Bad Sectors and Missing MFT on NTFS

[DrNick]

Hello,

I just downloaded a trial of the program and am trying to figure out the best settings for my situation.

I have an 80GB internal Maxtor ATA drive with a single NTFS partition. It had a lot of files on it, primarily MP3s, videos, and downloaded programs (zip and exe's). All of a sudden, Windows would not recognize most of it and when I ran CHKDSK it said that the MFT was corrupt. The next time I rebooted the disk was completely unusable. Disk Management said it was a RAW drive and wanted me to initialize and format it. I DID NOT format it.

So what I have is an 80GB drive with apparently no MFT. Upon scanning it with other recovery tools, they all had a problem with bad sectors near the beginning of the drive. This lead me to believe that the drive has bad sectors in the MFT region, however I haven't been able to even find any files using these other programs.

Recover My Files is the only program so far that has actually found anything. I did the full format scan and while it did find a few files, there were only about 40 or so where originally there were in the 50,000 range.

My question is, what settings should I use for this disk? I'd REALLY like to get my stuff back (obviously and have have reason to believe that most of it should still be there since I've not done anything to the drive since the crash and from what I can tell the MFT is simply missing.

Thanks a ton!

Nick

[GDH]

Please make sure you are running the latest version, which is 3.60, available from www.recovermyfiles.com.

Please run a "Fast Format Recover" of the "physical drive", which should complete in less than 30 minutes. What results did you get. Does the event log say anything about not being able to read parts of the disk?

[DrNick]

Hmm.

I just did a Fast Format scan and here's the log:

EventLog
Searching for partition entries.
Cylinder = 9732
Tracks per Cylinder = 255
Sectors per Track = 63
Found 0 partitions.
All searches completed.
A total of 0 file(s) were located.
Time Elapsed: 0.990583333333333 (mins)
Search aborted.

What's the problem? Should I do something else? It doesn't say anything about errors reading the drive, but I know that two other programs both complained about bad sectors at about sector 6,300,000 (out of 156,500,000).

Another question: Do you have to select ALL the filetypes you want recovered in the options dialog before a scan? What if you forget one, do you have to rescan it?

Thanks again.

[GDH]

OK - now run a "Complete Format Recovery" and this time do not select any file types - take all the ticks off.

Please post the event log.

[DrNick]

Alright, I did as you asked, here's the result:

Starting search of Lost Files on drive 2\
Completed search of drive 2
There were 22 NTFS file system entries found.
Found a total of 22 MFT entries.
Total Counts = 0
Average Counts = 0
Sigma = 0
Number of found partitions: 0
Problem finding partitions - making estimates for partition start
Partition 1 starts at 0
Partition 2 starts at 63
Found 2 directory entries in partition 1
Found 2 directory entries in partition 2
All searches completed.
A total of 32 file(s) were located.
Time Elapsed: 113.551433333333 (mins)

This is the first thing I tried. It finds 32 files, but that's it. What would you suggest?

[Brett Hunter]

Hi Nick,
We are not sure why the MFT would be totally gone. RecoverMyFiles will recover MFT records even if the MFT table structure is corrupt (but not when the MFT record itself is corrupt). For the MFT to be completely gone (i.e. the 50000 records) something really bad must have happened. Also we have had instantances of CHKDSK doing things without "consent" (it happened on my own computer).
Anyway I don't think the MFT records are there anymore (although you can check with a hexeditor that looks at drives such as HexEditor - for XP look at about 1/3 of the way through the drive and for Win2000 at the beginning. If you installed XP on top of a previous 2000 installation then check at the beginning). The last restort and it is time consuming is to do a Complete File Search for the file type you need: mp3, mpeg and zip (we currently don't do exe's). I would suggest doing a "test" scan for just zip files (as this will be the quickest search), then mp3's then lastly mpeg (the slowest of the lot).
No filenames will be found (no MFT's), but you will probably get some data.
For the mp3's if the title/artist is present we might be able to make a renamer for you to rename the "Recovered_MP3_X.mp3" files to ones based on the title and/or artist. Let us know if you need this.
Hope that helps
Brett

[DrNick]

Thanks for the reply.

Here's where I am:

I don't need to worry about my MP3s. I had forgotten I'd copied them to my laptop a month or so ago so all I'm missing is the latest few CDs I've ripped and songs I've downloaded. They aren't a problem, though I really appreciate your offer for an ID3 renamer

I'm going to try a few other scans I suppose to see if I can find other files. For the most part all I had on that drive in addition to music was video clips and downloaded programs. I'm starting with a Complete File Search for .zip files as you suggested and it looks like it's going to take about 2 hours, but it's already found some files.

Just a few other questions if you don't mind:

Is it better to run several scans with different filetypes or a single scan with 5-6 different filetypes selected?

Why no support for executables?

How big of an impact does fragmentation have on a drive with a missing MFT?

Is there any way to test a few restorations to make doubly sure that the files are whole? I'm not looking for a freebie but I think that the program would be nicer if the trial allowed for something like 5-10 restorations for testing or maybe allowed restoring files less than 64KB.

Thanks again for all your help.

[GDH]

Glad you found your music.

Running a "Complete File Search" for 5 or 6 file types is not a problem. The slowest file types are multimedia, specifically MP3 and MPEG, so you may want to run separate searches for those.

Recover My Files currently supports the recovery of executables, in fact it will find any file type. Here is a quick summary of how it works which hopefully will answer your question:

A Search for "Deleted Files" - Finds All File Types

A "Deleted File" has an MFT record. The MFT record indicates that the file was deleted. The MFT record points to the location of the deleted file on the disk. As long as the deleted file has not been overwritten by other data (indicated in Recover My Files by the "recovery rating"), then the file can be recovered.

All file types can be located and recovered. If they are not selected or included in the Recover My Files File Type list then they are placed in the "other files" folder in the results screen. Normally you would look in this folder for your .exe files.

The "Fast File Search" and "Format Recover" options use the MFT method of recovery.

A Search for "Lost Files" - Only finds the files in the RMF File Type List

In your case, your MFT records are corrupt/destroyed/gone so you get poor results when you run a Fast or Format Recover search.

In a "Complete Search" Recover My Files fist runs a "Deleted File" search, but then also scans the entire disk and looks for files by their structure, eg. header/content/footer. You ask the program to do this in a "Complete Search" by selecting the specific file type you are looking for in the RMF File Type Selection List.

The good news is that even if MFT records are destroyed, you can still find your files (which is what has happened in your case). The bad news is that MFT records hold the file name, so thus the file name is lost. Recover My Files gives the ******* name "Recovered_Filename_1".

We do not support the recovery of .exe files in a "Lost File Search" because:

1. You would end up with a file called "Recovered_Executable_1.exe". What is it? Are you game to run it? No way, it could be anything!

2. Usually a .exe file, i.e. a program, relies on more than just a .exe file to make it work. The best option is to reinstall the software.

I hope this makes sense.

[DrNick]

Thanks for the clarification.

The scan for zip files is just about done, but I noticed something odd. In my Downloads folder I used to have a ton of zip files. Looking at the scan results, it has found about 400 so far which sounds about right, but there only seems to be about 15 or 20 different files repeated over and over. Some have 20-50 copies with the same files showing up in the Preview window. Why is this?

Regarding executables, I can understand the reason behind not recovering them with a lost MFT. In my case however most were installers which I could run and then find the name. I suppose however that if the file became corrupt there could be some funny stuff in the exe, though the odds of a corrupted file causing problems seems low. Perhaps this could be an advanced option, or maybe some sort of registry/ini file/argument tweak. Dunno.

Anyway, thanks for all your help ****. I'll do a few other scans and see what it finds and decide if it's worth the price of the program.

Nick

[GDH]

Multiple repeated Zips are a bit odd. I have seen a hard drive crash before where it has dumped the same data from memory again and again on the drive, but this is very rare. Did they turn out to be all the same files?