Page 2 of 2

Re: Failed to fix MFT mirror: write error.

Posted: 01 Jan 2013, 15:24
by dragonfly41
Doesn't this help at all to walk you through $MFT?

https://tzworks.net/prototype_page.php?proto_id=12

e.g. perhaps filter by date of file?

Re: Failed to fix MFT mirror: write error.

Posted: 01 Jan 2013, 18:04
by Lito
You could try checking the files for the immutable attribute bit.
If this is set, sometimes not even root can remove them.

http://en.wikipedia.org/wiki/Chattr

You will need a Linux distribution disk that includes the chattr command.

For instance Helix 3, a forensics Linux distro (up to this version it was possible to download it for free). This page explain how to get Helix 3 free version. I do not know if is still possible to download a copy. The page says yes, but i did not try it.

Parted Magic includes e2fsprogs and chattr is part of that set of programmes:

http://partedmagic.com/doku.php?id=programs
But I have never tried ruuning it myself from this distro.

More info on chattr command:

http://www.aboutlinux.info/2005/11/make ... -even.html

If I do remember correctly the Windows pagefile is one of such a files. Also i think that if you delete it, Windows does create a new one the next time you boot. But you will need to verify this information.

How to use the TestDisk created image:

http://www.cgsecurity.org/wiki/Image_Creation

Happy New Year!

Re: Failed to fix MFT mirror: write error.

Posted: 01 Jan 2013, 18:07
by dragonfly41
And try this tool to delete stubborn files ..

http://technet.microsoft.com/en-us/sysi ... s/bb897556

Re: Failed to fix MFT mirror: write error.

Posted: 02 Jan 2013, 05:59
by AndyII
Thank you for the assistance. While I didn't use the Hiren CD, I used the Ultimate Boot CD and the Parted Magic program to delete the files. That is what I needed to accomplish for now.