NTFS MFT overwritten

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
iwlf
Posts: 10
Joined: 10 Jun 2016, 22:37

NTFS MFT overwritten

#1 Post by iwlf »

Hi,

I have accidentally written a 6GB USB Stick Image to a 2TB NTFS Drive (other Linux sdx order of the external drives this time).

I have overwritten that first 6GB with zeros so it is clearly invalid now, so no partition table, bootsector and MFT.

As far I understood there is a Backup-Boot-Sector at the end of the NTFS-Drive which testdisk can find with deep search and restore partition table and boot sector from.

There is also an Backup MFT / Mirror but haven't found for sure if also at the end and so still on my disk.

Doc says testdisk can copy Backup MFT (hopefully at the end) to MFT.

If I can restore the partition (table) with testdisk, should I copy the Backup MFT, or does chkdsk restore the filesystem from Backup MFT when only zeros in the MFT?

iwlf
Posts: 10
Joined: 10 Jun 2016, 22:37

Re: NTFS MFT overwritten

#2 Post by iwlf »

Deeper Search found several Partitions, on NTFS spanning the whole disk which is may be the right one.

Pressing P for List Files only says Filesystem corrupt.

Does this Test check the MFT Mirror at all, I know MFT is only zeros.

Unfortunately I pressed <Enter> and have to start over again.

It would be really nice if testdisk stored it's results and could continue with.

Will need 8 hours now to get to the same point.

sachinkhanna32
Posts: 2
Joined: 04 May 2018, 12:38

Re: NTFS MFT overwritten

#3 Post by sachinkhanna32 »

iwlf wrote: 29 May 2019, 21:53 Deeper Search found several Partitions, on NTFS spanning the whole disk which is may be the right one Pressing P for List Files only says Filesystem corrupt. Does this Test check the MFT Mirror at all, I know MFT is only zeros. Unfortunately I pressed <Enter> and washing machine have to start over again. It would be really nice if testdisk stored it's results and could continue with. Will need 8 hours now to get to the same point.
Hi, I have the same problem. If I Format the drive will it solve the issue.

iwlf
Posts: 10
Joined: 10 Jun 2016, 22:37

Re: NTFS MFT overwritten

#4 Post by iwlf »

With formating you delete more and recover nothing.

Locked