Can't read MFT?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Induna123
Posts: 15
Joined: 17 Jul 2012, 13:21

Can't read MFT?

#1 Post by Induna123 »

Image

I have a 500GB PATA IDE Hard drive (Western Digital WD5000AAKB). It seems the MFT is corrupt or bad. The drive was split into two drives, 34GB and 430GB after formatting with NTFS. The first drive still shows up in Windows but the larger one doesn't.

I ran testdisk, (click on thumbnail screenshots above). I did a deep scan and testdisk says hard disk seems too small.

The jumper setting is correct so not sure why it's saying this. Strange thing is testdisk can list the files on the missing partition. Any ideas?

Here is the log

Code: Select all


Mon Aug 26 16:57:19 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=122941242880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=122941242880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=26246836224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=96688134144
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=37507244544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=462597940224
Hard disk list
Disk /dev/sda - 122 GB / 114 GiB - CHS 14946 255 63, sector size=512 - Maxtor 6Y120P0, S/N:335958325a504533202020202020202020202020, FW:YAR41BW0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKB-00H8A0, FW:05.04E05

Partition table type (auto): XBox
Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - WDC WD5000AAKB-00H8A0
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
file_pread(5,4096,buffer,6291519(391/160/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,6294317(391/204/51)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
NTFS at 4560/1/1
file_pread(5,4096,buffer,73256487(4560/1/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,73256506(4560/1/44)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
 1 * HPFS - NTFS              0   1  1  4559 254 63   73256337
 2 E extended LBA          4560   0  1 60800 254 63  903511665
 5 L HPFS - NTFS           4560   1  1 60800 254 63  903511602

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size           73256337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               4578521
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4096,buffer,6291519(391/160/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,6294317(391/204/51)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS              0   1  1  4559 254 63   73256337
     NTFS, blocksize=4096, 37 GB / 34 GiB
file_pread(5,4096,buffer,73256487(4560/1/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,73256506(4560/1/44)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
NTFS at 4560/1/1
filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4088,buffer,73256495(4560/1/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,73256506(4560/1/44)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
file_pread(5,2,buffer,976771072(60801/47/47)) lseek err Invalid argument
file_pread(5,1,buffer,976771072(60801/47/47)) lseek err Invalid argument
file_pread(5,1,buffer,976771071(60801/47/46)) lseek err Invalid argument
file_pread(5,1,buffer,976771072(60801/47/47)) lseek err Invalid argument
file_pread(5,14,buffer,976771073(60801/47/48)) lseek err Invalid argument
file_pread(5,3,buffer,976771087(60801/47/62)) lseek err Invalid argument
file_pread(5,3,buffer,976771134(60801/48/46)) lseek err Invalid argument
file_pread(5,8,buffer,976771150(60801/48/62)) lseek err Invalid argument
file_pread(5,11,buffer,976771197(60801/49/46)) lseek err Invalid argument
file_pread(5,2,buffer,976773119(60801/80/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * HPFS - NTFS              0   1  1  4559 254 63   73256337
     NTFS, blocksize=4096, 37 GB / 34 GiB
   L HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * HPFS - NTFS              0   1  1  4559 254 63   73256337
 2 E extended LBA          4560   0  1 60800 254 63  903511665
 5 L HPFS - NTFS           4560   1  1 60800 254 63  903511602

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size           73256337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               4578521
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4096,buffer,6291519(391/160/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,6294317(391/204/51)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS              0   1  1  4559 254 63   73256337
     NTFS, blocksize=4096, 37 GB / 34 GiB
file_pread(5,16,buffer,15503747(965/16/15)) ReadFile Data error (cyclic redundancy check).

NTFS at 4559/254/63
filesystem size           73256337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               4578521
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4096,buffer,6291519(391/160/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,6294317(391/204/51)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS              0   1  1  4559 254 63   73256337
     NTFS found using backup sector, blocksize=4096, 37 GB / 34 GiB
file_pread(5,4096,buffer,73256487(4560/1/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,73256506(4560/1/44)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
NTFS at 4560/1/1
filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4088,buffer,73256495(4560/1/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,73256506(4560/1/44)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
file_pread(5,16,buffer,147789887(9199/126/15)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,183394304(11415/195/45)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,183394303(11415/195/44)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,183394306(11415/195/47)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,183394310(11415/195/51)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,384405583(23928/35/59)) ReadFile Data error (cyclic redundancy check).

NTFS at 60800/254/63
filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4096,buffer,73256487(4560/1/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,73256506(4560/1/44)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS found using backup sector, blocksize=4096, 462 GB / 430 GiB
NTFS at 60800/254/63
filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4096,buffer,976768088(60801/0/24)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,976771055(60801/47/30)) ReadFile The drive cannot find the sector requested.

NTFS: Can't read MFT
     HPFS - NTFS          60800 254 63 117041 253 62  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
This partition ends after the disk limits. (start=976768064, size=903511602, end=1880279665, disk end=976771055)
file_pread(5,2,buffer,976771072(60801/47/47)) lseek err Invalid argument
file_pread(5,1,buffer,976771072(60801/47/47)) lseek err Invalid argument
file_pread(5,1,buffer,976771071(60801/47/46)) lseek err Invalid argument
file_pread(5,1,buffer,976771072(60801/47/47)) lseek err Invalid argument
file_pread(5,14,buffer,976771073(60801/47/48)) lseek err Invalid argument
file_pread(5,3,buffer,976771087(60801/47/62)) lseek err Invalid argument
file_pread(5,3,buffer,976771134(60801/48/46)) lseek err Invalid argument
file_pread(5,8,buffer,976771150(60801/48/62)) lseek err Invalid argument
file_pread(5,11,buffer,976771197(60801/49/46)) lseek err Invalid argument
file_pread(5,2,buffer,976773119(60801/80/15)) lseek err Invalid argument
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 962 GB / 896 GiB)
The following partition can't be recovered:
     HPFS - NTFS          60800 254 63 117041 253 62  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * HPFS - NTFS              0   1  1  4559 254 63   73256337
     NTFS, blocksize=4096, 37 GB / 34 GiB
   L HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * HPFS - NTFS              0   1  1  4559 254 63   73256337
 2 E extended LBA          4560   0  1 60800 254 63  903511665
 5 L HPFS - NTFS           4560   1  1 60800 254 63  903511602
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 4560/0/1,lba=73256400

TestDisk exited normally.
Last edited by Induna123 on 09 Sep 2013, 07:15, edited 1 time in total.
Top
FaulknerPeggy
Posts: 1
Joined: 04 Sep 2013, 11:40

Re: The hard disk seems too small!

#2 Post by FaulknerPeggy »

Hi, as far as I remember in this video screencast http://wowmp3.net/watch/7JV4HpJNgGs/Par ... Screencast they show how you can deal with this problem. Try to take a look, this might help you out with that.
Top
User avatar
cgrenier
Site Admin
Posts: 5439
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: The hard disk seems too small!

#3 Post by cgrenier »

It's a false positive cause by the NTFS backup boot sector.
Run TestDisk, Advanced, select tour NTFS partition, Boot, RebuildBS, List. If it works, choose Write, confirm, Quit, reboot your computer and run "chkdsk /f d:" (replace d: by the correct drive letter) if you still have problem to access your files.
Top
Induna123
Posts: 15
Joined: 17 Jul 2012, 13:21

Re: The hard disk seems too small!

#4 Post by Induna123 »

OK I did all that and the problem still persists. I can list the files on the drive in TestDisk (and have copied some of them to another drive) but the drive itself won't show up in Windows. (The 500GB disk drive should show up as E: and F:).

Image

Image

Here is the new log. It still says "can't read MFT". Should I try the "Repair MFT" command next to the "Rebuild BS command"? (BTW I removed the list of files/dir from the log).

Code: Select all

Sun Sep  8 20:10:59 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=122941242880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=122941242880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=26246836224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=96688134144
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=37507244544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=462597940224
Hard disk list
Disk /dev/sda - 122 GB / 114 GiB - CHS 14946 255 63, sector size=512 - Maxtor 6Y120P0, S/N:335958325a504533202020202020202020202020, FW:YAR41BW0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKB-00H8A0, FW:05.04E05

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - WDC WD5000AAKB-00H8A0
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
file_pread(5,4096,buffer,6291519(391/160/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,6294317(391/204/51)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
NTFS at 4560/1/1
file_pread(5,4096,buffer,73256487(4560/1/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,73256506(4560/1/44)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=255 nbr=6
 1 * HPFS - NTFS              0   1  1  4559 254 63   73256337
     NTFS, blocksize=4096, 37 GB / 34 GiB
 2 E extended LBA          4560   0  1 60800 254 63  903511665
 5 L HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB

ntfs_boot_sector
 5 L HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
NTFS at 4560/1/1
NTFS at 4560/1/1
filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 451755800, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn             3
ntfs_find_mft: mftmirr_lcn         56469475
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn             3
ntfs_find_mft: mftmirr_lcn         56469475
ntfs_find_mft: mft_record_size     1024
ntfs_find_mft: index_block_size    4096
Extrapolated boot sector and current boot sector are identical.
filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1

file_pread(5,16,buffer,73256497(4560/1/35)) ReadFile Data error (cyclic redundancy check).

Directory /

filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1

ntfs_boot_sector
 5 L HPFS - NTFS           4560   1  1 60800 254 63  903511602
     NTFS, blocksize=4096, 462 GB / 430 GiB
NTFS at 4560/1/1
NTFS at 4560/1/1
filesystem size           903511602
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               56469475
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Can't read MFT?

#5 Post by Fiona »

Repair NTFS is an option in compliance with chkdsk, if chkdsk doesn't work.
After trying to repair your MFT you can have another try to run chkdsk.
Often chkdsk will work then.
Chkdsk is a utility to have a try to repair a file system but not to recover data.
As long as you're able to copy data, you should do that first.
If testdisk doesn't list your data, you should use datarecovery software which reads data underlying in your sectors like PhotoRec or if you'd like to recover file names and directories have a look for commercial software.
Rebuild BS doesn't help as much because of the rebuilded bs and the current are both equal.
So there is no change.
It normally indicates that your file system is faulty.

Fiona
Top
Induna123
Posts: 15
Joined: 17 Jul 2012, 13:21

Re: Can't read MFT?

#6 Post by Induna123 »

I just want to say thank you to both of you. I misunderstood the relevance of chkdsk. I did run it with the /f switch and it repaired the MFT and my files are now readable in Windows.

Here's a screenshot

Image


I will certainly be making a donation for you app as it has saved over 400GB of my data, plus I'll recommend TestDisk to anybody has a problem with their drive.

Thank you again.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Can't read MFT?

#7 Post by Fiona »

Chkdsk found some bad sectors.
You'll find some information about in your last screen.
It's one cluser.
Cluster is a group of 8 sectors.
Could you run crystaldiskinfo or another diagnose tool like smartmon or diagnose tool of your manufacturer of your disk as a diagnose?
http://crystalmark.info/software/Crysta ... dex-e.html
If the amount of bad sectors increase, you should replace your disk!
Pleas backup all data.

Fiona
Top
Almaz
Posts: 1
Joined: 06 Nov 2013, 06:34

Re: Can't read MFT?

#8 Post by Almaz »

Hi!
A similar problem.
Sata hard drive WD320.
cgrenier wrote:Run TestDisk, Advanced, select tour NTFS partition, Boot, RebuildBS, List.
It is don't work.
displays a message. "Can't open filesystem. Filesystem seems damaged."
Please help!
Attachments
5.jpg
5.jpg (62.98 KiB) Viewed 14646 times
6.jpg
6.jpg (70.49 KiB) Viewed 14646 times
Top
Locked

Return to “Partition Recovery”