|
I volunteered to help a friend of the wife's last week with computer problems. The workstation belongs to a local church and contains years of business information. The workstation refuses to boot. Plugging the drive in as a slave starts chkdisk which reports that the master file table is corrupt, and aborts. The drive is not accessible through explorer, which reports the same error. I was able to recover all files on the disk using photorec however, it meant losing filenames and directory information. I am about to dig out the old XP CD's and try a repair. Has anybody had any luck fixing a corrupted master file table? Google results on this one look pretty grim. The sad thing is, this is a pro-bono job, and I already have a few hours in it. (not counting the 16 hours it took to recover the files to another disk) Here goes nothing....
"Go forth into the source" - Neal Morse
|
|
|
|
|
Did you do the fdisk /fixmbr
|
|
|
|
|
Tried it. I finally dug out the XP Home CD and have given up hope on anything but a re-install so that I can at least give them the computer back running with their recovered data on DVDs. Formatting now,... I suppose I am past the point of no return. With any luck all they really need are the quickbooks files and office documents.
"Go forth into the source" - Neal Morse
|
|
|
|
|
kmoorevs wrote: Formatting now,...
Either the disk failed, or they turned off the computer without shutting it down. If you even suspect the disk failed, replace it. Microsoft is so poor at dealing with failed disks that it can't ever be reliable on anything but a fully functioning one (XP let me install it to a drive where the heads were glued to the platter and never once squawked about any kind of problem.. it didn't even take longer to install). Oh, and make sure you format it for NTFS 
We can program with only 1's, but if all you've got are zeros, you've got nothing.
|
|
|
|
|
mbr and mft are different things, at different levels.
|
|
|
|
|
Yes, I know, I brain farted....
|
|
|
|
|
Hi, there's MFT mirror afaik (on the disk itself - $MFTMirr). It should contain few backup records from MFT. Mainly the MFT itself. It might be, that corrupted is only the information about MFT (volume information which contains MFT location). If I can recommend you a software I would use GetDataBack for NTFS. Anything else would require more detailed analysis of this disk contents. To see what's there and what's not. Which entries are corrupted or if structure is corrupted itself. I'm off to bed now.
regards,
Kate
P.S.: If you want to dig deeper, try this program.
Disk Editor[^]
modified 23-Jun-14 19:44pm.
|
|
|
|
|
I love GetDataBack as it has saved my ass a couple of times.
|
|
|
|
|
kmoorevs wrote: I volunteered to help a friend of the wife's last week with computer problems
Words of Wisdom: Don't ever do that again
If it's not broken, fix it until it is
|
|
|
|
|
Do you fix computers?
Not if I can avoid it!!
*actual conversation last week*
|
|
|
|
|
kmoorevs wrote: I volunteered to help a friend of the wife's last week with computer problems. The workstation belongs to a local church and contains years of business information. The workstation refuses to boot. Plugging the drive in as a slave starts chkdisk which reports that the master file table is corrupt, and aborts. The drive is not accessible through explorer, which reports the same error. I was able to recover all files on the disk using photorec however, it meant losing filenames and directory information. I am about to dig out the old XP CD's and try a repair. Has anybody had any luck fixing a corrupted master file table? Google results on this one look pretty grim. The sad thing is, this is a pro-bono job, and I already have a few hours in it. (not counting the 16 hours it took to recover the files to another disk) Here goes nothing....
Download Parted Magic[^] (will cost you USD$4.99) and burn it to a USB with YUMI[^].
Then boot from the USB and run through this tutorial[^].
If the repair of the MFT doesn't work you can at least copy off the files with folder structure from within the TestDisk command line.
Michael Martin
Australia
"I controlled my laughter and simple said "No,I am very busy,so I can't write any code for you". The moment they heard this all the smiling face turned into a sad looking face and one of them farted. So I had to leave the place as soon as possible."
- Mr.Prakash One Fine Saturday. 24/04/2004
|
|
|
|
|
If part of MFT is corrupted, you should be able to read something. This message is probably due to corruption in MBR where is the data to find and validate MFT. If system is FAT, there is probably a chance to look at the table manually and see if anything survived (the records of FAT are fixed size - easy to read). If it is NTFS, you should try some tools, but if it didn't work - sorry.
|
|
|
|
|
I'd have to make one more suggestion on this particular activity, should you ever have to do it again. Do yourself a favor and image this drive using FTK Imager (free from AccessData) or dd on a Linux live disk before formatting the drive. You could also use a forensics toolset, such as Autopsy (from the sleuthkit) to possibly examine the drive and determine why the $MFT file is corrupted. As another person posted, one of the records pertaining to the $MFT itself has been corrupted and could be recovered from $MFTMirr.
To do a more thorough data recovery, you could have used a Linux live distribution (either against the live disk or the image had you made one) and installed foremost. Foremost is more configurable as you can edit its config file and add in file headers that you would like to search for (PK for office documents and zip files, JFIF for jpg images, etc.). You can Google for file header magic numbers and find a pretty extensive list.
Just some more food for though on the subject matter at hand. A great book explaining the NTFS file system and $MFT is Brian Carrier's File System Forensic Analysis.
|
|
|
|
|
Thanks Vachaun22! (and all others who replied) Great advice and well thought out response. I shall file it away for future reference, as it was a little late for this job. In this case, I had recovered all the files on the disk, albeit without the filenames and directory structure, which is more than the A+ dude at the computer repair shop could do for them. At least I can give them back a working computer (fresh XP Home install) and a couple of sets of DVDs with the data files. They can sort out what's important.
<rant>
I am trying to create a filtered data set by searching on known file extensions and copy/pasting into folders but keep running into an error 'Cannot copy file: Cannot read from the source file or disk'. This is on XP and it happens when I try to copy all files found in the search. It seems to be one file out of hundreds that causes the error, but it doesn't tell me which one, and nothing gets copied!
"Go forth into the source" - Neal Morse
|
|
|
|
|
Divide and conquer the listing of files to copy.
Rather than try to do them all at one fell swoop, grab only a portion of the files at a time. Then when you get a group of files that won't copy due to the disk read error, then work at that group of files one at a time (or break the group up to a smaller group), rinse and repeat. At some point you will narrow it down to the file(s) that are causing you a problem.
If the disk is failing, you may get read errors. You could try dd-rescue at that point (google for samples of the command) to image the disk to a known good disk. dd-rescue will time out before the hard drive read times out, so it can continue by skipping the block and marking it. Once the forward image is completed, it revisits the blocks that it could read, and reverse reads those blocks sector by sector. Many times it can recover 7 of the 8 sectors in a 4K block. Granted, the file is still corrupt, but you may have recovered enough of the file for parts of it to be useable.
|
|
|
|
|
Last time I had a BSOD from a corrupt NTFS filesystem, I used a Knoppix disk to fix it.
Windows would blue screen when it tried to boot from the disk and if I put it in another system.
I dug out a Knoppix DVD, booted from that & used the 'ntfsfix' tools to repair the filesystem.
Booted the drive from Windows again, let it complete its own chkdsk & all then ran without trouble.
If you're worried about corruption, you could always backup the drive from within Linux (assuming you have somewhere else to put it all).
The Pedant.
|
|
|
|
|
This product has helped me in the past.
R-Studio
http://www.data-recovery-software.net/[^]
I have used it to even recover files on a Raid 5 volume, I don't know what their cost is now, but if you need the files, chances are they can recover it.
Good luck.
|
|
|
|
|
If the MFT is corrupted it means you can't access any of the files in there by default, as the MFT holds pointers to where the files are on the disk.
You need some file recovery software, if you need to recover some important data. I had good track with GetDataBackNTFS. which goes on the disk cluster by cluster and tries to make sense where files start and end.
Since the computer is old, there is a high chance that the region is affected by a bad sector, and given the nature of rotating media, there is a higher chance that the bad region will grow in size. If you have the standard single c:\ partition, then I would strongly recommend running a bad block finder on the disk and if it can't read from the sector (even though the data is corrupted) replacing the disk with a new one, since that means you have damage to the beginning of the disk. This damage will probably grow in size with age and will affect other important bits, such as the master boot record (making partitions unreadable) or the track that has the disk firmware, and geometry. ( making the whole disk unmountable)
|
|
|
|
|
The disk has a brand new OS, actually better than the original, without the dell crapware. I still need to get the 3K images (mostly bs, but I'm certainly not about to look at each one to figure it out) all together in a new folder and copy/paste is failing since one or more in the group are caueing read errors. Think I'll put together a little VBScript to do the job! ahem...sounds like an appropriate place for on error resume next! 
"Go forth into the source" - Neal Morse
|
|
|
|
|
That will be cumbersome after the fact.
Notes to self.
- Recover first, reinstall later, since reinstall will usually overwrite the actual data on the platter. Whereas quick format/delete just erases the index in the table, leaving the actual data intact, until new space is needed for new physical write.
- New windows does not mean healthy drive, it just means new operating system on potentially old broken drive.
- Conventional tools usually give up on the first problem/error. Unconventional tools ( data recovery tools) will often employ aggressive rereads/ and/or reads in reverse, use available checksums or known patterns, skip missing/broken sections to try to resurrect as much of the data on a damaged disk as they can.
|
|
|
|
|
So finally finished the latest CCTV install.
Went to the site, logged in to the router.
Port forwarded the Web Access/TCP and UDP sockets and left.
Came home, loaded up the web viewer and hey presto.
Too easy!
Normally there are problems of some description, but not this time.
Feel guilty taking so much money from him for the technical install.
However, and as Michelle pointed out, I now have access to over 100 cameras on many sites, including pubs and shops.
She reckons that I have all the makings of a psycho-killer!
Not so, but I do need to monitor the systems.
And to see who does what, at all times, everywhere.
---------------------------------
Obscurum per obscurius.
Ad astra per alas porci.
Quidquid latine dictum sit, altum videtur .
|
|
|
|
|
You will be changing your name to Zeke Hawkins[^] before long..... 
(had to look the name up, my memory isn't that good!)
modified 23-Jun-14 17:24pm.
|
|
|
|
|
Dalek Dave wrote: all the makings of a psycho-killer
qu'est-ce que c'est?
PooperPig - Coming Soon
|
|
|
|
|
Fa-fa-fa-fa-faaaa fa-fa-fa-fa-faaaaaaaaaaaaaaaaaaaaa...
|
|
|
|
|
Better run run run run run run run run awaaaaaaaaaaaaaay
PooperPig - Coming Soon
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
