cgsecurity.org

I have a 4TB Samsung SSD that developed a MFT error.

Using EASEUS - the whole drive, file structure and all shows everything that should be there.

Checked drive SMART stats and no issues.

Tried CHKDSK and said could not repair MFT.

Ran Testdisk 7.2, partitions show and went to advanced then repair MFT. Program closes

Logs

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 3840 GB / 3576 GiB - SAMSUNG MZ7LH3T8HMLT-000
Partition table type: EFI GPT
New options :
Dump : No
Align partition: Yes
Expert mode : No

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7501476527 (expected 7501476527)
hdr_lba_start=34
hdr_lba_end=7501476494
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 7501475839 7501211648 [Basic data partition] [Samsung SSD]
NTFS, blocksize=4096, 3840 GB / 3576 GiB

Analyse Disk \\.\PhysicalDrive2 - 3840 GB / 3576 GiB - CHS 466945 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7501476527 (expected 7501476527)
hdr_lba_start=34
hdr_lba_end=7501476494
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 7501475839 7501211648 [Basic data partition] [Samsung SSD]

search_part()
Disk \\.\PhysicalDrive2 - 3840 GB / 3576 GiB - CHS 466945 255 63
NTFS at 0/1/1
filesystem size 3586302342
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 224143896
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=32256, part_size=1836186799104, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/1/1
filesystem size 3586302342
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 224143896
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 63 3586302404 3586302342
NTFS, blocksize=4096, 1836 GB / 1710 GiB
NTFS at 466945/70/5
filesystem size 7501211648
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 224143896
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 7501475839 7501211648 [Samsung SSD]
NTFS found using backup sector, blocksize=4096, 3840 GB / 3576 GiB
NTFS at 466945/70/5
filesystem size 7501211648
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 224143896
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 7501475839 15002687486 7501211648
NTFS, blocksize=4096, 3840 GB / 3576 GiB
This partition ends after the disk limits. (start=7501475839, size=7501211648, end=15002687486, disk end=7501476528)
Search for partition aborted
Disk \\.\PhysicalDrive2 - 3840 GB / 3576 GiB - CHS 466945 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (3840 GB / 3576 GiB) seems too small! (< 7681 GB / 7153 GiB)
The following partition can't be recovered:
MS Data 7501475839 15002687486 7501211648
NTFS, blocksize=4096, 3840 GB / 3576 GiB

Results
MS Data 63 3586302404 3586302342
NTFS, blocksize=4096, 1836 GB / 1710 GiB
MS Data 264192 7501475839 7501211648 [Samsung SSD]
NTFS found using backup sector, blocksize=4096, 3840 GB / 3576 GiB
ntfs_attr_open failed: Input/output error.
0 [main] testdisk_win 1966 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump

and the stackdump

Exception: STATUS_ACCESS_VIOLATION at eip=004693A6
eax=00000000 ebx=800B4220 ecx=80018020 edx=800B70C8 esi=800B70C8 edi=00000120
ebp=800B3808 esp=006EC340 program=C:\Users\info\Downloads\testdisk-7.2.win\testdisk-7.2\testdisk_win.exe, pid 1966, thread main
cs=0023 ds=002B es=002B fs=0053 gs=002B ss=002B
Stack trace:
Frame Function Args
End of stack trace

Use ddrescue as described in the manual to clone the disk and make the "read error" message disappear in a new log file.
Run TestDisk against the clone to see if TestDisk crashes again.

If Easeus sees your folder tree structure, use Easeus to extract its content first.

If you want to use TestDisk to repair the MFT, clone the clone and use TestDisk against your second clone.