MFT damaged Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Support Forum » Disk Editing » MFT damaged « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Peter G (Petergr)
Posted on Thursday, Oct 20, 2005 - 13:38:   

I am looking at a disk that has become inaccessible in Windows. It is the boot drive for an XP pro PC. Running chkdsk gives "unrecoverable disk error". I have tried a few data recovery programs (Ontrack and File Scavenger) which are successfully able to see the folder structure and files, however they are not able to complete and appear to hang - presumably because of some corruption somewhere. I have now successfully used Winhex and recovered by file type a large number of files which was good news (after two days trying to do it with the other programs. What I would like to know is how I can view the $MFT and mirror, and how I can swap the mirror into the place of the original. I have tried to click on "access" "MFT Tables" but the list is empty. At one point I was able to see a listing of these but I can no longer see how to do it. I am presuming that if I can do this I may be able to restore the directory structure into its original format or at least some of it!! (Currently I have one large folder with 9000 files in it.

Thanks for your help.

Peter
Top of pagePrevious messageNext messageBottom of page Link to this message

Terry Greenwood (Greenwood)
Posted on Thursday, Oct 20, 2005 - 13:49:   

Depending on what the actual error is, you may be lucky if you connect the faulty drive to a system running XP. On booting, the 'good' system will check the file system of attached drives and might fix your problem.

Having said that , I have seen this repair function completely screw a disk up so make sure that you have imaged the drive first !
Top of pagePrevious messageNext messageBottom of page Link to this message

Peter G (Petergr)
Posted on Thursday, Oct 20, 2005 - 14:38:   

The drive currently is connected to a PC running XP and is not visble, and could not be repaired with chkdsk or disk management console. I can extract specific files using winhex, but I was hoping to restore the drive with directory structure.

Peter
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann (Admin)
Posted on Thursday, Oct 20, 2005 - 18:33:   

> What I would like to know is how I can view the $MFT and
> mirror, and how I can swap the mirror into the place of
> the original.

The boot sector might still point to the clusters where $MFT and $MFTMirr start (use the template to interpret the boot sector). If so, you know which clusters to copy over which other clusters (copy & paste). Otherwise you have to manually locate both system files manually first.
Top of pagePrevious messageNext messageBottom of page Link to this message

Peter G (Petergr)
Posted on Friday, Oct 21, 2005 - 10:05:   

Thanks Stephan, I will have another attempt. This is a good learning process :)

Peter

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have an account.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.