Recovering NTFS MFT with bad sector(s)

[JMThomas]

I've got a basic disk with Windows XP NTFS file system. It appears there are bad sectors in the MFT. I can see the root directory and in it I see the directory with my files.

When I try to open that directory, I receive an I/O error followed by an empty directory being displayed. Since all the directory information is in the MFT, I assume the I/O error is in the MFT and files are recorded in the unreadable part of the MFT are therefore unreachable.

Can Recover My Files tackle this problem in an intellegent manor?

There is supposed to be some redundance in the MFT, plus the fact that some of the MFT is readable, should be exploitable. How much of the mFT can be re-constructed?

For example, assume that the unreadable part of the MFT points to subdirectories which are in a readable part of the MFT. The relationship of these "orphan" subdirectories to the directory tree isn't know, but if the subdirectories can be located by scanning and slicing and dicing the MFT then the files in them should be easily found.

If I need to scan for files, then by mapping what the MFT says is allocated and combining that with any available free space information, the areas of the disk where the files located by the unreadable directory can be narrowed down quite a lot. Then only that target area need be directly scanned for file data, thus cutting down the time and the number of located files that need to be sorted through.

Also, as far as determining file names go, some files such as Word documents and JPEGs have inside them interesting information like autor name, title, timestamp, etc. I notice the mass renamer that can look inside word documents. How about JPEGs and other "annotated files"?

I'm impressed by the response you (GetData) are providing to forum messages. I'm suspending my investigation of file recovery programs until I hear back from you, since I expect good news!

[admin]

Hi - Thanks for your post! There are lost of questions in this one, so I think it best if I roll out the cheif developer to answer this one. I shall pry Brett away from his code tomorrow to give you the best answer possible.

[JMThomas]

Thanks.

Someday I've got to look at the UNIX weenies reverse engineer of NTFS and see how things really work. I've got my curiosity in high gear now!

[Brett Hunter]

Hi,
You are right in that the MFT does have some reduncancy, but not much. A mirror of the first few MF records is stored in another part of the drive. The first record called $MFT is actually a file record that represents the entire MFT. If this record is corrupted then the $MFTMirror would help, but it sounds more like the actually MF Table (i.e about a 40MB "file) is corrupt somewhere in the middle. There is no redunancy for the entire MFT so such an error will be problematic. If only 1 cluster is corrupt then approximately 4 file or directory entries will be lost. There are other entries called INDX buffers that store some fiel information, but the Run List which is need for the reconstruction of the file is not included. RecoverMyFiles currently does not use the INDX buffers. If you want to get your files then I suggest a Format Recovery. In this mode the program will find MFT records irrespective of a readable $MFT or $MFTMirror - in fact you can have different MFT records from different drives (say you had Windows 2000 then formatted and then installed Windows XP - the MFT's are different) and Format Recover will try and partititon the 2 into separate "virtual partitions".
Your idea of virtually allocating the drive based on the found MFT and then determinign the "lost" space due to corrupt MFTs' is quite good and will see if we can implement something like it. I see the main problem in determining the available Free space information, as this itself comes from reading the MFT.

As to the file information in Word/Excel/JPEG documents, we are including in a forthcoming release the ability to auto-rename from this information if no filename is available (such as in cases where the MFT/FAT is gone and all you can do is look at the unallocated disk space areas - in RMF the filenames are currently "Recovered_Word_xxx" etc). Suprisingly about a quarter to a third of file formats have enough information to give a "reasonable" filename.

Hope that helps.

[Brett Hunter]

Hi,
Actually we have had a bit more thought and it might be possible to improve things using the $BitMap field of the $MFT record itself. This bitmap (not to be confused with the $BITMAP record which represents the cluster allocation) lists the used and unused MFT records. You could certainly use this information to know if there were any active files in the clusters that were corrupted. At the moment RMF will read MFT's and just ignore corrupt clusters: it reports that it had problems but not if they were actually in the MF Table or whether it knows that the MFT records it could not read were allocated or not. We might add this in a latter version of the program.
We will let you know when we add these extras.
Ciao
Brett

[JMThomas]

Cool!

Excuse me, please, while I go give you some money...

[adi_mardian]

On my case the MFT corrupt and the disk become unreadeable RAW format ?? how to recover the disk?
I've tried using third program such as stellar phoenix, but it use very long time to recover, about 45 hours on my 250GB HDD.

[GDH]

Download Recover My Files from www.recovermyfiles.com and try a Fast Format Recover of the physical drive. If it works you should have all your files and folders back in less than 1 hour.

[negative_creep]

Originally Posted by adi_mardian

On my case the MFT corrupt and the disk become unreadeable RAW format ?? how to recover the disk?
I've tried using third program such as stellar phoenix, but it use very long time to recover, about 45 hours on my 250GB HDD.

It seems I have the same problem as this guy. I did start a thread, but have not got any suggestions.
I would like to know what is expected to happen when the complete format recover scan is finished running on my external drive.
Will I just be able to access the drive once its done, or do I need another drive to put the recovered files on?
If I can put the files on a dvd or cd, how do I do it so that I can read the files?
The last time I did this, the disc was blank after writing my recovered avi files to it.
I tried to include any information that can help figure out what went wrong with the drive, and what I need to do to fix it, in my thread titled "I need some help'.
I could still use some help. It would be appreciated.