[clue] NTFS logical structure corruption?

[dshaw at famece.com]

Hi all-- sorry if this isn't the right forum for this, but there's an
Ubuntu thread so I thought I'd give it a shot.

A couple months ago my daughter's XP machine got infected with a nasty
virus. After getting that all cleaned up, I discovered a folder/file on
the NTFS filesystem that I can't access. Not sure if it was due to the
virus or not. In any case, I'd like to delete it. XP won't let me enter
the enclosing directory at all, even as administrator, working with access
rights, etc.  I tried all the "sfc", "chkdsk", etc. approaches I knew of,
to no avail. I also tried some surface scanners, but none of them found
anything either.

So I booted the machine from an Ubuntu live cd, mounted the NTFS
partition, and found Ubuntu couldn't access the file either. Ubuntu lets
me enter the enclosing folder, but when I try to rm the file, I get an
"operation not supported" message.

Looking around the filesystem a bit, I noticed a fair number of normal
files (but not all) that have 2 hard links showing up on an "ls -l".
Scanning the disk for the 2nd occurrence of the inode number for several
files revealed nothing. Not sure if this is related or not.

I'm thinking the file system is logically corrupt somehow, but I tried a
few of the "ntfs..." tools on Ubuntu, and nothing changed any of this.
Does anyone know of any tools to repair (I think) the structure of an NTFS
filesystem. Thanks...

Dave Shaw