MFT damage

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
danlane
Posts: 4
Joined: 27 Oct 2016, 22:45

MFT damage

#1 Post by danlane »

Hi,

My question is have i damaged my MFT? and should I follow these instructions below?

run test disk,
choose advanced menu
select my NTFS partition
choose boot
then repair MFT

I've added some screen grabs below and some background info on what I did:

I damaged my portable usb drive, I accidentally set it as a destination for a clone backup! Literally only for a second though, I realized my mistake just after pressing the button to start the process then I hit cancel.

Now when I try to access the disk windows says the filesystem seems damaged, the chkdisk utility didn't fix it either.

I'm on windows 8, the drive is an external usb portable drive.

Anyway I run test disk, it did an analyse and listed some things in green:
Capture.JPG
Capture.JPG (54.49 KiB) Viewed 4365 times
Trouble is I don't know what this means. I'm scared of damaging the data even more by picking the wrong options.
This what testdisk syas after pressing p to list files:
Capture2.JPG
Capture2.JPG (38.29 KiB) Viewed 4365 times
Thanks for reading, I'm a novice so any help will be really appreciated.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: MFT damage

#2 Post by cgrenier »

Select the PhysicalDrive containing D: instead of D: directly.
Advanced, Boot. If the main boot sector is damaged, choose BackupBS and confirm, Quit and restart your computer.
Use TestDisk 7.1-WIP, it is better as repairing the MFT than previous versions. Try it only if the boot sector is already ok, if Windows can not access your files and TestDisk failed to list your files.
Please post the testdisk.log file content if you have problems.
Top
danlane
Posts: 4
Joined: 27 Oct 2016, 22:45

Re: MFT damage

#3 Post by danlane »

Hi thanks so much for the reply,

When you say "Select the PhysicalDrive containing D: instead of D: directly", do you mean the select the drive at the earlier Disk selection menu or one of the other green entries listed in my first screen grab? Apologies if this is obvious!

Can I just check, would my drive have a boot sector? It wasn't used to run an OS from just as an external drive, do all drives have boot sectors?

I'll install 7.1

Thanks again for your help,
Cheers
Dan

I've pasted the log below (can't attach it for some reason):

Sat Oct 29 16:14:27 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398931968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398931968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999873507328
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=679933952
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive C: - 1999 GB / 1862 GiB - CHS 243137 255 63, sector size=512
Drive D: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive E: - 679 MB / 648 MiB - CHS 162 64 32, sector size=2048

Partition table type (auto): None
Drive D: - 2000 GB / 1863 GiB
Partition table type: None

Analyse Drive D: - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/0/1
filesystem size 1021952
sectors_per_cluster 8
mft_lcn 42581
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 0/0/1
Info: size boot_sector 1021952, partition 3907024896
Current partition structure:
P NTFS 0 0 1 243201 13 12 3907024896
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Top
danlane
Posts: 4
Joined: 27 Oct 2016, 22:45

Re: MFT damage

#4 Post by danlane »

Hi,
I used testdisk 7.1, it said boot sector ok and is identical to backup boot sector. It also said MFT and MFT mirror match perfectly! But the file system is still damaged.

Is this the end of the road for me or is there something I can do to repair the file system?

I noticed the log mentione the '$MFT has invalid magic'. I'm not sure what that means but seems relevant.

Cheers,
Dan

the log testdisk 7.1 generated is pasted below:

Tue Nov 1 23:49:06 2016
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398931968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398931968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999873507328
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=679933952
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1CH164, S/N:Z3405CVK, FW:CC27
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:20150418008796F, FW:5438
Drive E: - 679 MB / 648 MiB - CHS 162 64 32, sector size=2048 - ATAPI iHAS122 W, FW:PL06

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - TOSHIBA External USB 3.0
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [System]
NTFS, blocksize=4096, 2000 GB / 1863 GiB

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [System]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
filesystem size 1021952
sectors_per_cluster 8
mft_lcn 42581
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [System]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [System]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
filesystem size 1021952
sectors_per_cluster 8
mft_lcn 42581
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
MFT and MFT mirror match perfectly.
MFT and MFT mirror match perfectly.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [System]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
filesystem size 1021952
sectors_per_cluster 8
mft_lcn 42581
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
MFT and MFT mirror match perfectly.
MFT and MFT mirror match perfectly.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [System]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
NTFS at 0/32/33
Info: size boot_sector 1021952, partition 3907024896
filesystem size 1021952
sectors_per_cluster 8
mft_lcn 42581
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Last edited by danlane on 02 Nov 2016, 01:09, edited 1 time in total.
Top
danlane
Posts: 4
Joined: 27 Oct 2016, 22:45

Re: MFT damage

#5 Post by danlane »

Hi,

I just tried the same thing back in testdisk 7.0 and it says something different to 7.1 it says 'MFT and MFT mirror are bad.Failed to repair them'.
Top
Locked

Return to “Filesystem repair”