Need help understanding an NTFS repair

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
RecoveryNoob
Posts: 1
Joined: 30 Jul 2014, 20:28

Need help understanding an NTFS repair

#1 Post by RecoveryNoob »

Hey all,

I'm trying to recover the file system on a single-partition NTFS drive (an old Windows XP 32-bit disk). I'm doing this under 64-bit Linux. Neither Linux nor Windows are capable of mounting the drive. However, using PhotoRec, I can recuperate numerous files (sorting them is a different matter). Nonetheless, I'm having difficulty recreating the file system of the NTFS drive.

When running testdisk on the drive, it recognizes it as an Intel/PC partition. Upon analysing it, testdisk finds a single NTFS partition:

Code: Select all

     Partition                  Start        End    Size in sectors
> 1 * HPFS - NTFS              0   1  1 19455 254 63  312560577
I then created an image of the drive (image.dd) and run testdisk on that ("sudo testdisk image.dd"). When doing so, testdisk detects a non-partitioned media. If I choose "None", then a single partition* is found when analysing:

Code: Select all

Disk image.dd - 160 GB / 149 GiB - CHS 19456 255 63

     Partition                  Start        End    Size in sectors
>   P NTFS                     0   0  1 19455 253 63  312560577
When I choose "Filesystem Utils" and "Boot", I receive the following message:

Code: Select all

Disk image.dd - 160 GB / 149 GiB - CHS 19456 255 63
     Partition                  Start        End    Size in sectors
   P NTFS                     0   0  1 19455 253 63  312560577

Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
However, when I choose "List", no files are shown:

Code: Select all

   P NTFS                     0   0  1 19455 253 63  312560577
Directory /

>dr-xr-xr-x     0     0         0 24-Jan-2014 22:23 .
 dr-xr-xr-x     0     0         0 24-Jan-2014 22:23 .
When I choose "Repair MFT", I get the following message:

Code: Select all

MFT and MFT mirror are bad. Failed to repair them.
From here, I'm uncertain as to how to proceed. I'd love to hear any feedback or recommendations.

:| :roll: :shock:


--------------------------------------------

--------------------------------------------
* Aside:

Note that if I choose Intel/PC (rather than "None") for the partition type, upon analysing it, I receive the following output:

Code: Select all

Disk image.dd - 160 GB / 149 GiB - CHS 19456 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 * Sys=72               13577 238 11 119521 238 60 1701990410

Bad relative sector.
 2 * Sys=74               45381  70  3 79242  34 29  543974724

Bad relative sector.
 3 * NetWare 3.11+        10498  56 41 10498  56 40          0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
 1 * Sys=72               13577 238 11 119521 238 60 1701990410
 2 * Sys=74               45381  70  3 79242  34 29  543974724
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
From there, if I run further analysis, no partitions are found.
Top
Locked

Return to “Filesystem repair”