Page 1 of 1

NTFS Filesystem repair

Posted: 06 May 2017, 18:54
by littlebiggtoe
I have a 1TB NTFS external backup drive that is unreadable. The drive has a single NTFS parition on it, which Windows disk management now shows as RAW. Below is a list of things that I have found and things I have tried.

1. Run chkdsk /r on the drive, which says the mft is corrupt. chkdsk is unable to repair it and aborts

2.Using TestDisk 7.1 WIP went to advanced->boot where there were warnings about the number of heads and sectors being incorrect (both were set to 1). Both the boot sector and its backup had a status of 'OK'. Running repairMFT, TestDisk reports that both the MFT and its mirror are perfectly matched. I also ran RebuildBS (without changing any disk geomentry) which didn't seem to do anything. I cannot list the files from the partition

4. Under Geometry I set Heads = 255 and Sectors = 63 based on the recommendation from TestDisk. Analyze shows the NTFS partition, but I cannot list files. Running RepairMFT and RebuildBS again made no difference.

5. Under Analyze I did a deep search, which found a bunch of bogus partitions. Thinking that perhaps there were issues with the partition table I selected the NTFS partition from the quick search and wrote it to disk. Still not change.


From all of this I have gathered that my partition table is fine, but that my MFT is fried since I can't get to the filesystem. I was able to view some of the files using the Zero Assumption Recovery linked in the wiki. Any suggestions as to how I can recover the filesystem on this drive?

Thanks! :D

Re: NTFS Filesystem repair

Posted: 07 May 2017, 15:57
by cgrenier
You can always use PhotoRec to recover the data, select the disk and next the partition, Search, choose [Whole] instead of [Free].
It will not recover the original filenames.

Re: NTFS Filesystem repair

Posted: 07 May 2017, 18:57
by littlebiggtoe
Yeah, that was going to be the final step I took. Does that mean you don't think the filesystem is recoverable?

Re: NTFS Filesystem repair

Posted: 09 May 2017, 06:01
by cgrenier
To recover the original filenames you can try various commercial data recovery utilities but in your case TestDisk can't handle the corruption of your NTFS filesystem,
it's why I told you to try PhotoRec.

Re: NTFS Filesystem repair

Posted: 10 May 2017, 00:46
by littlebiggtoe
Okay, thank you. I appreciate your help and thank you for your awesome software!

Re: NTFS Filesystem repair

Posted: 11 May 2017, 17:17
by littlebiggtoe
Just thought I would post here that I successfully restored access to the filesystem. It turns out that the MFT and its mirror were intact, but were shifted out of place. I found this using a pretty powerful piece of freeware called Active Disk Editor by LSoft Technologies (http://www.lsoft.net/disk-editor.aspx). It turns out the boot sector was pointing to the correct sector for the MFT, but the MFT file was offset by 128 bytes instead of 0 bytes. The MFT_MIRR and logfile were both offset by the same amount. Shifting them all up by 128 bytes so that they were properly aligned with the start of their repsective sector fixed the issue and got me access to the filesystem. I am currently copying files off the drive and plan on reformatting it so I get a clean filesystem.

All in all I feel VERY thankful. Thanks again.

Re: NTFS Filesystem repair

Posted: 09 Jul 2018, 02:30
by bschloma
happy to hear that littlebiggtoe. I'm in a similar situation. I have an 8 TB storage drive formatted with an NTFS partition (with GPT) that windows 7 cannot access, claims is corrupted or unreadable. disk manager sees the partition as RAW. chkdsk won't run, can't verify the volume. testdisk says boot sectors are ok and that both mft and mftmirr are ok, but can't list any files (says filesystem is corrupted). active@ disk editor on the other hand says the mfts are invalid, can't preview them, and says that the file offset is -1. active@ disk editor can actually see the top level of the file structure, i.e. the first directories in the file system, but not anything in them.

could you explain a bit more how deduced + fixed the issue with the mft offset? any other advice is also most welcome.

thanks!