Hi All,
New to the forum, but want to thank the developer on the program, and documentation...really well done. So I thought I would ask for help as I can't get any further forward.
Fault: Unable to boot from NTFS Partion
Overview: Corrupt Filesystem, unable to fix with chkdsk
Current position; Having installed R-Studio, and completed scan I can confirm access is possible to my data for recovery purposes however unable to repair FS
Previously unable to repair bootsect or mft with testdisk. After populating files with R-Studio, mft repair works, as does boot sector report all ok.
Unable to list FS Structure, Analyse hangs at 99% at cylinder 60800/60801.
Log File attached.
Can some please help me out as I believe I'm close but missing something.
Thanks
TestDisk 7.3-WIP, Data Recovery Utility, September 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3003.3
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=238734540800
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4008706048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=419430400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=249806454784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=249880903680
Hard disk list
Disk \\.\PhysicalDrive0 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SV300S37A240G, S/N:50026B786401574C, FW:608ABBF0
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST950032 5AS, S/N:7D1B3C854321
Disk \\.\PhysicalDrive2 - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - Verbatim STORE N GO, S/N:10V1900000003E37, FW:1.00
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - ST950032 5AS
Partition table type: Intel
New options :
Dump : Yes
Align partition: Yes
Expert mode : Yes
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 51/30/44
NTFS at 30421/176/28
Info: size boot_sector 488046640, partition 488048640
1 P HPFS - NTFS 0 32 33 51 30 43 819200 [SYSTEM]
NTFS, blocksize=4096, 419 MB / 400 MiB
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
3 P HPFS - NTFS 30421 176 28 60801 80 15 488048640 [Data]
NTFS, blocksize=4096, 249 GB / 232 GiB
ntfs_boot_sector
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
NTFS at 51/30/44
NTFS at 51/30/44
filesystem size 487903232
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Boot sector Backup boot sector
0000 ffffffeb52ffffff904e 54465320 .R.NTFS ffffffeb52ffffff904e 54465320 .R.NTFS
0008 20202000 02080000 ..... 20202000 02080000 .....
0010 00000000 00fffffff80000 ........ 00000000 00fffffff80000 ........
0018 3f00ffffffff00 00ffffff880c00 ?....... 3f00ffffffff00 00ffffff880c00 ?.......
0020 00000000 ffffff8000ffffff8000 ........ 00000000 ffffff8000ffffff8000 ........
0028 ffffffffffffffcf141d 00000000 ........ ffffffffffffffcf141d 00000000 ........
0030 00000c00 00000000 ........ 00000c00 00000000 ........
0038 02000000 00000000 ........ 02000000 00000000 ........
0040 fffffff6000000 01000000 ........ fffffff6000000 01000000 ........
0048 71fffffff11278 1f137822 q..x..x" 71fffffff11278 1f137822 q..x..x"
0050 00000000 fffffffa33ffffffc0ffffff8e .....3.. 00000000 fffffffa33ffffffc0ffffff8e .....3..
0058 ffffffd0ffffffbc007c fffffffb68ffffffc007 ...|.h.. ffffffd0ffffffbc007c fffffffb68ffffffc007 ...|.h..
0060 1f1e6866 00ffffffcbffffff8816 ..hf.... 1f1e6866 00ffffffcbffffff8816 ..hf....
0068 0e0066ffffff81 3e03004e ..f.>..N 0e0066ffffff81 3e03004e ..f.>..N
0070 54465375 15ffffffb441ffffffbb TFSu..A. 54465375 15ffffffb441ffffffbb TFSu..A.
0078 ffffffaa55ffffffcd13 720cffffff81fffffffb .U..r... ffffffaa55ffffffcd13 720cffffff81fffffffb .U..r...
0080 55ffffffaa7506 fffffff7ffffffc10100 U.u..... 55ffffffaa7506 fffffff7ffffffc10100 U.u.....
0088 7503ffffffe9ffffffdd 001effffff83ffffffec u....... 7503ffffffe9ffffffdd 001effffff83ffffffec u.......
0090 18681a00 ffffffb448ffffff8a16 .h...H.. 18681a00 ffffffb448ffffff8a16 .h...H..
0098 0e00ffffff8bfffffff4 161fffffffcd13 ........ 0e00ffffff8bfffffff4 161fffffffcd13 ........
00A0 ffffff9fffffff83ffffffc418 ffffff9e581f72 .....X.r ffffff9fffffff83ffffffc418 ffffff9e581f72 .....X.r
00A8 ffffffe13b060b 0075ffffffdbffffffa3 .;...u.. ffffffe13b060b 0075ffffffdbffffffa3 .;...u..
00B0 0f00ffffffc12e 0f00041e ........ 0f00ffffffc12e 0f00041e ........
00B8 5a33ffffffdbffffffb9 00202bffffffc8 Z3... +. 5a33ffffffdbffffffb9 00202bffffffc8 Z3... +.
00C0 66ffffffff0611 0003160f f....... 66ffffffff0611 0003160f f.......
00C8 00ffffff8effffffc2ffffffff 061600ffffffe8 ........ 00ffffff8effffffc2ffffffff 061600ffffffe8 ........
00D0 4b002bffffffc8 77ffffffefffffffb800 K.+.w... 4b002bffffffc8 77ffffffefffffffb800 K.+.w...
00D8 ffffffbbffffffcd1a66 23ffffffc0752d ...f#.u- ffffffbbffffffcd1a66 23ffffffc0752d ...f#.u-
00E0 66ffffff81fffffffb54 43504175 f..TCPAu 66ffffff81fffffffb54 43504175 f..TCPAu
00E8 24ffffff81fffffff902 01721e16 $....r.. 24ffffff81fffffff902 01721e16 $....r..
00F0 6807ffffffbb16 68700e16 h...hp.. 6807ffffffbb16 68700e16 h...hp..
00F8 68090066 53665366 h..fSfSf 68090066 53665366 h..fSfSf
0100 55161616 68ffffffb80166 U...h..f 55161616 68ffffffb80166 U...h..f
0108 610e07ffffffcd 1a33ffffffc0ffffffbf a....3.. 610e07ffffffcd 1a33ffffffc0ffffffbf a....3..
0110 2810ffffffb9ffffffd8 0ffffffffcfffffff3ffffffaa (....... 2810ffffffb9ffffffd8 0ffffffffcfffffff3ffffffaa (.......
0118 ffffffe95f01ffffff90 ffffff9066601e ._...f`. ffffffe95f01ffffff90 ffffff9066601e ._...f`.
0120 0666ffffffa111 00660306 .f...f.. 0666ffffffa111 00660306 .f...f..
0128 1c001e66 68000000 ...fh... 1c001e66 68000000 ...fh...
0130 00665006 53680100 .fP.Sh.. 00665006 53680100 .fP.Sh..
0138 681000ffffffb4 42ffffff8a160e h...B... 681000ffffffb4 42ffffff8a160e h...B...
0140 00161fffffff8b fffffff4ffffffcd1366 .......f 00161fffffff8b fffffff4ffffffcd1366 .......f
0148 595b5a66 5966591f Y[ZfYfY. 595b5a66 5966591f Y[ZfYfY.
0150 0fffffff821600 66ffffffff0611 ....f... 0fffffff821600 66ffffffff0611 ....f...
0158 0003160f 00ffffff8effffffc2ffffffff ........ 0003160f 00ffffff8effffffc2ffffffff ........
0160 0e160075 ffffffbc071f66 ...u...f 0e160075 ffffffbc071f66 ...u...f
0168 61ffffffc3ffffffa0fffffff8 01ffffffe80900 a....... 61ffffffc3ffffffa0fffffff8 01ffffffe80900 a.......
0170 ffffffa0fffffffb01ffffffe8 0300fffffff4ffffffeb ........ ffffffa0fffffffb01ffffffe8 0300fffffff4ffffffeb ........
0178 fffffffdffffffb401ffffff8b fffffff0ffffffac3c00 ......<. fffffffdffffffb401ffffff8b fffffff0ffffffac3c00 ......<.
0180 7409ffffffb40e ffffffbb0700ffffffcd t....... 7409ffffffb40e ffffffbb0700ffffffcd t.......
0188 10ffffffebfffffff2ffffffc3 0d0a4120 ......A 10ffffffebfffffff2ffffffc3 0d0a4120 ......A
0190 6469736b 20726561 disk rea 6469736b 20726561 disk rea
0198 64206572 726f7220 d error 64206572 726f7220 d error
01A0 6f636375 72726564 occurred 6f636375 72726564 occurred
01A8 000d0a4d 4942524c ...MIBRL 000d0a4d 4942524c ...MIBRL
01B0 20202069 73206d69 is mi 20202069 73206d69 is mi
01B8 7373696e 67000d0a ssing... 7373696e 67000d0a ssing...
01C0 4d494252 4c202020 MIBRL 4d494252 4c202020 MIBRL
01C8 69732063 6f6d7072 is compr 69732063 6f6d7072 is compr
01D0 65737365 64000d0a essed... 65737365 64000d0a essed...
01D8 50726573 73204374 Press Ct 50726573 73204374 Press Ct
01E0 726c2b41 6c742b44 rl+Alt+D 726c2b41 6c742b44 rl+Alt+D
01E8 656c2074 6f207265 el to re 656c2074 6f207265 el to re
01F0 73746172 740d0a00 start... 73746172 740d0a00 start...
01F8 ffffff8cffffffa9ffffffbeffffffd6 000055ffffffaa ......U. ffffff8cffffffa9ffffffbeffffffd6 000055ffffffaa ......U.
ntfs_boot_sector
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
NTFS at 51/30/44
NTFS at 51/30/44
filesystem size 487903232
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 51/30/44
file_win32_pread(612,16,buffer,7112704(442/190/5)) read err: read after end of file
MFT and MFT mirror match perfectly.
MFT and MFT mirror match perfectly.
ntfs_boot_sector
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
NTFS at 51/30/44
NTFS at 51/30/44
filesystem size 487903232
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT must be non-resident but a resident extent was found. $MFT is corrupt. Run chkdsk.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT must be non-resident but a resident extent was found. $MFT is corrupt. Run chkdsk.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Not an exFAT boot sector.
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
NTFS at 51/30/44
NTFS at 51/30/44
filesystem size 487903232
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 51/30/44
MFT and MFT mirror match perfectly.
MFT and MFT mirror match perfectly.
ntfs_boot_sector
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
NTFS at 51/30/44
NTFS at 51/30/44
filesystem size 487903232
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT must be non-resident but a resident extent was found. $MFT is corrupt. Run chkdsk.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT must be non-resident but a resident extent was found. $MFT is corrupt. Run chkdsk.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Not an exFAT boot sector.
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
NTFS, blocksize=4096, 249 GB / 232 GiB
Can't open filesystem. Filesystem seems damaged.
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
Analyse Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 51/30/44
file_win32_pread(612,16,buffer,7112710(442/190/11)) read err: read after end of file
NTFS at 30421/176/28
Info: size boot_sector 488046640, partition 488048640
Current partition structure:
1 P HPFS - NTFS 0 32 33 51 30 43 819200 [SYSTEM]
2 * HPFS - NTFS 51 30 44 30421 176 27 487903232 [WINDOWS]
3 P HPFS - NTFS 30421 176 28 60801 80 15 488048640 [Data]
MFT Issue, TESTDISK HANGS, R-Studio See Files, Still unable to repair FS
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
trickygibbo
- Posts: 1
- Joined: 15 Feb 2025, 00:32
-
recuperation
- Posts: 3030
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: MFT Issue, TESTDISK HANGS, R-Studio See Files, Still unable to repair FS
File system repair is the TestDisk exception within data recovery software and only works in few defined cases. Other problems may exist which cannot be repaired automatically such as read errors in your case.trickygibbo wrote: 15 Feb 2025, 00:44 Hi All,
New to the forum, but want to thank the developer on the program, and documentation...really well done. So I thought I would ask for help as I can't get any further forward.
Fault: Unable to boot from NTFS Partion
Overview: Corrupt Filesystem, unable to fix with chkdsk
Current position; Having installed R-Studio, and completed scan I can confirm access is possible to my data for recovery purposes however unable to repair FS
Where are you "populating"?
Previously unable to repair bootsect or mft with testdisk. After populating files with R-Studio, mft repair works, as does boot sector report all ok.