NTFS Filesystem repair

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

NTFS Filesystem repair

#1 Post by littlebiggtoe »

I have a 1TB NTFS external backup drive that is unreadable. The drive has a single NTFS parition on it, which Windows disk management now shows as RAW. Below is a list of things that I have found and things I have tried.

1. Run chkdsk /r on the drive, which says the mft is corrupt. chkdsk is unable to repair it and aborts

2.Using TestDisk 7.1 WIP went to advanced->boot where there were warnings about the number of heads and sectors being incorrect (both were set to 1). Both the boot sector and its backup had a status of 'OK'. Running repairMFT, TestDisk reports that both the MFT and its mirror are perfectly matched. I also ran RebuildBS (without changing any disk geomentry) which didn't seem to do anything. I cannot list the files from the partition

4. Under Geometry I set Heads = 255 and Sectors = 63 based on the recommendation from TestDisk. Analyze shows the NTFS partition, but I cannot list files. Running RepairMFT and RebuildBS again made no difference.

5. Under Analyze I did a deep search, which found a bunch of bogus partitions. Thinking that perhaps there were issues with the partition table I selected the NTFS partition from the quick search and wrote it to disk. Still not change.


From all of this I have gathered that my partition table is fine, but that my MFT is fried since I can't get to the filesystem. I was able to view some of the files using the Zero Assumption Recovery linked in the wiki. Any suggestions as to how I can recover the filesystem on this drive?

Thanks! :D

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS Filesystem repair

#2 Post by cgrenier »

You can always use PhotoRec to recover the data, select the disk and next the partition, Search, choose [Whole] instead of [Free].
It will not recover the original filenames.

littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

Re: NTFS Filesystem repair

#3 Post by littlebiggtoe »

Yeah, that was going to be the final step I took. Does that mean you don't think the filesystem is recoverable?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS Filesystem repair

#4 Post by cgrenier »

To recover the original filenames you can try various commercial data recovery utilities but in your case TestDisk can't handle the corruption of your NTFS filesystem,
it's why I told you to try PhotoRec.

littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

Re: NTFS Filesystem repair

#5 Post by littlebiggtoe »

Okay, thank you. I appreciate your help and thank you for your awesome software!

littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

Re: NTFS Filesystem repair

#6 Post by littlebiggtoe »

Just thought I would post here that I successfully restored access to the filesystem. It turns out that the MFT and its mirror were intact, but were shifted out of place. I found this using a pretty powerful piece of freeware called Active Disk Editor by LSoft Technologies (http://www.lsoft.net/disk-editor.aspx). It turns out the boot sector was pointing to the correct sector for the MFT, but the MFT file was offset by 128 bytes instead of 0 bytes. The MFT_MIRR and logfile were both offset by the same amount. Shifting them all up by 128 bytes so that they were properly aligned with the start of their repsective sector fixed the issue and got me access to the filesystem. I am currently copying files off the drive and plan on reformatting it so I get a clean filesystem.

All in all I feel VERY thankful. Thanks again.

bschloma
Posts: 1
Joined: 09 Jul 2018, 02:14

Re: NTFS Filesystem repair

#7 Post by bschloma »

happy to hear that littlebiggtoe. I'm in a similar situation. I have an 8 TB storage drive formatted with an NTFS partition (with GPT) that windows 7 cannot access, claims is corrupted or unreadable. disk manager sees the partition as RAW. chkdsk won't run, can't verify the volume. testdisk says boot sectors are ok and that both mft and mftmirr are ok, but can't list any files (says filesystem is corrupted). active@ disk editor on the other hand says the mfts are invalid, can't preview them, and says that the file offset is -1. active@ disk editor can actually see the top level of the file structure, i.e. the first directories in the file system, but not anything in them.

could you explain a bit more how deduced + fixed the issue with the mft offset? any other advice is also most welcome.

thanks!

Locked