Failed to fix MFT mirror: write error.

[AndyII]

I'm having a problem with CHKDSK not fixing files. It finds the same orphaned index entries and recovers those same files every time it runs. I found a post that suggested that the pointers in the MFT might be pointing at the same file or one pointer trying to point to two different files - something like that. I tried to have TestDisk repair the MFT. It asks: Fix MFT mirror using MFT ? (Y/N). I say yes and get: Failed to fix MFT mirror: write error.

I'm working with someone in another forum who had me try to move the files to another directory to force the MFT to repair itself, but I can't move the files. I managed to use TestDisk to copy them to another folder, but I can't delete them. Some tools give an error and others say the files don't exist, yet they are there. Can TestDisk delete files?

Any other ideas I can try?

[AndyII]

Is there anyone here with knowledge on this problem?

[dragonfly41]

All the guidelines say .. clone your disc image first and then attempt recovery on the cloned image

Read here ..

http://www.cgsecurity.org/wiki/Advanced ... MFT_Repair

If both MFT and MFTMirr are damaged and thus cannot be repaired using TestDisk, you might want to try commercial software like Zero Assumption Recovery, GetDataBack for NTFS or Restorer 2000.

[AndyII]

Thanks for responding. I went to the link you posted and the word "clone" isn't even on the page so I don't know where you're getting "All the guidelines say .. clone your disc image first and then attempt recovery on the cloned image". If I'm to use another software to make a clone, wouldn't I just be cloning those same bad MFTs? Would an image and restore be better?

Second, the part you quoted was about data recovery which is not my issue. TestDisk is able to see files and do things that Windows won't allow. I'm trying to delete files though and was wondering if there was a way to use TestDisk for that.

Third, since you brought up cloning the disk, TestDisk allows me to make an image which I can save. I can't find any instructions on how to use that at all. Are there instructions on a hidden page somewhere?

[dragonfly41]

We are expected to deduce that you are recovering windows (since you refer to CHKDSK).
You do not provide any testdisk.log from a first search or analysis.
You give no information on the OS and partition structure.
Is your hdd (under recovery) now an external drive?

However to answer your questions.

First:-

Just try searching this forum for "clone".

It is generally advisable to make a copy of (clone) any disk under recovery.
The principle is quite basic. If you screw up your recovery attempts you can clone another image from the source.
And you cannot copy (clone) any bad sectors (which are hardware faults).
when you are done with recovery you can use the clone hdd as your backup device.

Recovery of MFT is separate from the argument for cloning.
Yes you will be copying bad MFT's but as I point out if you screw up you have no fallback.

You can try MFT repair without cloning (at your risk).

Second:-

The link I provided refers to MFT repair.
I'll repeat the relevant section here (in full) ..

The MFT (Master File Table) is sometimes corrupted. If Microsoft's Checkdisk (chkdsk) failed to repair the MFT, run TestDisk. In the Advanced menu, select your NTFS partition, choose Boot, then Repair MFT. TestDisk will compare the MFT and MFT mirror (its backup). If the MFT is damaged, it will try to repair the MFT using the backup. If the MFT backup is damaged, it will use the main MFT.

If both MFT and MFTMirr are damaged and thus cannot be repaired using TestDisk, you might want to try commercial software like Zero Assumption Recovery, GetDataBack for NTFS or Restorer 2000.

Deleting files can be done either from testdisk or using a Live CD to inspect the file structure.

After this exercise you might consider burning and keeping a copy of Live (Linux) CD at hand for such cloning and other tasks using utilities such as ddrescue or clonezilla .. and other forensic tools.

There are other threads you can follow on MFT repair ..

http://forum.cgsecurity.org/phpBB3/repa ... -t171.html

but they end with suggestions that you use data recovery software.

If you are in windows you could try .. Easus free recovery tool .. to repair MFT.

http://www.easeus.com/resource/ntfs-disk-structure.htm

Good luck.

[AndyII]

We are expected to deduce that you are recovering windows (since you refer to CHKDSK).
You do not provide any testdisk.log from a first search or analysis.
You give no information on the OS and partition structure.
Is your hdd (under recovery) now an external drive?

As I said originally, I was working with someone else in another forum on my hard drive issues. I was trying to not waste anyone's time getting into all the details of my entire issue, when my questions are specifically about TestDisk. I was trying to get some really quick answers since the person I'm working with had never heard of TestDisk. I don't need to find any files, so I haven't done a search or analysis. The OS is Vista and the hard disk is broken down into 3 NTFS partitions. The HDD is the operating system drive and is not external as yet.

However to answer your questions.

First:-

Just try searching this forum for "clone".

It is generally advisable to make a copy of (clone) any disk under recovery.
The principle is quite basic. If you screw up your recovery attempts you can clone another image from the source.

The principle is quite basic because you understand it. I do not. I don't have any clone software nor can I purchase any. I used TestDisk to make an image, but all it does is make an image.dd file. There is no information on how to use it or recover using that image.

And you cannot copy (clone) any bad sectors (which are hardware faults).
when you are done with recovery you can use the clone hdd as your backup device.

I don't understand what you mean. I cannot clone any bad sectors or I must not clone any bad sectors? As I understand it, when using a clone, the marked bad sectors will also be copied to the destination drive.

Recovery of MFT is separate from the argument for cloning.
Yes you will be copying bad MFT's but as I point out if you screw up you have no fallback.

You can try MFT repair without cloning (at your risk).

As I stated originally, I tried the MFT repair and it failed due to a write error. I'm wondering if an image would be better. If I get a bad MFT no matter what I do, then there is no point in the clone since I'll have a bad MFT that still needs repair. It won't matter that it needs repair on a clone. I have copies of all the files but they are not usable as an image. What I'm trying to avoid is reinstalling Windows and having to reinstall all the programs. I have too many to count and no longer have the install files for some of them.

Second:-

The link I provided refers to MFT repair.
I'll repeat the relevant section here (in full) ..

The MFT (Master File Table) is sometimes corrupted. If Microsoft's Checkdisk (chkdsk) failed to repair the MFT, run TestDisk. In the Advanced menu, select your NTFS partition, choose Boot, then Repair MFT. TestDisk will compare the MFT and MFT mirror (its backup). If the MFT is damaged, it will try to repair the MFT using the backup. If the MFT backup is damaged, it will use the main MFT.

If both MFT and MFTMirr are damaged and thus cannot be repaired using TestDisk, you might want to try commercial software like Zero Assumption Recovery, GetDataBack for NTFS or Restorer 2000.

I saw this and responded that these softwares are for Data Recovery. I do not need data recovery. I can see all the files on the disk and have access to them. This is not the problem I am having.

Deleting files can be done either from testdisk or using a Live CD to inspect the file structure.

This is the question I had. How can I delete files using TestDisk? I find no such "delete" command in the software. If it is hidden, what is it?

The files are there and accessible but I can't delete them because Windows doesn't think they exist. TestDisk can see them and copy them. I can even access them. I've made copies elsewhere and need to delete these references. No other software (DelInvFile, Killbox, ICE ECC, ZTreeWin) has been able to delete them.

After this exercise you might consider burning and keeping a copy of Live (Linux) CD at hand for such cloning and other tasks using utilities such as ddrescue or clonezilla .. and other forensic tools.

There are other threads you can follow on MFT repair ..

http://forum.cgsecurity.org/phpBB3/repa ... -t171.html

but they end with suggestions that you use data recovery software.

If you are in windows you could try .. Easus free recovery tool .. to repair MFT.

http://www.easeus.com/resource/ntfs-disk-structure.htm

Good luck.

If I can fix the file system, I intend to implement a backup and recovery system once I find free software that will do the job. I'm still investigating the multitudes of software out there. I've looked at free Easeus Backup software but it is trialware. I looking for something for the long term.

[dragonfly41]

Let's try to retrace our steps.
My suggestion was that if you provide salient information at the outset you do not waste time.
This much I've gleaned from your post so far:-

OS: Vista
Computer: no information supplied (32 or 64 bit?)
Disk: no information given
Partitions: 3 NTFS partitions
Problem reported: "I'm having a problem with CHKDSK not fixing files. It finds the same orphaned index entries and recovers those same files every time it runs".
Testing hdd as external device: no, it's still internal
Knowledge of cloning software or process: none
Budget for purchase of software: can't purchase
Problem identified in running testdisk: bad MFT and MFT mirror
File structure visible: yes
Backup and recovery process: needed, EASUS Backup being tried.

But does Vista actually run after running chkdsk?

Did you run chkdsk /f to actually try to fix the errors?

Have you tried vista repair installation disk?

http://www.howtogeek.com/howto/windows- ... -have-one/

...

Regarding backup tools the Easus Backup Utility does refer to disk clone / partition clone

I suggest that you also research the equivalent of rsync (from linux) which allows file differences to be backed up.

Search for rsync variants which run in vista and not linux

https://www.itefix.no/i2/cwrsync

http://en.kioskea.net/faq/2231-rsync-under-windows

...

Now to return to MFT repair

Here are some possibly related threads from my bookmarks ..

http://reboot.pro/topic/15243-mft-repairrebuild/
refers to testdisk

TESTDISK has a "fix $MFT" feature, but basically it just uses the $MFT_Mirror to fix it, (and as you might be familiar with $MFT_Mirror should be called $MFT_Mirror:Incipit as it stores only the first few records of the $MFT):

http://dmitrybrant.com/ntfswalker

http://www.forensicfocus.com/index.php? ... pic&t=8010

NTFSWalker has its own drivers for reading NTFS partitions. It bypasses the Windows file system drivers and reads your disk hardware directly! It allows you to view every record in your file system's MFT in excruciating detail. And I mean excruciating.

[AndyII]

Let's try to retrace our steps.
My suggestion was that if you provide salient information at the outset you do not waste time.
This much I've gleaned from your post so far:-

OS: Vista
Computer: no information supplied (32 or 64 bit?) 32 bit
Disk: no information given WD 500 GB
Partitions: 3 NTFS partitions
Problem reported: "I'm having a problem with CHKDSK not fixing files. It finds the same orphaned index entries and recovers those same files every time it runs". INCORRECT: The problem is 1) How do I use the Disk Image function of TestDisk and 2) Where in TestDisk does it allow you to delete files.
Testing hdd as external device: no, it's still internal
Knowledge of cloning software or process: none
Budget for purchase of software: can't purchase
Problem identified in running testdisk: bad MFT and MFT mirror INCORRECT: The TestDisk "fix MFT function" will not work because of a "Write Error".
File structure visible: yes
Backup and recovery process: needed, EASUS Backup being tried. No. Since it is not free, I am looking for a free option that I can keep and schedule to do incremental backups that is also easy for someone new to backups and cloning.

But does Vista actually run after running chkdsk? Yes, Vista is working fine. I just need to delete 65 files that will not delete or copy

Did you run chkdsk /f to actually try to fix the errors? This is part of why I was not providing this information. It is a sidetrack from my actual question. I am already working with someone on this. But yes. I have used /F, /R, and /B. I am quite savvy with computers. I am just unfamiliar with backups and cloning since I have never done them.

Have you tried vista repair installation disk? No. I have been told that I would lose my emails. I know that they will remain on the disk, but then I'd have to import them back in Windows Mail and there are 7900 of them. I would most like then have to fix something else.

http://www.howtogeek.com/howto/windows- ... -have-one/

...

Regarding backup tools the Easus Backup Utility does refer to disk clone / partition clone

I suggest that you also research the equivalent of rsync (from linux) which allows file differences to be backed up.

Search for rsync variants which run in vista and not linux

https://www.itefix.no/i2/cwrsync

http://en.kioskea.net/faq/2231-rsync-under-windows

Thank you. I hadn't heard of that one and will look into it.

...

Now to return to MFT repair

Here are some possibly related threads from my bookmarks ..

http://reboot.pro/topic/15243-mft-repairrebuild/
refers to testdisk

TESTDISK has a "fix $MFT" feature, but basically it just uses the $MFT_Mirror to fix it, (and as you might be familiar with $MFT_Mirror should be called $MFT_Mirror:Incipit as it stores only the first few records of the $MFT):

http://dmitrybrant.com/ntfswalker

http://www.forensicfocus.com/index.php? ... pic&t=8010

NTFSWalker has its own drivers for reading NTFS partitions. It bypasses the Windows file system drivers and reads your disk hardware directly! It allows you to view every record in your file system's MFT in excruciating detail. And I mean excruciating.

I will look at those links as well. Thank you.

1) You had said earlier that TestDisk will delete files. How?
2) How do I use the image I created with TestDisk?

[dragonfly41]

You clarified the problem:

INCORRECT: The problem is 1) How do I use the Disk Image function of TestDisk and 2) Where in TestDisk does it allow you to delete files.

To use any disk imaging you need another hdd which is equal in size or greater than your disk to be repaired.

True I did write earlier ..

Deleting files can be done either from testdisk or using a Live CD to inspect the file structure.

That was badly explained. I meant save files (using testdisk or Live CD).

Yes, Vista is working fine. I just need to delete 65 files that will not delete or copy.

I'm fairly sure that if you had a Live CD burned onto a CD or USB you should be able to inspect your Vista partition and with root permissions in your Linux OS delete any Vista files you choose by using a File Manager.

If you have Vista running then download and burn Hiren's CD.

http://www.hiren.info/pages/bootcd

From this bootable CD

• optionally run a virus scan of Vista
  
  if you have a suitable external hdd you can (optionaly) clone your disk drive
  
  look at Macrium Reflect to see if it suits your needs for free backup utility
  
  use one of the File Managers for your problematic 65 files you wish to delete

....

[Later Edit}

On reflection, some points do not add up ..

If "vista is working fine" then there can't be a problem with MFT surely?

When you say that you "need to delete 65 files" .. do you mean files .. or bad sectors found in chkdsk?

[AndyII]

[Later Edit}

On reflection, some points do not add up ..

If "vista is working fine" then there can't be a problem with MFT surely?

When you say that you "need to delete 65 files" .. do you mean files .. or bad sectors found in chkdsk?

I mean files. At this point, we are speculating that there may be two or more points inside the MFT pointing to the same file which may be why I can't do anything with them. I managed to use TestDisk to make copies of the files to another directory. Now if I can delete them, the MFT will stop pointing to them and I can copy them back.

I don't think this is relevant, but almost all of the files were last modified on the same date. Only a few were different.