NTFS Filesystem repair

Using TestDisk to repair the filesystem
Post Reply
Message
Author
littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

NTFS Filesystem repair

#1 Post by littlebiggtoe » 06 May 2017, 18:54

I have a 1TB NTFS external backup drive that is unreadable. The drive has a single NTFS parition on it, which Windows disk management now shows as RAW. Below is a list of things that I have found and things I have tried.

1. Run chkdsk /r on the drive, which says the mft is corrupt. chkdsk is unable to repair it and aborts

2.Using TestDisk 7.1 WIP went to advanced->boot where there were warnings about the number of heads and sectors being incorrect (both were set to 1). Both the boot sector and its backup had a status of 'OK'. Running repairMFT, TestDisk reports that both the MFT and its mirror are perfectly matched. I also ran RebuildBS (without changing any disk geomentry) which didn't seem to do anything. I cannot list the files from the partition

4. Under Geometry I set Heads = 255 and Sectors = 63 based on the recommendation from TestDisk. Analyze shows the NTFS partition, but I cannot list files. Running RepairMFT and RebuildBS again made no difference.

5. Under Analyze I did a deep search, which found a bunch of bogus partitions. Thinking that perhaps there were issues with the partition table I selected the NTFS partition from the quick search and wrote it to disk. Still not change.


From all of this I have gathered that my partition table is fine, but that my MFT is fried since I can't get to the filesystem. I was able to view some of the files using the Zero Assumption Recovery linked in the wiki. Any suggestions as to how I can recover the filesystem on this drive?

Thanks! :D

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3553
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS Filesystem repair

#2 Post by cgrenier » 07 May 2017, 15:57

You can always use PhotoRec to recover the data, select the disk and next the partition, Search, choose [Whole] instead of [Free].
It will not recover the original filenames.

littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

Re: NTFS Filesystem repair

#3 Post by littlebiggtoe » 07 May 2017, 18:57

Yeah, that was going to be the final step I took. Does that mean you don't think the filesystem is recoverable?

User avatar
cgrenier
Site Admin
Posts: 3553
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS Filesystem repair

#4 Post by cgrenier » 09 May 2017, 06:01

To recover the original filenames you can try various commercial data recovery utilities but in your case TestDisk can't handle the corruption of your NTFS filesystem,
it's why I told you to try PhotoRec.

littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

Re: NTFS Filesystem repair

#5 Post by littlebiggtoe » 10 May 2017, 00:46

Okay, thank you. I appreciate your help and thank you for your awesome software!

littlebiggtoe
Posts: 4
Joined: 06 May 2017, 17:11

Re: NTFS Filesystem repair

#6 Post by littlebiggtoe » 11 May 2017, 17:17

Just thought I would post here that I successfully restored access to the filesystem. It turns out that the MFT and its mirror were intact, but were shifted out of place. I found this using a pretty powerful piece of freeware called Active Disk Editor by LSoft Technologies (http://www.lsoft.net/disk-editor.aspx). It turns out the boot sector was pointing to the correct sector for the MFT, but the MFT file was offset by 128 bytes instead of 0 bytes. The MFT_MIRR and logfile were both offset by the same amount. Shifting them all up by 128 bytes so that they were properly aligned with the start of their repsective sector fixed the issue and got me access to the filesystem. I am currently copying files off the drive and plan on reformatting it so I get a clean filesystem.

All in all I feel VERY thankful. Thanks again.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests