File not visible, but still taking up disk space

I'm trying to recover data from a failing hard drive. I've booted into Ubuntu and I'm using ddrescue to do this. The drive I'm recovering from is an old 1TB external HDD. The drive I'm recovering data TO is a known-good 2TB SSD, NTFS partitioned for use with my day-to-day OS, Windows 10.

After using ntfsfix and ntfs-3g to allow me to mount my 2TB SSD for readwrite access, I ran ddrescue. Roughly 900GB into the recovery it gave me an error saying it had run out of disk space. I had (foolishly) forgotten that it writes a copy of all the blocks of the hard drive, not just used ones.

While my drive only had ~700GB of info on it, ddrescue needed a full 1TB of space. I booted back into Windows and cleared some more space on my SSD, but I noticed that my .img file from ddrescue wasn’t appearing on the SSD. I have hidden files and system files visible, but it still doesn't appear. Weirdly, the hard drive still says it’s nearly full, even though now the files on it only come to about 700GiB.

I used WinDirStat and it can’t find what’s using the space. I booted back into Linux and used ls -al but the file doesn’t appear, and yet df still reports 89% usage.

Using xdiskusage I can see the missing space is taken up by (permission denied). Not sure what to do about this.

du reports only 799G of usage. k4dirstat reports only 797.51GB. xdiskusage is the only tool I’ve used that seems to be able to see the missing space.

How can I get this file back, or even just reclaim the space that it still seems to be taking up?

Joshua Walsh

Posted 2017-12-29T02:40:42.947

Reputation: 147

If you did a block copy and the destination is now “full” due to lack of space, your only real choice right now is to erase the destination disk and copy the data over again using a method that strictly copies data, and not just raw blocks. – JakeGould – 2017-12-29T03:02:11.633

I was copying to a file, not to a drive. I'm still happy to copy raw blocks, as I've deleted other files on the destination drive so that it now has enough space to hold the full block copy. The issue is, the previous recovery file isn't visible in the file system, but is still taking up space. So of my 2TB drive, ~800GiB is now unuseable. – Joshua Walsh – 2017-12-29T03:07:33.883

You probably shouldn't try to "fix" the failing drive before copying it with gddrescue (that's the one you used right?). And one of the biggest features of gddrescue is it's log, so you can continue recovering where you left off, why not just do that? – Xen2050 – 2017-12-29T03:18:11.290

I'm not trying to fix the failing drive. The stuff I deleted was from the destination drive, freeing space for the failing drive's copy. I tried to use the log, but it requires that you still have the partial .img file, which I don't. I'm really just trying to run the exact same ddrescue command again, but I can't now because the destination drive is nearly full due to a file that doesn't exist. – Joshua Walsh – 2017-12-29T03:20:12.113

1Ah, didn't notice that detail amid the multiple drives. So the whole recovering data & gddrescue is basically a red herring, the real problem is "my program wrote a big file and I can't find or delete it"? Did you run as root while checking? Root shouldn't see "permission denied". fsck? – Xen2050 – 2017-12-29T03:28:18.157

Bingo, I just included the ddrescue stuff to say how the large file was created. I ran du and k4dirstat as root, I don't remember for xdiskusage. I'll try that when I get home (in roughly 1 hour) – Joshua Walsh – 2017-12-29T03:40:05.603

1Run chkdsk /f on it, in Windows. – Appleoddity – 2017-12-29T04:55:51.780

Root xdiskusage results in the same output. fsck only works on ext2/3/4 by the looks. I'll try chkdsk /f next.

I thought maybe the space wasn't really used, so I used dd to write a large file to the drive. It bailed out after a couple hundred GB saying that drive is full, so the space definitely isn't useable. – Joshua Walsh – 2017-12-29T05:29:39.833

@Appleoddity, could you please post chkdsk /f as an answer? That fixed the problem. I feel a bit silly not trying that myself, but in my defense chkdsk has never done anything useful for me in the past. – Joshua Walsh – 2017-12-29T05:46:51.853

File not visible, but still taking up disk space

Answers