I just lost 44 GB of data that I downloaded in the past two hours. My PC started to get laggy and it got stuck so I just shut it down believing that all will be well since the data has already been written to disk…
That’s not how PCs work. Once you’ve downloaded the data, it’s on your hard drive, not the RAM. This sounds very much like you’ve experienced hard drive failure.
Well, depending on the drive and if this 40gb of loss was one file and how quickly he shut down after saving the data, it actually is possible. Some drives will use write cache to speed up the perception of the write speeds of a drive where new data is very quickly written to a faster cache, then is transferred a little more slowly to permanent storage. But this write cache isn’t always power loss protected. If you do a normal shut down, the computer waits until any data on the write cache gets transferred to permanent storage before it fully shuts down. If you just nix the power though, that data could be gone, and if it was part of a larger file, it would corrupt that file.
Edit: Here’s a source to back up my info. Though, it looks like it may actually be an os feature instead of a drive feature. https://www.iolosystem.com/resources/disk-write-caching.html
Ah! Interesting.
This is incorrect too. The OS buffers writes to drives for performance, a portion is kept in memory and flushed to disk when possible. A sudden power loss can easily result in a partial write.
That said a drive failure is also possible.
The filesystems journal will be the source of truth.
44 GB over two hours, though? If it were the last couple GBs in the last maybe 10 ten minutes, but unless the OP is running a PC from 2002, the data should have already moved from RAM to disk in that time.
But yeah, the filesystem journal will explain what happened there.
I agree unless it was a single file download.
The buffer is flushed every 6 seconds. OP was pulling down 44GB/7200sec = 6MB/s. OP would have only lost 36MB to disk caching.
If it was a single 44GB file and OP turned off less than 6 seconds after it finished, then it could have been caching. But that’s very unlikely.
deleted by creator
Mem cache is definitely still a thing. Non-volatile storage has gotten faster in recent years but it’s still not as fast as RAM. Depending how his system is configured, data loss is definitely possible.
That being said, unless it was one big file and he lost critical data that made the file readable (say an MBR on a disk image) there’s no way he should have lost 44GB.
It actually might be, because now a magic file appeared on my hard drive (a file that was once deleted) that I can’t delete. When I try to delete it, even with admin rights, it says
No such file or directory
Sounds more like a hard drive problem than a power problem.
What filesystem are you using? Filesystems should be crash consistent these days.
A modern filesystem cannot make magic happen, if the data was in the process of being written it is still in memory and lost.
Only copy-on-write filesystems are safe here as they don’t overwrite old data. NTFS is not safe.
If 44GB had not been flushed to disk yet then that implies that OP has >44GB of RAM in use as page cache. SSD write caches are only around 2GB while HDD write caches are not more than about 512MB. I don’t know how much RAM OP has but this seems unlikely to be the case.
I would bet on one of the following:
- the transfer was still in progress when the system was halted
- the transfer was not a network download but actually a copy from another locally mounted partition and the OS was still transferring data
- the filesystem driver did write that 44GB to inodes but didn’t link the inodes into the filesystem yet, in which case the filesystem’s fsck tool should be able to recover data blocks that were already written
- OP is using a filesystem which does not use either journaling or COW (eg. FAT32) in which case the data which was written but not linked into the filesystem is lost as orphaned inodes.
3 & 4 being the reason I was asking what filesystem OP is using.
Only copy-on-write filesystems are safe here as they don’t overwrite old data.
COW filesystems make no difference in this case since this was not data overwriting an existing file. They still have the same behavior with write caching in the OS and on the drive and still require a tool (eg.
btrfs-check) to recover unlinked changes in the event of a crash.NTFS is not safe.
NTFS is a journaling filesystem and is crash-consistent. That doesn’t mean it can do “magic” if the data hasn’t hit the disk, but it does mean that it won’t corrupt the filesystem or lose data which was already written in the case of a crash.
I didn’t mean OPs case.
Journaling just means it knows what failed. Without CoW you will corrupt data.
My filesystem was NTFS
If you haven’t tried it already, you could run
chkdskto see if the filesystem needs repairing. You can do it from the command-line[1] or also through the drive properties > Tools > Check button.chkdsk /f Fixes errors on the disk. The disk must be locked. If chkdsk cannot lock the drive, a message appears that asks you if you want to check the drive the next time you restart the computer.
1 ↩︎
The question is what can you do when it is in that situation?
Wait it out, or fix whatever is making it “laggy”, like a program using all the CPU time.
And OP can probably recover that data with standard recovery tools, if they haven’t continued using the PC. Or just redownload it, since recovery would take longer than two hours.
The 44 GB of data that got lost consisted of 191 files each around ~220 MiB in one single folder. I used
testdiskto inspect my drive and I couldn’t find the data…
Do you have a RAID array of some sort? As other pointed out it’s odd for so much data to be lost with just a hard reboot.
I have no clue what a RAID is to be honest. I was using a VM with 6 GB RAM to do some work in another operating system and passed through my physical hard drive (Host to Guest) to write the data on when suddenly my VM got stuck.
Almost all of the data is certainly *somewhere *on the hard drive. It sounds like it was a write to the file system records that lost the record of where they are.
I mean it’s definitely not recommended, but sometimes you have no choice. As others have mentioned, your situation sounds unique.