Corrupted MFT in RAID 1 array

Using TestDisk to repair the filesystem
Post Reply
Message
Author
redwoodie
Posts: 2
Joined: 06 Aug 2014, 06:27

Corrupted MFT in RAID 1 array

#1 Post by redwoodie » 06 Aug 2014, 17:53

I have a 1 TB RAID1 array on a 3ware 9650SE-2LP adapter with 2-WD 1 TB Black drives, single NTFS partion. It is a data only array, not used to boot. Running Windows 7 SP1. The drive began giving corrupted file errors, and CHKDSK would repair them on boot. Then it became inacccessible/unreadable.

The 3ware software manager 3DM2 then re-initialized the array (apparently automatically, I did not give any command to do this--it took almost 24 hours), but the files can't be accessed--CHKDSK now gives the message "Corrupted MFT--Windows will try to repair--Repair failed, CHKDSK aborting." Windows Explorer says disk is corrupted and unreadable. But 3DM2 says the array and component drives are OK. I swapped the controller for a spare I had and got the same results, so I've ruled out a bad card.

I tried running Testdisk on the array from DOS and it will not see the array (lack of RAID driver).

At this point I need to recover the data if possible to another drive and then deal with any physical disk or controller problems. I connected one of the 1TB drives to the MB controller (it still gives corrupted messages) and ran Testdisk from Windows on it. It sees the 931GB primary partition, but on List files I got the message "Can't open file system. File system seems damaged."

I'm wondering if the re-initialization the controller did may have compounded the problem (or overwritten the backup MFT?) Usually Raid controllers rebuild corrupted mirrors, but it seems this time it re-formatted it.

Should I try repairing the NTFS boot sector, the MFT or both? The page on repairing NTFS boot/MFT refers to the Advanced menu, not sure how to locate that. Screenshots and step by step instructions would help. Thanks!
Log file info:


Tue Aug 5 22:12:08 2014
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER

<grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-

04-28T11:42:38
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32

IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\

\.\PhysicalDrive1)=120034123776
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=73400320000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=10421796864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)

=999986036736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32

IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=0
Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=0
Warning: can't get size for \\.\N:
filewin32_getfilesize(\\.\Q:)

GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\Q:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\Q:
filewin32_getfilesize(\\.\R:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\R:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\R:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC

WD1003FBYX-01Y7B1, S/N:2020202057202d44435757413633333637323039, FW:01.01V02
Disk /dev/sdb - 120 GB / 111 GiB - CHS 55084 224 19,

sector size=512 - OCZ-VERTEX2, S/N:434f2d5a4a55595a55424d503835383252315447, FW:1.11

Partition table type (auto): Intel
Disk

/dev/sda - 1000 GB / 931 GiB - WDC WD1003FBYX-01Y7B1
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS

121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0

32 33 121574 213 47 1953097728
No partition is bootable
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in

$MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi

sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi sector transfer

detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi

sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume:

Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output

error.

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953097728
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121574 213 47 1953097728
NTFS, blocksize=4096, 999 GB / 931

GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek

err Invalid argument
file_pread(4,15,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525776

(121601/90/42)) lseek err Invalid argument
file_pread(4,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread

(4,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(4,11,buffer,1953525886(121601/92/26)) lseek err Invalid

argument
file_pread(4,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33

121574 213 47 1953097728
NTFS, blocksize=4096, 999 GB / 931 GiB
Not an exFAT boot sector.

* HPFS - NTFS 0 32 33

121574 213 47 1953097728
NTFS, blocksize=4096, 999 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT

boot sector.

* HPFS - NTFS 0 32 33 121574 213 47 1953097728
NTFS, blocksize=4096, 999 GB / 931 GiB
Can't open

filesystem. Filesystem seems damaged.

interface_write()
1 * HPFS - NTFS 0 32 33 121574 213 47 1953097728
Incomplete

multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume:

Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output

error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to

startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT:

Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output

error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load

$MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

Sponsored links

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests