Testdisk shows MFT and MFT Mirror Bad - What next
First of all, hello to all on these forums. I really hope you will be able to help. I found these forums after reading a post by Thrax on another topic, who seemed to know about this issue. Any help would be greatly appreciated.
My slave sata drive (a Western Digital 1600JD) corrupted today when my computer locked up for the first time ever in 3 years, and it will not open when in windows. I have been trying to fix it for over 6 hours now and am very lost, however, after much beating around I have concluded the following.
- Windows is showing the drive as RAW
- Testdisk shows that the MFT and MFT mirror are bad
I am stuck now what to do. I can't get chkdsk /r to work on the slave D: drive as nothing happens. If testdisk identifies and MFT and MFT mirror are bad is all hope of recovery over?
My slave sata drive (a Western Digital 1600JD) corrupted today when my computer locked up for the first time ever in 3 years, and it will not open when in windows. I have been trying to fix it for over 6 hours now and am very lost, however, after much beating around I have concluded the following.
- Windows is showing the drive as RAW
- Testdisk shows that the MFT and MFT mirror are bad
I am stuck now what to do. I can't get chkdsk /r to work on the slave D: drive as nothing happens. If testdisk identifies and MFT and MFT mirror are bad is all hope of recovery over?
0
Comments
I did the deep scan but did not proceed with the repair as I was unable to see that option. I did proceed with a write though, which made no difference.
Have you tried this technique yet?
Link says
* HPFS - NTFS 0 1 1 1274 254 63 20482812
Mine says;
* HPFS - NTFS 0 1 1 19456 254 63 312576642
I think the two differences come from the drive being a different size to the example?
The drive has no OS on it and is used purely as slave for my documents. I still tried the MBR technique, did the restart, let windows install the drive and then restarted as prompted but it made no difference to the problem.
I know there is data on the drive still as I have been able to recover certain files used photorec. However, I think I am beginning to get into this problem. Things I can conclude are:
* HPFS - NTFS 0 1 1 19456 254 63 312576642
Pressing 'P' does not list files as it says 'Can't Open the Filesystem
My MFT and MFT mirror are both bad.
Where does it say that the MBR is intact? Mine states the following on the advanced screen:
1 P HPFS - NTFS 0 1 1 19456 254 63 312576642
BootSector
Status: OK
Backup Bootsector
Status: OK
Sectors are identical
A Valid NTFS Boot Sector must be present in order to access any data; even if the partition is not bootable
When I try and rebuild the BS, nothing really changes. Repairing the MFT states:
MFT and MFT Mirror are bad. Failed to Repair them.
I can Dump, what does that do though?
any help, thanks
hello to anyone who finds themselves in this situation. i believe i have found a solution, if your drive is in fairly good condition, and you haven't written anything to it since "the crash" or whatever. never write to the corrupted drive at any time while recovering data.
here's what i did:
1. obtain GetDataBack NTFS. use default settings, and check all boxes in the options except for "Excessive search".
2. SPECIFY LOGFILE in the Environment tab of Options. you'll need it later.
3. select your corrupted drive in step 2, then hit next.
4. take a nap, run it overnight, whatever. my drive was 300gb and it took about 5 hours to scan.
5. when the scan is done, you'll probably see a bunch of folders that you recognize. that's good, recovering is straightforward (just select, right click -> copy).
if, however, you see files that have blank filenames, you will need to rename them yourself. the way to determine the filename is by using the ID number in the "ID" column of the Recovery Browser and by looking the logfile you specified in step 2:
a. let's say you have a file with a blank name. scroll to the right to see what its ID number is.
b. open the log file and search for "ID<the ID number>", no quotes, where <the ID number> is the ID number from step b. hopefully something will be found, like this:
Added '' ID155, Mft#4E22 @sec 006080E3(2), parent 4E20, 3/12/2007
c. now, search for the Mft#, so in this case you would do a search for "4E22", no quotes. that should take you to the line with the filename you want, like so:
Index info added FileName=GGS3SRanBat2.1.divx, Mft=x4E22[x1], ParentMft=x4E20[x1], ( )
d. rename your blank-named file accordingly, then right-click -> Copy to recover.
this filename-recovery method works for directories too.
sometimes, a whole folder will be deleted, and you don't want to rename each thing individually. that's ok. select that folder and copy it, and when prompted with the "file already exists" message or whatever, just select the "rename all" option. so then you'll get a folder with files like (2), (3), (4), etc. now, to rename them all, just go to the logfile and grab the filenames. usually the whole folder's contents will be listed in a group in the logfile. copy those lines into a new text file, and isolate the filenames by surrounding each side of the names with tab characters (search and replace is your friend). then copy paste into excel. now you should have a column of filenames, and columns of other stuff that was next to the filenames. all you need is the column with filenames. in excel, it's easy to create a sequence of numbers, just by dragging the lower-right corner of a number. ok, rest should be self-explanatory. you should ultimately get something like this:
ren (2) "01 astair.mp3"
ren (3) "02 acting like a fool.mp3"
ren (4) "03 tv gods.mp3"
ren (5) "04 shimmering fields.mp3"
ren (6) "05 movin' on.mp3"
ren (7) "B0001Z8OCK.01._SCLZZZZZZZ_[1].jpg"
just paste into your dos prompt.
hope this helps someone! i'm just happy i got all my files back