Corrupt NTFS partition's MFT – Which tool is right? What tool to fix?
If the MFT$ file got corrupted, try R-STUDIO to rescue the data on that drive.
Important: Do not perform any write operation to the corrupted drive!
- attach the corrupted drive to a working windows system
- analyze the drive using r-studio
- copy any good data to a new drive
- delete all partitions on the corrupted drive ("old drive")
- create a new partition on the old drive and format
- use a tool of your choice to analyze the drives hardware, if required.
Done!
unndreay
Updated on September 18, 2022Comments
-
unndreay over 1 year
I used Avira Rescue Disk (Ubuntu 12.04) to access a broken NTFS boot partition. Windows 7 fails to mount it: it displays a bluescreen ("UNMOUNTABLE_BOOT_VOLUME") and restarts immediately. With the Rescue Disk I could backup the most important data (Ubuntu does not fail on mounting). Now I tried
gparted
to fix the partition. To analyse the partition, gparted runs a scanning-onlyntfsresize
first.A similar (= non-writing) but manual run of
ntfsresize -info --force /dev/sda3
gives:ntfsresize v2012.1.15AR.1 (libntfs-3g) Device name : /dev/sda3 NTFS volume version: 3.1 Cluster size : 4096 bytes Current volume size: 484336226816 bytes (484337 MB) Current device size: 484336230400 bytes (484337 MB) Checking for bad sectors ... Checking filesystem consistency ... 0,00 percent completed .. .. .. 12,83 percent completed ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler Failed to read of MFT, mft=73604 count=1 br=-1: Eingabe-/Ausgabefehler (= I/O error) ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler Failed to read of MFT, mft=73605 count=1 br=-1: Eingabe-/Ausgabefehler ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler Failed to read of MFT, mft=73606 count=1 br=-1: Eingabe-/Ausgabefehler ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler Failed to read of MFT, mft=73607 count=1 br=-1: Eingabe-/Ausgabefehler 12,85 percent completed .. .. .. 100.00 percent completed Accounting clusters ... Cluster accounting failed at 9962391 (0x980397): extra cluster in $Bitmap .. .. .. Cluster accounting failed at 9963113 (0x980669): extra cluster in $Bitmap Filesystem check failed! Totally 723 cluster accounting mismatches. ERROR: NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE! The usage of the /f parameter is very IMPORTANT! No modification was and will be made to NTFS by this software until it gets repaired.
So, the $MFT seems to be broken. However,
ntfsfix --no-action /dev/sda3
(non-writing) states:avira@avira:~$ sudo ntfsfix -n /dev/sda3 Mounting volume... OK Processing of $MFT and $MFTMirr completed successfully. NTFS volume version is 3.1. NTFS partition /dev/sda3 was processed successfully.
Whom can I trust? What really happened to my $MFT? Why can Ubuntu still read most of the files, and Win 7 fails to mount (expect from being Windows)? What tool should I use to fix the MFT:
gparted
ortestdisk
orntfsfix
(without--no-action
) orchkdsk /f
? Haven't felt lucky yet. I've read abouttestdisk
being able to mess up $MFT and $MFTMirr in severe cases. Could that happen?Additionally, SMART reports one bad sector (Reallocated Sectors Count = 1). Should I renew the disk in any event?
What can I run else to (at least) locate the error (e.g. affected filenames, electromechanical failure y/n?) better?
-
Ramhound about 10 yearsYour hdd failed your MFT was on the corrupted sector.
-
unndreay about 10 years@Ramhound Obviously, yes. What next? Should I try
chkdsk /r
? -
Ĭsααc tիε βöss almost 8 yearsTestDisk will be the savior, read its documentation and do the actions carefully.
-
kreemoweet over 7 yearsLinux doesn't have a (free) equivalent of Window's chkdsk. That's why it's suggested for use by the Linux utilities you used. I don't see where you followed those suggestions . . .
-