Failed to fix MFT mirror: write error.

Using TestDisk to repair the filesystem
Message
Author
dragonfly41
Posts: 65
Joined: 14 Sep 2012, 20:51

Re: Failed to fix MFT mirror: write error.

#11 Post by dragonfly41 » 01 Jan 2013, 15:24

Doesn't this help at all to walk you through $MFT?

https://tzworks.net/prototype_page.php?proto_id=12

e.g. perhaps filter by date of file?

Sponsored links

Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: Failed to fix MFT mirror: write error.

#12 Post by Lito » 01 Jan 2013, 18:04

You could try checking the files for the immutable attribute bit.
If this is set, sometimes not even root can remove them.

http://en.wikipedia.org/wiki/Chattr

You will need a Linux distribution disk that includes the chattr command.

For instance Helix 3, a forensics Linux distro (up to this version it was possible to download it for free). This page explain how to get Helix 3 free version. I do not know if is still possible to download a copy. The page says yes, but i did not try it.

Parted Magic includes e2fsprogs and chattr is part of that set of programmes:

http://partedmagic.com/doku.php?id=programs
But I have never tried ruuning it myself from this distro.

More info on chattr command:

http://www.aboutlinux.info/2005/11/make ... -even.html

If I do remember correctly the Windows pagefile is one of such a files. Also i think that if you delete it, Windows does create a new one the next time you boot. But you will need to verify this information.

How to use the TestDisk created image:

http://www.cgsecurity.org/wiki/Image_Creation

Happy New Year!

dragonfly41
Posts: 65
Joined: 14 Sep 2012, 20:51

Re: Failed to fix MFT mirror: write error.

#13 Post by dragonfly41 » 01 Jan 2013, 18:07

And try this tool to delete stubborn files ..

http://technet.microsoft.com/en-us/sysi ... s/bb897556

AndyII
Posts: 52
Joined: 15 Apr 2012, 06:15

Re: Failed to fix MFT mirror: write error.

#14 Post by AndyII » 02 Jan 2013, 05:59

Thank you for the assistance. While I didn't use the Hiren CD, I used the Ultimate Boot CD and the Parted Magic program to delete the files. That is what I needed to accomplish for now.

Post Reply

Who is online

Users browsing this forum: Bing [Bot] and 1 guest