Page 2 of 2
Re: Failed to fix MFT mirror: write error.
Posted: 01 Jan 2013, 15:24
by dragonfly41
Doesn't this help at all to walk you through $MFT?
https://tzworks.net/prototype_page.php?proto_id=12
e.g. perhaps filter by date of file?
Re: Failed to fix MFT mirror: write error.
Posted: 01 Jan 2013, 18:04
by Lito
You could try checking the files for the immutable attribute bit.
If this is set, sometimes not even root can remove them.
http://en.wikipedia.org/wiki/Chattr
You will need a Linux distribution disk that includes the chattr command.
For instance Helix 3, a forensics Linux distro (up to this version it was possible to download it for free). This page explain how to get Helix 3 free version. I do not know if is still possible to download a copy. The page says yes, but i did not try it.
Parted Magic includes e2fsprogs and chattr is part of that set of programmes:
http://partedmagic.com/doku.php?id=programs
But I have never tried ruuning it myself from this distro.
More info on chattr command:
http://www.aboutlinux.info/2005/11/make ... -even.html
If I do remember correctly the Windows pagefile is one of such a files. Also i think that if you delete it, Windows does create a new one the next time you boot. But you will need to verify this information.
How to use the TestDisk created image:
http://www.cgsecurity.org/wiki/Image_Creation
Happy New Year!
Re: Failed to fix MFT mirror: write error.
Posted: 01 Jan 2013, 18:07
by dragonfly41
Re: Failed to fix MFT mirror: write error.
Posted: 02 Jan 2013, 05:59
by AndyII
Thank you for the assistance. While I didn't use the Hiren CD, I used the Ultimate Boot CD and the Parted Magic program to delete the files. That is what I needed to accomplish for now.