Corrupt Master File Table / Bad Sectors.

GillaGal

Honorable
Nov 23, 2013
17
0
10,510
Seagate HDD with one partition (NTFS), no O/S only data is returning the error "Corrupt Master File Table". I've CHKDSK /F on the drive, but no progress indicator is displayed even after 13+ hours.

Running Seatools there were 73 Bad Sectors identified and "repaired". I've tried a Linux Live CD but the drive cannot be mounted due to missing MFT. Ghost and Redo backup did not work either.

I tried GetDataBack, but the application scans for less than a second and only displays 7.5GB of approximate 150GB of files the 400GB drive. One odd thing I noticed with this app is if I scan FAT32 it takes 1.5 hours and discovers 80k files, but displays nothing to be recovered.

Right now I'm running HDD Regenerator in hopes to fix bad sectors.

Can anyone suggest a method for recovering the data or MFT so I can at least get a copy?
 
Solution
Running CHKDSK in repair mode against a drive with numerous bad sectors was not a wise thing to do.

HDD Regenerator is potentially a drive killer, especially when the drive has a weak head.

The best approach is to clone your drive, sector by sector, using a tool (eg ddrescue) that understands how to work around bad media. Then use data recovery software against the clone.

That said, I would use a disc editor (eg DMDE freeware) to Search for Special Sectors, eg MFT records. There should be an MFT mirror which is a copy of the first part of the MFT.
Running CHKDSK in repair mode against a drive with numerous bad sectors was not a wise thing to do.

HDD Regenerator is potentially a drive killer, especially when the drive has a weak head.

The best approach is to clone your drive, sector by sector, using a tool (eg ddrescue) that understands how to work around bad media. Then use data recovery software against the clone.

That said, I would use a disc editor (eg DMDE freeware) to Search for Special Sectors, eg MFT records. There should be an MFT mirror which is a copy of the first part of the MFT.
 
Solution

GillaGal

Honorable
Nov 23, 2013
17
0
10,510
I followed some instructions in another forum: Used True Image to make a sector-by-sector image, restored that image to a new hard drive, Booted to Windows XP with Hiren's BootCD, from CMD ran "chkdsk /f c:" on the restored copy and still got "Corrupt Master File Table. CHKDSK Aborted". The drive is detected as 0 Bytes.

Tried to repair the MFT with TestDisk in my prior steps too, but it failed.

Will DMDE still be able to search for the MFT in this state?
 

GillaGal

Honorable
Nov 23, 2013
17
0
10,510
How do I show you the contents of the NTFS boot sector?

Keep in mind TestDisk was unsuccessful in recovering the MFT and MFT_mirror. The drive is also not accessible in Windows, returning the error "The file of directory is corrupt or unreadable", not sure if that is a result in me mistakenly restoring the image to a EFI GPT partition (RAID) or not, but I'm currently restoring the the image again to an Intel/PC partition (NTFS).
 
Select Tools -> Search for Special Sector -> NTFS Boot Sector

You should now see the NTFS boot sector, probably at sector 63 or 2048.

Select Tools -> Copy Sectors

In the Source pane ...

Start Sector = 63 or 2048 or other
Number of Sectors = 1

In the Destination pane select File.

You will offered a filename such as "dev128_lba2048_1.bin".

Save it.
 
Sector 0 is a Windows 7 or 8 Master Boot Record:
http://thestarman.pcministry.com/asm/mbr/W7MBR.htm#CHS

Here is the partition table:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000001B0 65 6D 00 00 00 63 7B 9A 7D AC 18 99 65 63 80 20
000001C0 21 00 07 FE FF FF 00 08 00 00 00 80 93 2E 00 00

It shows a single NTFS partition (type 0x07) beginning at sector 2048 (= 0x800) and with a capacity of 781418496 (= 0x2E938000) sectors. That corresponds to 400GB.

0x2E938000 sectors x 512 bytes per sector = 400 086 269 952 bytes

http://www.google.com/search?q=0x2E938000+x+512+in+decimal

Normally there would be an NTFS boot sector at sector 2048.

There would also be a backup NTFS boot sector at the end of the partition, namely sector 781420543 (= 2048 + 781418496 - 1).

Could we see both of these sectors? Sectors 2049, 781420542 and 781420544 would be nice, too.
 
Here is the BIOS Parameter Block in your NTFS boot sector at sector 2048:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 ...NTFS
00000010 00 00 00 00 00 F8 00 00 3F 00 FF 00 00 08 00 00
00000020 00 00 00 00 80 00 80 00 FF 7F 93 2E 00 00 00 00
00000030 00 00 0C 00 00 00 00 00 FF 37 E9 02 00 00 00 00
00000040 F6 00 00 00 01 00 00 00 56 3E 72 CC 66 72 CC 18
00000050 00 00 00 00

It's telling us that ...

Sector Size = 512 bytes
Sectors per Cluster = 8
Starting Cluster Number for the $MFT File = 0x000C0000
Starting Cluster Number for the $MFTMirror File = 0x02E937FF

This means that the $MFT should have been at physical sector ...

2048 + 0x000C0000 x 8 = 6293504

The $MFTMirror should be at physical sector ...

2048 + 0x02E937FF x 8 = 390711288

When you go to those particular sectors, select Mode -> MFT Record.

To go to a particular sector ...

Editor -> Goto Offset
Sector = target sector number
Sector Offset = 0
From Start/End radio button
Decimal radio button

BTW, this is what an NTFS boot sector looks like:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
 

GillaGal

Honorable
Nov 23, 2013
17
0
10,510
Okay, I went to 6293504 sector as instructed, then what?

$MFT at sector 6293504
B86YLr0.png


$MFTMirror at sector 390711288
E18A9pK.png
 

GillaGal

Honorable
Nov 23, 2013
17
0
10,510


I went to both offsets as you instructed. Please see updated screenshots above in here.
 
Sorry, I have content blockers to speed up this web site. Sometimes I don't see the images. However, I do see them now:

http://i.imgur.com/B86YLr0.png
http://i.imgur.com/E18A9pK.png

ISTM that both your $MFT amd $MFTMirror are present, but they are empty.

Here is my own 20GB NTFS Windows XP volume:
http://www.users.on.net/~fzabkar/temp/MFT_example.jpg

I don't see an easy solution for you. Try a raw scan with PhotoRec. PhotoRec tries to locate files via their header information (aka "signature").

http://www.cgsecurity.org/wiki/PhotoRec
 

GillaGal

Honorable
Nov 23, 2013
17
0
10,510
1. Could I perhaps get better results if I use ddrescue sector-by-sector on the failed drive instead of TrueImage sector-by-sector?

2. Should I try this same DMDE process on the original failing drive?

3. Currently running PhotoRec on another image of the drive. It has discovered 6000+ files so far, but going to take a while. Unfortunately PhotoRec doesn't copy over the file names or dir the files are suppose to be in. No way around that huh?

I know TrueDisk is similar to PhotoRec and will get filenames, but that doesn't run due to the MFT.

4. Just found out from another forum that I followed Image restore process incorrectly. I used True Image to restore "Image restore (disks or partitions)" and it should have been restored "Sector-by-Sector".

I'll have to restore that tomorrow and try again?


 
The MFT (Master File Table) is where the directory structure (file names, folder names) is stored.

If I start at my MFT sector and page down, then I eventually arrive at my files and folders:

http://www.users.on.net/~fzabkar/temp/MFT_example_2.jpg

I suggest you do the same. If you see nothing, then that would suggest that your MFT has been wiped. In this case you might like to try Tools -> Search for Special Sector -> MFT Record. Perhaps there are MFT fragments elsewhere on the drive.

As for ddrescue, that appears to be the DIY tool that is most recommended for those cases where there are bad sectors. I would give it a go.