Doesn't this help at all to walk you through $MFT?
https://tzworks.net/prototype_page.php?proto_id=12
e.g. perhaps filter by date of file?
Failed to fix MFT mirror: write error.
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Re: Failed to fix MFT mirror: write error.
You could try checking the files for the immutable attribute bit.
If this is set, sometimes not even root can remove them.
http://en.wikipedia.org/wiki/Chattr
You will need a Linux distribution disk that includes the chattr command.
For instance Helix 3, a forensics Linux distro (up to this version it was possible to download it for free). This page explain how to get Helix 3 free version. I do not know if is still possible to download a copy. The page says yes, but i did not try it.
Parted Magic includes e2fsprogs and chattr is part of that set of programmes:
http://partedmagic.com/doku.php?id=programs
But I have never tried ruuning it myself from this distro.
More info on chattr command:
http://www.aboutlinux.info/2005/11/make ... -even.html
If I do remember correctly the Windows pagefile is one of such a files. Also i think that if you delete it, Windows does create a new one the next time you boot. But you will need to verify this information.
How to use the TestDisk created image:
http://www.cgsecurity.org/wiki/Image_Creation
Happy New Year!
If this is set, sometimes not even root can remove them.
http://en.wikipedia.org/wiki/Chattr
You will need a Linux distribution disk that includes the chattr command.
For instance Helix 3, a forensics Linux distro (up to this version it was possible to download it for free). This page explain how to get Helix 3 free version. I do not know if is still possible to download a copy. The page says yes, but i did not try it.
Parted Magic includes e2fsprogs and chattr is part of that set of programmes:
http://partedmagic.com/doku.php?id=programs
But I have never tried ruuning it myself from this distro.
More info on chattr command:
http://www.aboutlinux.info/2005/11/make ... -even.html
If I do remember correctly the Windows pagefile is one of such a files. Also i think that if you delete it, Windows does create a new one the next time you boot. But you will need to verify this information.
How to use the TestDisk created image:
http://www.cgsecurity.org/wiki/Image_Creation
Happy New Year!
-
dragonfly41
- Posts: 67
- Joined: 14 Sep 2012, 20:51
Re: Failed to fix MFT mirror: write error.
And try this tool to delete stubborn files ..
http://technet.microsoft.com/en-us/sysi ... s/bb897556
http://technet.microsoft.com/en-us/sysi ... s/bb897556
Re: Failed to fix MFT mirror: write error.
Thank you for the assistance. While I didn't use the Hiren CD, I used the Ultimate Boot CD and the Parted Magic program to delete the files. That is what I needed to accomplish for now.