How do I repair a corrupted MFT on an NTFS partition?

Status
Not open for further replies.

henderson1977

Junior Member
Mar 18, 2005
7
0
0
Hi

I had a perfectly working Western Digital WD2000JB 200GB hard drive running 1 NTFS partition (not ideal I know!), storing media files (inc. AVI, MPEG, MP3, PDF, RAR, ZIP, EXE). It does not have an OS on it, Windows 2000 is running on my boot drive (Seagate 6GB).

Then one day I get an error in the Event Viewer:

Event ID: 55
Event Source: NTFS
Event Description: The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume <drive letter>:.

- AND I get an error when trying to access this partition
- AND Windows 2000 recognises the file system as "unknown" and 0 bytes

I have tried almost EVERYTHING (except format and start again!)
- ran chkdsk, but get error "corrupted master file table" - chkdsk is unable to read drive
- checked cables (hardware) connected fine
- recovery console doesn't allow access to the drive also, although 'fixboot' has allowed the drive to be recognised as an NTFS file system in Ontrack's EasyRecovery Pro software but not Windows 2000 or XP, hence is still not accessible! ('fixmbr' was useless too!)
- moved the hard drive into my Windows XP PC which recognises it with a "RAW" file system with 0 bytes and still cannot access it
- inspired by the use of the term "RAW file system", I'm using Ontrack's EasyRecovery Pro software to perform a "Raw Recovery" of the data from this drive, so far it has recognised 109GB (oh yes!) but will recover the data in folder organised by the file's extension, for example, all AVI files will be in a folder marked "?.AVI" and so on and each file will be marked "File001.AVI" and so on? so you can see this is not recovering the filename which means I will have to manually amend each and every file until all are named correctly - a very long job, but worthwhile perhaps (I'm losing my will!) - the only problem with a Raw Recovery is that it is limited to recovering only 200 file extensions, I have checked that it is not going to recover MPG, MPEG & RAR files to name but a few, however, I can add my own extensions but need to "enter the signature in hexadecimal format with a maximum of 8 bytes (ie. 1A 00 00 03 00 00 14 00). The signature offset should be zero relative and less than 512 bytes." Apparently I can use WinHex (www.winhex.com) to gather this information to generate the signatures for MPG, MPEG & RAR files, but so far have no succeeded (I'm getting errors when trying to create them!)
- my next step is to try an "Advanced Recovery" using Ontrack's EasyRecovery Pro software. This does not suffer the limitations or Raw Recovery and will try to recover all the data 'as was' (I should have tried this 1st but I ain't quitting an 8hr Raw Recovery half-way through!)
- I have tried another product called GetDataBack for NTFS which works in a similar way to Ontrack's EasyRecovery Pro software and did recognise 109GB of data that can be recovered.
- I have tried other products to repair the corrupted MFT (master file table) such as "Partition Table Doctor" but not having much luck.


:(My question is this? is there a way to repair a corrupted MFT (master file table) on an NTFS partition, instead of trying data recovery techniques? (It would say so much time having to rename files/folders after data recovery). If so, how? What software do I need? Or perhaps only a specialised data recovery company have the answer??? Any help appreciated!!

Thank you in advance.

Scott

P.s. I have bought another 200GB drive and will sure be employing a backup strategy as soon as I get my data back! ;o)
 

stevty2889

Diamond Member
Dec 13, 2003
7,036
8
81
I used a program called testdisk to successfuly repair a messed up MFT on an NTFS partition, it's free, so it can't hurt to give it a try..
 

henderson1977

Junior Member
Mar 18, 2005
7
0
0
Thanks for your reply.

I ran TestDisk 5.6 in a command prompt in Windows 2000 but it didn't even identify the corrupted drive/partition! I can only see my other 2 (working) hard disks. Am I doing something wrong?
 

henderson1977

Junior Member
Mar 18, 2005
7
0
0
:eek: Oops! I used TestDisk on my other PC by accident!

Well, TestDisk did recognise my corrupted partition... Analyse said the structure is OK but when I press P to list files I got "Cannot open NTFS filesystem: I/O Error"... when I press L to Load Backup I got "No backup found!"

Any ideas please?
 

meltdown75

Lifer
Nov 17, 2004
37,548
7
81
Hi Henderson1977, & welcome

My post isn't very helpful, I'm just wondering how & what happened to a seemingly functional drive? Also please list your full specs if you have a minute. Have you tried running a virus scan on the drive? Just curious. g/l
 

henderson1977

Junior Member
Mar 18, 2005
7
0
0
Hi Meltdown75

I have tried running a virus scan on the corrupted partition using Kaspersky ant-virus which ends very quickly (only found/scanned 7 sectors!) and the report is completely empty so not much help there! ;o(

Full Spec:
Windows 2000 SP4
Athlon 1.4
Epox EP-8K7A+ mobo
512MB RAM
1 x 6GB Seagate (boot) drive
2 x 200GB Western Digital WD2000JB (media + backup) drives
DVD-ROM drive
nVidia GeForce 1

My issue was first discovered when I couldn't access the drive in Windows and the event log showed Event ID: 55, Event Source: NTFS (see my first post above for full details). It appears I have a corrupt $MFT on an NTFS partition. I just need to find a way to repair the $MFT (master file table) so that I can access my drive again, then backup & format the drive again.

Thank you in advance...
 

meltdown75

Lifer
Nov 17, 2004
37,548
7
81
No problem. How long have you owned the drive, and do you have the latest BIOS for your mobo?

I don't know jack about $MFTs but just encouraging discussion of the problem. I don't visit this area of AT, but you may want to try the folks in the Highly Technical forum - perhaps this would meet the criteria for posting in there... good luck!
 

henderson1977

Junior Member
Mar 18, 2005
7
0
0
I've had the drive less than 6 mths, Western Digital's DataLife diagnostic tools conclude that the drive is physical ok, it is definitely a filesystem corruption, I just don't know how to fix a corrupted $MFT.

I installed the latest BIOS for my mobo recently, which helped big time actually, because the BIOS wasn't LBA enabled to read the drive/partition over 128GB - but it can now.
 

meltdown75

Lifer
Nov 17, 2004
37,548
7
81
Oh and BTW don't post this in Highly Techinical - sorry I mentioned that. I just made my first visit and read the disclaimer of sorts, and this or General Hardware is your best bet. Hopefully someone picks up on this topic and can give you some better assistance!!
 

henderson1977

Junior Member
Mar 18, 2005
7
0
0
I tried Restorer2000 which again only recognises a very small number of files. OnTrack's EasyRecovery recovery has worked the best for me so far, recovering 109GB of data using RAWRecovery. I have had in-depth discussions about the full extent of my MFP problems and suggestions on another forum...

http://pub50.bravenet.com/forum/4220517151/show/394675

If there is nothing that can be done, then I want to at least prevent this from happening again (the best I can anyway!)
:disgust:
My question is: Is there ANY backup software that can backup just the $MFT of a NTFS partition? I understand that if I backup everything, then I will not need to backup the $MFT, but I have limited space and thought I could just backup the $MFT for now until I get more storage to backup more. Is it possible and if so, how please?

Thank you kindly
 

jitinarora

Junior Member
Apr 7, 2005
1
0
0
I had a very similar problem when I messed up my hard drive while trying to install Linux (Debian specifically). I noticed that fixboot only made it worse. Apparently it overwrote the information in the partition boot record or some such place and Windows starting saying that my NTFS partition was a FAT32 partition and obviously couldn't work with it at all. I fixed the master boot record, the partition table and, to the best I could, the partition boot record. No luck. I then spent several days searching the internet, researching the problem and trying demo versions of programs. Here's what I found:

You have the best software that I am aware of - Ontrack Easy Recovery does a great job.
However, there is no software that will fix a corrupted $MFT or fix corrupted file structures, as far as I know.
Since you are able to use your drive from another computer, you might try the following: do a quick format on the drive using NTFS as the filesystem; now start Easy Recovery and choose Data Recovery -> Advanced Recovery, select the newly formatted partition, then Advanced Options, click tab Partition Settings and choose Ignore MFT, then OK. Click Next and after a long scan, Easy Recovery will show you a complete list of files that can possibly be salvaged. If the filesystem has not been completely trashed, then the filenames and folder tree will also be available and Easy Recovery will automatically restore them correctly to the location you specify. If that doesn't work, then Raw Recovery is the option of last resort.

Good Luck.
 

henderson1977

Junior Member
Mar 18, 2005
7
0
0
Thanks for your reply. I tried your suggestion early but again, only a small number of files were found to be recovered, just like an Advanced Recovery without specifying to ignore MFT. Thanks for your suggestion though, I appreciate everyone's time and effort on this, my biggest IT problem to date.

If anyone else has had an experience of backing up just the $MFT, please step forward. I thank you all.
 

sevenofnine69

Junior Member
Nov 1, 2012
1
0
0
I reimaged my drive c: under windows 7 and after rebooting, 1 of my external drives was missing.disk manager told me that it was offline, so i right clicked and turned it online...this is were I learned that it had suffered a collision during my reimaging of the main drive. Windows reported that it cannot read the drive and that I should format it. Since I have worked with computers for over 40 years I did not format it, I knew the data was there. The disk manager reported that the $mft was corrupted and this ntfs volume contained raw data. Unlike most data recovery programs I have, none of them handle raw data recovery. I googled under ``raw data recovery'' and found (EASEUS Data Recovery Wizard Professional 5.0.1) I pointed it to the drive containg raw data and it processed it and the reported 100% recoverable, next it created a raw $mft, and then an ntfs $mft , then a list of everything on the drive to choose from and began recovery. From my understanding of the nature of an $mft on an ntfs volume, it is structured completely different from a fat table and once corrupted it is brain dead and all data is left in the raw status. the down side is it took it 15hrs.
 

DPOverLord

Golden Member
Dec 20, 1999
1,980
1
86
I am running testdisk now to see if it will fix mine. My drive got all messed up sitting on the marvel & Micron controller on my gigabyte x58-ud5 rev 2 board
 

grrl

Diamond Member
Jun 21, 2001
6,204
1
0
Ah, another necro. It took me a moment to figure out why the OP was still running Win 2K.
 

DPOverLord

Golden Member
Dec 20, 1999
1,980
1
86
10hours later and testdisk could not fix the mft table and read teh boot sector was bad.Going to try EaseUS Data recovery to see if it works
 
Status
Not open for further replies.