go usb sticks.
So unfortunately, there is currently no "clean" and officially supported way to do it.

I have some ideas about some hacks that may allow it to be done anyway like installing Windows on virtualbox. Copying the VHD image to a Ventoy stick that has the VHD supported plugin, and boot. :warning: :warning: but I can't really endorse them because I haven't extensively tested them and I don't know if it works or if it may cause problems. You may venture down this path at your own risk :warning: :warning:.

To create a bootable Linux stick

Use your favorite software to create bootable Linux USB sticks. BalenaEtcher (works on Windows/Mac/Linux), or Rufus (Windows-only) are among the most popular ones to do this task.
After this, plug in your usb stick, press the correct F-key to choose your device to boot from in your BIOS, if necessary disable secure boot in your UEFI or BIOS.

To install Windows on an external hard drive

Boot the Windows installer medium, follow the steps and select the correct hard drive to be formatted.
You can find the Windows iso on Microsoft own website for free.

1 Like

Hello. I don't talked about /home on NTFS, it will be obviously on a Linux FS
I think of using 2 SSD: 1 with the OS, and other with /home (on Linux FS both, probably EXT4)
The NTFS HDDs will stay here for accessing files stored there only.

2 Likes

Yup, it will be likely to work without a hitch. As I said, in real life problems due to this are extremely rare, I have used NTFS drives without problems on Linux for a long time, and I am sure that I am not the only one.

Make sure to backup important data, just in case. Physical failure can still be a thing, regardless of what happens at the software level.

2 Likes

I think I made a mistake with the amount of actual disk space the lost+found folder has taken up ..... apparently it has set up appox 30 GB for itself but is only actually using 1.6 GB ..... not sure just why it thinks it needs 30 GB but it is what it is I guess .....

More confusing than ever ..... photo's to follow ..... as of now I have some 23 folders in the lost+found folder ..... some are empty and some contain very little bytes stored with the exception of the following .....

home - 12.7 GB
lib - 4.8 GB
proc - 140.7 TB .... **** photo to follow
sys - 1.4 GB
usr - 7.6 GB
var - 2.6 GB
swap file - 2.1 GB

As you can tell I have no earthly idea what I'm doing .... none of this makes sense to me anyway here are the photos .... folder in photo shown in root .....

When I right click on properties for the drive lost+found is on I get this .....

Folders in lost+find .....

Folder showing 140.7 TB .... I only have one drive that is more than 1 TB and it is an external USB and not plugged in ...... this looks like the correct amount of GB's not used on that drive ......

I would think about backups before anything else. How many other copies of this data do you have on other hard drives? 1 is the absolute bare-bare minimum, you should have at least 2 other copies. Even more is nicer.

In your own mind, consider this hard drive as completely untrusted. Act as if there was no data on it. That's why I strongly recommended at least 2 other backups, because with only one other copy, well... this copy has no backup.

So, if you were procrastinating on your backups, now may be the time.

How old are your drives?

1 Like

Laptop is about 5 1/2 years old running dual boot with Mint on the 265 SSD and Zorin 17 on the 1 TB .... not sure about the back-up as I have back-ups of both OS's .... I use Rescuezilla and all the back-ups I have have the same lost+found file folders on them which I know from experience is transferred to any new back-up I make ......

This is a 17 in Asus gaming laptop so I would expect the drives to be a bit hardy but you never know ..... the SSD was used to run Win 10 and for the past 3 years hardly used at all just a few weeks ago I deleted Win 10 and installed Mint on it ..... the drives make no noise and show no sings of slowing down if that means anything .....

Well, there are some tests you can do on your drives, but here's the thing: while it can sometimes prove that a drive has problems, it can also sometimes miss them. Some drives also have bad test results buy may still live a long life without problems.

And then you sometimes have test results that are messed up by buggy firmwares in the drives or manufacturers ignoring standards.

It also doesn't help that in practice, it's very hard, to not say impossible to actually prove that a drive has "no problems".

Old HDDs tend to fail slowly overtime (but not always!), whereas SSDs tend to fail spontaneously with few warning signs.

I always take all these tests with a pinch of salt.

If you are curious about falling down this rabbithole that can be complex at times (even for experienced users), you can download in your software center a GUI tool called GSmartControl (should be in both mint and zorin repos).
You can select your disk, and see all kinds of interesting things on it, and even try "self-tests". You can save the outputs of all of this to a text file, very fun stuff.

GSmartControl doesn't try to repair disks, it only watches at a distance.

1 Like

@Frog. Before this happened, did you suffer any power outs or unexpected shutdowns that could have caused corruption on the drive?
As Green52 has suggested, backup, backup, backup, and then run disk tests to try and diagnose any drive faults.
That folder showing as 140.7 TB is totally nuts.

1 Like

Thanks I'll give GSmartControl a try and see what it shows ......

That is what I do. However I will at some point be changing this option to have an Ext4 backup partition for Timeshift Snapshots.

Yes zab I had quite a few unexpected shut downs lately in fact I deleted Win 10 by mistake and tried to reinstall it with my back-ups until I totally screwed up my back-up drives with Win 10 on them .....

I also tried using various external drives converted to NTFS on Zorin 17 and wiped and reinstalled back-ups from Rescuezilla which some turned out to be a disaster .... so knowing me I'm sure I caused all this mess to begin with .....

Good news is I totally got rid of Windows ..... and I don't even have a disk to reinstall it if I wanted to ..... LOL

1 Like

That can play havoc with the File System and leave file fragments mid air with no registered address so to speak. Once you are sure you have safely backed up your stuff (at least twice), I guess fsck should be called on, to try and tidy up the drive, before returning it to active service.

I know they are not cheap, but if you reside in a area regularly hit by thunderstorms and random brown-outs and black-outs, maybe investment in a UPS (uninterruptable power supply) unit for sensitive electronic devices would be a good thing.

EDIT: I just re-read the thread and found this:

green52's sounds about right.
Sorry, I wasn't fully aware you had already resorted to fsck and that it was having problems making sense of the file debris.

Actually I have not tried anything with fsck I just read that if you do manage to delete any of the files or folders in the lost+found folder the next time fsck starts back up it will automatically reinstall those files and folders ..... so I guess I better read up on how to use fsck .....

Thanks for you help .....

1 Like