File undelete failing "Record is in use by the mft"

Using TestDisk to undelete files
Post Reply
Message
Author
Inindo
Posts: 1
Joined: 24 Oct 2015, 03:41

File undelete failing "Record is in use by the mft"

#1 Post by Inindo » 24 Oct 2015, 03:47

I am trying to recover files after a RAID array was mistakenly declared failed by Intel Rapid Storage Technology. After rebuilding the parition, I can see the list of my files when I use Undelete. However, when I try to actually undelete a file, I get "Record is in use by the mft" How would I get to fixing this?

Log file is as follows:



Fri Oct 23 21:31:54 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=240063086592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000792444928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=64016220160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240063086592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000792444928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=64016220160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239467495424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4000650887168
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=64016203776
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29186 255 63, sector size=512
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Disk /dev/sdd - 64 GB / 59 GiB - CHS 7782 255 63, sector size=512
Drive C: - 239 GB / 223 GiB - CHS 29113 255 63, sector size=512
Drive D: - 4000 GB / 3725 GiB - CHS 486384 255 63, sector size=512
Drive G: - 64 GB / 59 GiB - CHS 7782 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 3518814208 > partition 4294967295
check_part_i386 failed for partition type 07
1 * HPFS - NTFS 16 113 34 267365 202 36 4294967295


Files with potentially recoverable content: 14944
1 * HPFS - NTFS 16 113 34 267365 202 36 4294967295
Directory /

*Snip a LOT of file names*


Record is in use by the mft
Record is in use by the mft
Record is in use by the mft
Record is in use by the mft
Record is in use by the mft
TestDisk exited normally.

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3619
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete failing "Record is in use by the mft"

#2 Post by cgrenier » 26 Oct 2015, 17:21

You can have this message when the original file was fragmented or when new files have been written on the disk after the deletion.
If everything failed, you can try PhotoRec on the free space of the partition.
Good luck

Post Reply

Who is online

Users browsing this forum: No registered users and 10 guests