cgsecurity.org

I am currently trying to restore a NTFS partition of which the start of the patition has been overwritten. I rebuilt the boot sector and the mft using testdisk. Only some of my files showed up after the rebuild. However, a lot / all(?) of them are shown under undelete. I tried to undelete the deleted files, but again only a very small fraction gets copied. The testdisk log file is filled with

Couldn't open $Bitmap
and
Record is in use by the mft

I could not find any information on what this actually means. Can someone give me a hand?

Anyone got a pointer on what the log messages mean?

Info:
https://msdn.microsoft.com/en-us/librar ... 85%29.aspx
$Bitmap contains data about used and free space of your file system.
Chkdsk driveletter: /r might be able to repair a corrupted file system.
Note, chkdsk is a try to repair a file system bit it's not intended to recover data.

Fiona

Thanks for the link. I'll be trying some other tools, as I don't see a fundamental problem on why hardly any of the files can be restored, based on the information in the link. Maybe I'll be lucky.