How do I repair a corrupted MFT on an NTFS partition?

[henderson1977]

Hi

I had a perfectly working Western Digital WD2000JB 200GB hard drive running 1 NTFS partition (not ideal I know!), storing media files (inc. AVI, MPEG, MP3, PDF, RAR, ZIP, EXE). It does not have an OS on it, Windows 2000 is running on my boot drive (Seagate 6GB).

Then one day I get an error in the Event Viewer:

Event ID: 55
Event Source: NTFS
Event Description: The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume :.

- AND I get an error when trying to access this partition
- AND Windows 2000 recognises the file system as "unknown" and 0 bytes

I have tried almost EVERYTHING (except format and start again!)
- ran chkdsk, but get error "corrupted master file table" - chkdsk is unable to read drive
- checked cables (hardware) connected fine
- recovery console doesn't allow access to the drive also, although 'fixboot' has allowed the drive to be recognised as an NTFS file system in Ontrack's EasyRecovery Pro software but not Windows 2000 or XP, hence is still not accessible! ('fixmbr' was useless too!)
- moved the hard drive into my Windows XP PC which recognises it with a "RAW" file system with 0 bytes and still cannot access it
- inspired by the use of the term "RAW file system", I'm using Ontrack's EasyRecovery Pro software to perform a "Raw Recovery" of the data from this drive, so far it has recognised 109GB (oh yes!) but will recover the data in folder organised by the file's extension, for example, all AVI files will be in a folder marked "….AVI" and so on and each file will be marked "File001.AVI" and so on… so you can see this is not recovering the filename which means I will have to manually amend each and every file until all are named correctly - a very long job, but worthwhile perhaps (I'm losing my will!) - the only problem with a Raw Recovery is that it is limited to recovering only 200 file extensions, I have checked that it is not going to recover MPG, MPEG & RAR files to name but a few, however, I can add my own extensions but need to "enter the signature in hexadecimal format with a maximum of 8 bytes (ie. 1A 00 00 03 00 00 14 00). The signature offset should be zero relative and less than 512 bytes." Apparently I can use WinHex (www.winhex.com) to gather this information to generate the signatures for MPG, MPEG & RAR files, but so far have no succeeded (I'm getting errors when trying to create them!)
- my next step is to try an "Advanced Recovery" using Ontrack's EasyRecovery Pro software. This does not suffer the limitations or Raw Recovery and will try to recover all the data 'as was' (I should have tried this 1st but I ain't quitting an 8hr Raw Recovery half-way through!)
- I have tried another product called GetDataBack for NTFS which works in a similar way to Ontrack's EasyRecovery Pro software and did recognise 109GB of data that can be recovered.
- I have tried other products to repair the corrupted MFT (master file table) such as "Partition Table Doctor" but not having much luck.


My question is this… is there a way to repair a corrupted MFT (master file table) on an NTFS partition, instead of trying data recovery techniques? (It would say so much time having to rename files/folders after data recovery). If so, how? What software do I need? Or perhaps only a specialised data recovery company have the answer??? Any help appreciated!!

Thank you in advance.

Scott

P.s. I have bought another 200GB drive and will sure be employing a backup strategy as soon as I get my data back! ;o)

[codered6651]

Hello and Welcome to PCMECH, from what I have read on the microsoft site about this there is a repair solution albeit not a guarantee that it will work. If you'd like to read more on this here is the link that I was refering to http://support.microsoft.com/kb/176646. I hope you have luck in getting this solution to work for you. Maybe someone else has a better solution.

[henderson1977]

Hi there & thanks for the reply

I have investigated your suggestion among others with no joy. I have had in-depth discussion about the full extent of my MFP problems and suggestions on another forum...

http://pub50.bravenet.com/forum/4220517151/show/394675

If there is nothing that can be done, then I want to at least prevent this from happening again (the best I can anyway!)

I recovered most of my data using EasyRecovery's Ontrack to do a Raw Recovery. My question is: Is there ANY backup software that can backup just the $MFT of a NTFS partition? I understand that if I backup everything, then I will not need to backup the $MFT, but I have limited space and thought I could just backup the $MFT for now until I get more storage to backup more. Is it possible and if so, how please?

Thank you kindly

[eXe]

I think that this software could help you.
Anyway,you can ask this question to one of their supporters whose support nas no equal

http://www.wilderssecurity.com/forumdisplay.php?f=64

http://www.acronis.com/homecomputing...cts/trueimage/
http://www.acronis.com/homecomputing...oad/trueimage/


Good luck!!!

[henderson1977]

Thanks for the reply, eXe

I will look into Acronis TrueImage. I have read about the product on the website which does say it backs up system files, partitions among other things.

But do you know if it has the ability to backup (& restore) the MFT (Master File Table) of an NTFS partition please? This is crucial.

Thanks.

[thefultonhow]

If you've recovered your data by reading in RAW mode, I would just reformat and reinstall Windows. If you couldn't recover all of your data by reading at that low level, it's possible that the drive is going bad and you'll have to get a new one. I would download a drive fitness test from the manufacturer of the drive and check it, and if it's okay, you can reformat.

[=Maverick=]

Originally Posted by henderson1977 I will look into Acronis TrueImage.... But do you know if it has the ability to backup (& restore) the MFT (Master File Table) of an NTFS partition please? This is crucial. Thanks.

I use it and yes i can confirm it does.

Originally Posted by thefultonhow If you've recovered your data by reading in RAW mode, I would just reformat and reinstall Windows.

Thefulton, you're giving very bad advice. The HDD is bad - why would you suggest that he reformat and re-use it? Besides, Henderson already stated he's using the drive strictly for data and has no OS installed on it. Read his original posting again.

[thefultonhow]

Originally Posted by =Maverick= Thefulton, you're giving very bad advice. The HDD is bad - why would you suggest that he reformat and re-use it? Besides, Henderson already stated he's using the drive strictly for data and has no OS installed on it. Read his original posting again.

My bad for not reading the first post carefully enough and thus not noticing that he wasn't running Windows on it... But a corrupted MFT is not necessarily indicative of a bad drive, and in case it is, I explicitly recommended running a drive fitness test to check for that possibility. I wouldn't call that bad advice.

Also, there are much better ways to correct somebody than saying "You're giving very bad advice." We try to keep a civil tone here at PCMech, and I don't consider belittling somebody's suggestion to be civil.

[=Maverick=]

Originally Posted by thefultonhow But a corrupted MFT is not necessarily indicative of a bad drive...

Well then what would you consider it to be? To me it definitely suggests the drive is headed south and I wouldn't trust it for any of my important data.

Originally Posted by thefultonhow I explicitly recommended running a drive fitness test to check for that possibility. I wouldn't call that bad advice.

I was referring to the fact that you suggested to him that he reformat and reuse the drive. Now that I definitely do not agree with. A 200 Gigger with a corrupted MFT? Whats the likelihood that it will fail again on him again? I wouldn't risk anything that large (200 GB) to safely hold all my data and not cause me grief again.

[thefultonhow]

Originally Posted by =Maverick= No? Then what would you consider it to be?

I'd consider it to be indicative of a corrupted MFT. My brother's MFT got corrupted when he tried to repartition his drive using PartitionMagic. That doesn't mean his drive is bad. Other factors can also corrupt an MFT -- all you need is a well-placed electromagnetic wave to wipe out a few bits of data and corrupt the larger drive.

Now, I don't deny that a corrupted MFT can be indicative of a hard drive that is going bad, and that's why I recommended he run a drive fitness test. But I wouldn't trash an expensive piece of hardware out of hand just because there's a remote possibility that it could be failing. I would verify that there is an imminent failure first.

Originally Posted by =Maverick= I was referring to the fact that you suggested to him that he reformat and reuse the drive. Now that I definitely do not agree with. A 200 Gigger with a corrupted MFT? Whats the likelihood that it will fail again on him again? I wouldn't risk anything that large (200 GB) to safely hold all my data and not cause me grief again.

That's all well and good, and you can disagree with advice on this forum, but there's no reason to essentially flame somebody for it. Please see the edit on my previous post -- PCMech is meant to be a forum for constructive advice, not for belittling people's ideas. If you thought there was a problem with my advice, you could have pointed out the problem just fine without saying, "You are giving very bad advice."

[=Maverick=]

Originally Posted by thefultonhow Also, there are much better ways to correct somebody than saying "You're giving very bad advice." We try to keep a civil tone here at PCMech, and I don't consider belittling somebody's suggestion to be civil.

Apparently you've got some very thin skin.

When I make a statement:
You're giving good advice/
You're giving bad advice...

That's called an observation - a statement of my opinion. Ya see how that works?

If I had said, you're a dimwit or a jackass or called you some derogatory names then that would be called flaming. Do you understand how that works ? Now I can't help it if you're just a boy or emotionally uncapable of handling some criticism.

The sooner you grow up the sooner you'll realize in the real world, people will not always present things in the picture perfect manner with roses and candies.

[=Maverick=]

Originally Posted by thefultonhow Now, I don't deny that a corrupted MFT can be indicative of a hard drive that is going bad, and that's why I recommended he run a drive fitness test.

And what piece of so called "drive fitness" test do you own or have tried in the past that is 100% accurate? Just because you have success running one piece of diagnostic software doesn't mean the HDD in question is safe to use.

[=Maverick=]

Originally Posted by thefultonhow but there's no reason to essentially flame somebody for it.

You're being absolutely ridiculous about this whole thing and somewhat of a crybaby. I just don't see where the accusation of a flame is justified.

[thefultonhow]

Originally Posted by =Maverick= And what piece of so called "drive fitness" test do you own or have tried in the past that is 100% accurate? Just because you have success running one piece of diagnostic software doesn't mean the HDD in question is safe to use.

I'm not going to continue to reply to your other posts. I think I've wasted enough time on them and, especially at this point, that's what the mods are here for.

But as to the reliability of drive fitness tests -- I really don't see how 100% accuracy is a prerequisite for any tool. Nobody calls McAfee, Norton, Lavasoft, Webroot, etc. out and refuses to use them because their security tools don't find all the viruses and spyware there are to find. The point of any diagnostic tool is to give the user a good idea as to what probelms there are, and a drive fitness test does just that. They are produced by the hard drive manufacturers themselves and are used by those manufactuers as diagnostic tools, so I would trust them even if I hadn't found them to be effective in checking for problems the mutliple times I've used them in the past.

I will reiterate my advice to Henderson, because I believe it is sound -- and I will let him decide whether to take my advice or not, because it's his money and it's his data. Run Western Digital's drive fitness test. If the drive checks out okay, then I would say that it's safe to use. If not, you should throw it on the trash heap and buy a new drive, or into a box back to WD and get a replacement if it's under warranty.

[=Maverick=]

Originally Posted by thefultonhow I really don't see how 100% accuracy is a prerequisite for any tool.

It is that exactly type of thinking why i said you were giving bad advice.

Originally Posted by thefultonhow ....and I will let him decide whether to take my advice or not, because it's his money and it's his data.

And all i'm doing is giving Henderson another viewpoint, another angle to think about - Simply disagreeing w/ your posts doesn't mean it's a flame.

[Panama Red]

Ok folks, let's stick to the subject at hand and stop the personal disagreements. Your debate is doing nothing to answer the original question.

-------------moderator-------------

[HAL9000]

I know I've seen enough.

[henderson1977]

Well guys, after all is said 'n' done...

I had already run WD's drive fitness test a while back (wish I'd mentioned earlier now to save the 'domestic' between Maverick & TheFulton - oops!)... which confirmed the drive is fine, no errors/warning reported at all.

Also Maverick, I have to agree with TheFulton on the corrupted $MFT... because I've done some extensive research on this issue now which dismisses a physical hard drive problem. I read somewhere that it can be fatal if the $MFT becomes heavily fragmented, which could be my situation... I did have Diskeeper configured to "smart schedule" which basically means it defrags on the fly...although, the $MFT cannot be defragged while Windows is running & I can't remember if I ever did a boot-time defrag. However, I do remember configuring Diskeeper's FragShield to optimise the $MFT... could this have something to do with it perhaps?

Ultimately, the information I am looking for is: Can the $MFT be backed up, so that if this happens again, I can easily restore it? If so, what software do I need please?

Thanks
Henderson1977

[glc]

Can the $MFT be backed up

I don't believe so.

[thefultonhow]

Originally Posted by henderson1977 I had already run WD's drive fitness test a while back (wish I'd mentioned earlier now to save the 'domestic' between Maverick & TheFulton - oops!)

Well, that's certainly finished now, judging by the word under Maverick's name. I guess what you're trying to do here is make sure that this MFT debacle doesn't happen again... I doubt it will, but it seems like your best line of action if it does is just to run a data-recovery program. At this point you have GetDataBack -- although it's annoying to use, it's a very powerful data-recovery tool.

[henderson1977]

GetDataBack was one of the better data recovery tools I tried, but none cam close to the powerful RawRecovery in Ontrack's EasyRecovery software. It scans the drive in RAW mode, so it ignores any (previous) operating system(s) and recovers data based on file extension (.doc, .xls, .exe, etc..). It does that by creating a signature for each file extension, which is made up of a Hexadecimal (usually the header) and the offset. It recovered upto 200 of the most popular file extensions which was great but, I need to recover the following files: .rar, .iso, .bin, .cue, etc... So I used WinHex (www.winhex.com) to create a signature for each file extension that I wanted to recover.

I got far more data back using Ontrack EasyRecovery's RAWRecovery than all the other data recovery tools I tried (and I tried loads!).

I find it frustrating that there appears to be no way to backup JUST the $MFT, afterall it's just a database like any other. I really didn't want to have to backup all my data onto another 200GB hard drive, but if there's NO way to backup the $MFT then I have no choice because I do not want to run the risk of this happening again. Granted, it may be impossible to back it up while Windows is running, but there must be a way to back it up at boot-time or as read-only perhaps. Any further suggestions please?

[Carl Price]

Acronis True Image 8.0 will backup a windows xp installation including the mft., but I don't think it is capable of backing up that mft. alone.

[RamRom]

Originally Posted by henderson1977 GetDataBack was one of the better data recovery tools I tried, but none cam close to the powerful RawRecovery in Ontrack's EasyRecovery software. It scans the drive in RAW mode, so it ignores any (previous) operating system(s) and recovers data based on file extension (.doc, .xls, .exe, etc..). It does that by creating a signature for each file extension, which is made up of a Hexadecimal (usually the header) and the offset. It recovered upto 200 of the most popular file extensions which was great but, I need to recover the following files: .rar, .iso, .bin, .cue, etc... So I used WinHex (www.winhex.com) to create a signature for each file extension that I wanted to recover. I got far more data back using Ontrack EasyRecovery's RAWRecovery than all the other data recovery tools I tried (and I tried loads!). I find it frustrating that there appears to be no way to backup JUST the $MFT, afterall it's just a database like any other. I really didn't want to have to backup all my data onto another 200GB hard drive, but if there's NO way to backup the $MFT then I have no choice because I do not want to run the risk of this happening again. Granted, it may be impossible to back it up while Windows is running, but there must be a way to back it up at boot-time or as read-only perhaps. Any further suggestions please?

how do u use the winhex program to recover files?

[pam123]

RamRom this thread is nearly 2 years old.
To get your question answered start your own thread.