Master File Table Corrupted - Any words of wisdom from the gallery?
-
I volunteered to help a friend of the wife's last week with computer problems. The workstation belongs to a local church and contains years of business information. The workstation refuses to boot. Plugging the drive in as a slave starts chkdisk which reports that the master file table is corrupt, and aborts. The drive is not accessible through explorer, which reports the same error. I was able to recover all files on the disk using photorec however, it meant losing filenames and directory information. I am about to dig out the old XP CD's and try a repair. Has anybody had any luck fixing a corrupted master file table? Google results on this one look pretty grim. The sad thing is, this is a pro-bono job, and I already have a few hours in it. (not counting the 16 hours it took to recover the files to another disk) Here goes nothing....
"Go forth into the source" - Neal Morse
I'd have to make one more suggestion on this particular activity, should you ever have to do it again. Do yourself a favor and image this drive using FTK Imager (free from AccessData) or dd on a Linux live disk before formatting the drive. You could also use a forensics toolset, such as Autopsy (from the sleuthkit) to possibly examine the drive and determine why the $MFT file is corrupted. As another person posted, one of the records pertaining to the $MFT itself has been corrupted and could be recovered from $MFTMirr. To do a more thorough data recovery, you could have used a Linux live distribution (either against the live disk or the image had you made one) and installed foremost. Foremost is more configurable as you can edit its config file and add in file headers that you would like to search for (PK for office documents and zip files, JFIF for jpg images, etc.). You can Google for file header magic numbers and find a pretty extensive list. Just some more food for though on the subject matter at hand. A great book explaining the NTFS file system and $MFT is Brian Carrier's File System Forensic Analysis.
-
I volunteered to help a friend of the wife's last week with computer problems. The workstation belongs to a local church and contains years of business information. The workstation refuses to boot. Plugging the drive in as a slave starts chkdisk which reports that the master file table is corrupt, and aborts. The drive is not accessible through explorer, which reports the same error. I was able to recover all files on the disk using photorec however, it meant losing filenames and directory information. I am about to dig out the old XP CD's and try a repair. Has anybody had any luck fixing a corrupted master file table? Google results on this one look pretty grim. The sad thing is, this is a pro-bono job, and I already have a few hours in it. (not counting the 16 hours it took to recover the files to another disk) Here goes nothing....
"Go forth into the source" - Neal Morse
Last time I had a BSOD from a corrupt NTFS filesystem, I used a Knoppix disk to fix it. Windows would blue screen when it tried to boot from the disk and if I put it in another system. I dug out a Knoppix DVD, booted from that & used the 'ntfsfix' tools to repair the filesystem. Booted the drive from Windows again, let it complete its own chkdsk & all then ran without trouble. If you're worried about corruption, you could always backup the drive from within Linux (assuming you have somewhere else to put it all).
The Pedant.
-
I'd have to make one more suggestion on this particular activity, should you ever have to do it again. Do yourself a favor and image this drive using FTK Imager (free from AccessData) or dd on a Linux live disk before formatting the drive. You could also use a forensics toolset, such as Autopsy (from the sleuthkit) to possibly examine the drive and determine why the $MFT file is corrupted. As another person posted, one of the records pertaining to the $MFT itself has been corrupted and could be recovered from $MFTMirr. To do a more thorough data recovery, you could have used a Linux live distribution (either against the live disk or the image had you made one) and installed foremost. Foremost is more configurable as you can edit its config file and add in file headers that you would like to search for (PK for office documents and zip files, JFIF for jpg images, etc.). You can Google for file header magic numbers and find a pretty extensive list. Just some more food for though on the subject matter at hand. A great book explaining the NTFS file system and $MFT is Brian Carrier's File System Forensic Analysis.
Thanks Vachaun22! (and all others who replied) Great advice and well thought out response. I shall file it away for future reference, as it was a little late for this job. In this case, I had recovered all the files on the disk, albeit without the filenames and directory structure, which is more than the A+ dude at the computer repair shop could do for them. At least I can give them back a working computer (fresh XP Home install) and a couple of sets of DVDs with the data files. They can sort out what's important. I am trying to create a filtered data set by searching on known file extensions and copy/pasting into folders but keep running into an error 'Cannot copy file: Cannot read from the source file or disk'. This is on XP and it happens when I try to copy all files found in the search. It seems to be one file out of hundreds that causes the error, but it doesn't tell me which one, and nothing gets copied!
"Go forth into the source" - Neal Morse
-
Thanks Vachaun22! (and all others who replied) Great advice and well thought out response. I shall file it away for future reference, as it was a little late for this job. In this case, I had recovered all the files on the disk, albeit without the filenames and directory structure, which is more than the A+ dude at the computer repair shop could do for them. At least I can give them back a working computer (fresh XP Home install) and a couple of sets of DVDs with the data files. They can sort out what's important. I am trying to create a filtered data set by searching on known file extensions and copy/pasting into folders but keep running into an error 'Cannot copy file: Cannot read from the source file or disk'. This is on XP and it happens when I try to copy all files found in the search. It seems to be one file out of hundreds that causes the error, but it doesn't tell me which one, and nothing gets copied!
"Go forth into the source" - Neal Morse
Divide and conquer the listing of files to copy. Rather than try to do them all at one fell swoop, grab only a portion of the files at a time. Then when you get a group of files that won't copy due to the disk read error, then work at that group of files one at a time (or break the group up to a smaller group), rinse and repeat. At some point you will narrow it down to the file(s) that are causing you a problem. If the disk is failing, you may get read errors. You could try dd-rescue at that point (google for samples of the command) to image the disk to a known good disk. dd-rescue will time out before the hard drive read times out, so it can continue by skipping the block and marking it. Once the forward image is completed, it revisits the blocks that it could read, and reverse reads those blocks sector by sector. Many times it can recover 7 of the 8 sectors in a 4K block. Granted, the file is still corrupt, but you may have recovered enough of the file for parts of it to be useable.
-
Tried it. I finally dug out the XP Home CD and have given up hope on anything but a re-install so that I can at least give them the computer back running with their recovered data on DVDs. Formatting now,... I suppose I am past the point of no return. With any luck all they really need are the quickbooks files and office documents.
"Go forth into the source" - Neal Morse
kmoorevs wrote:
Formatting now,...
Either the disk failed, or they turned off the computer without shutting it down. If you even suspect the disk failed, replace it. Microsoft is so poor at dealing with failed disks that it can't ever be reliable on anything but a fully functioning one (XP let me install it to a drive where the heads were glued to the platter and never once squawked about any kind of problem.. it didn't even take longer to install). Oh, and make sure you format it for NTFS :)
We can program with only 1's, but if all you've got are zeros, you've got nothing.
-
I volunteered to help a friend of the wife's last week with computer problems. The workstation belongs to a local church and contains years of business information. The workstation refuses to boot. Plugging the drive in as a slave starts chkdisk which reports that the master file table is corrupt, and aborts. The drive is not accessible through explorer, which reports the same error. I was able to recover all files on the disk using photorec however, it meant losing filenames and directory information. I am about to dig out the old XP CD's and try a repair. Has anybody had any luck fixing a corrupted master file table? Google results on this one look pretty grim. The sad thing is, this is a pro-bono job, and I already have a few hours in it. (not counting the 16 hours it took to recover the files to another disk) Here goes nothing....
"Go forth into the source" - Neal Morse
This product has helped me in the past. R-Studio http://www.data-recovery-software.net/[^] I have used it to even recover files on a Raid 5 volume, I don't know what their cost is now, but if you need the files, chances are they can recover it. Good luck.
-
Hi, there's MFT mirror afaik (on the disk itself - $MFTMirr). It should contain few backup records from MFT. Mainly the MFT itself. It might be, that corrupted is only the information about MFT (volume information which contains MFT location). If I can recommend you a software I would use GetDataBack for NTFS. Anything else would require more detailed analysis of this disk contents. To see what's there and what's not. Which entries are corrupted or if structure is corrupted itself. I'm off to bed now. :) regards, Kate P.S.: If you want to dig deeper, try this program. Disk Editor[^]
I love GetDataBack as it has saved my ass a couple of times.
CEO at: - Rafaga Systems - Para Facturas - Modern Components for the moment...
-
I volunteered to help a friend of the wife's last week with computer problems. The workstation belongs to a local church and contains years of business information. The workstation refuses to boot. Plugging the drive in as a slave starts chkdisk which reports that the master file table is corrupt, and aborts. The drive is not accessible through explorer, which reports the same error. I was able to recover all files on the disk using photorec however, it meant losing filenames and directory information. I am about to dig out the old XP CD's and try a repair. Has anybody had any luck fixing a corrupted master file table? Google results on this one look pretty grim. The sad thing is, this is a pro-bono job, and I already have a few hours in it. (not counting the 16 hours it took to recover the files to another disk) Here goes nothing....
"Go forth into the source" - Neal Morse
If the MFT is corrupted it means you can't access any of the files in there by default, as the MFT holds pointers to where the files are on the disk. You need some file recovery software, if you need to recover some important data. I had good track with GetDataBackNTFS. which goes on the disk cluster by cluster and tries to make sense where files start and end. Since the computer is old, there is a high chance that the region is affected by a bad sector, and given the nature of rotating media, there is a higher chance that the bad region will grow in size. If you have the standard single c:\ partition, then I would strongly recommend running a bad block finder on the disk and if it can't read from the sector (even though the data is corrupted) replacing the disk with a new one, since that means you have damage to the beginning of the disk. This damage will probably grow in size with age and will affect other important bits, such as the master boot record (making partitions unreadable) or the track that has the disk firmware, and geometry. ( making the whole disk unmountable)
-
If the MFT is corrupted it means you can't access any of the files in there by default, as the MFT holds pointers to where the files are on the disk. You need some file recovery software, if you need to recover some important data. I had good track with GetDataBackNTFS. which goes on the disk cluster by cluster and tries to make sense where files start and end. Since the computer is old, there is a high chance that the region is affected by a bad sector, and given the nature of rotating media, there is a higher chance that the bad region will grow in size. If you have the standard single c:\ partition, then I would strongly recommend running a bad block finder on the disk and if it can't read from the sector (even though the data is corrupted) replacing the disk with a new one, since that means you have damage to the beginning of the disk. This damage will probably grow in size with age and will affect other important bits, such as the master boot record (making partitions unreadable) or the track that has the disk firmware, and geometry. ( making the whole disk unmountable)
The disk has a brand new OS, actually better than the original, without the dell crapware. I still need to get the 3K images (mostly bs, but I'm certainly not about to look at each one to figure it out) all together in a new folder and copy/paste is failing since one or more in the group are caueing read errors. Think I'll put together a little VBScript to do the job! ahem...sounds like an appropriate place for on error resume next! :laugh:
"Go forth into the source" - Neal Morse
-
The disk has a brand new OS, actually better than the original, without the dell crapware. I still need to get the 3K images (mostly bs, but I'm certainly not about to look at each one to figure it out) all together in a new folder and copy/paste is failing since one or more in the group are caueing read errors. Think I'll put together a little VBScript to do the job! ahem...sounds like an appropriate place for on error resume next! :laugh:
"Go forth into the source" - Neal Morse
That will be cumbersome after the fact. Notes to self. - Recover first, reinstall later, since reinstall will usually overwrite the actual data on the platter. Whereas quick format/delete just erases the index in the table, leaving the actual data intact, until new space is needed for new physical write. - New windows does not mean healthy drive, it just means new operating system on potentially old broken drive. - Conventional tools usually give up on the first problem/error. Unconventional tools ( data recovery tools) will often employ aggressive rereads/ and/or reads in reverse, use available checksums or known patterns, skip missing/broken sections to try to resurrect as much of the data on a damaged disk as they can.