Bad MFT, Trying on Image

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bujen
Posts: 1
Joined: 08 Sep 2013, 05:57

Bad MFT, Trying on Image

#1 Post by bujen »

A 1TB WD disk, couldn't access anything on it. It had one partition only. Initial TestDisk check found bad MFT but could not repair it. Then I backed up and tried to recover the partiaion with ddrescue. But now the image shows different partition structure.
$ sudo fdisk -l

Disk /dev/sda: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x70712382

Device Boot Start End Blocks Id System
/dev/sda1 * 63 1953520064 976760001 7 HPFS/NTFS/exFAT
Checking with TestDisk:
$ sudo testdisk /dev/sda

[Analyise]
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 121600 254 63 1953520002
I backed up the partition with ddrescue
sudo ddrescue -r 3 /dev/sda1 ~/one-terra.img ~/log-1T-ddres.txt
Now checking the image with TestDisk gives me different structure details:
$ testdisk one-terra.img

Disk ~/one-terra.img - 1000 GB / 931 GiB
Current partition structure:
Partition Start End Size in sectors

> 1 * Sys=72 13577 238 11 119521 238 60 1701990410

Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724

Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
> 2 * Sys=74 45381 70 3 79242 34 29 543974724
Retruning to the hard disk, I could fix the MBR but not the MFT:
$ sudo testdisk /dev/sda
[Advance][Boot sector recovery]
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
1 * HPFS - NTFS 0 1 1 121600 254 63 1953520002

Boot sector
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

..copied Bootsector over Backup boot sector.
..[Repair MFT]
MFT and MFT mirror are bad. Failed to repair them.
How to proceed from here?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Bad MFT, Trying on Image

#2 Post by cgrenier »

It's a partition image, not a disk image, so the partition table type should be None, not PC/Intel.
In the Advanced menu, you may have to force the type to NTFS.

Locked