Solved

URGENT - MFT Corrupted, need to repair??

Posted on 2000-05-03
17
2,820 Views
Last Modified: 2009-08-09
The second partition of my drive, a Win2K NTFS partition, has developed a "corrupted Master File Table". I cannot access any files on the drive.

Running CHKDSK, all it does is tell me I have a corrupted MFT and aborts.

I am in total despair!! I have tried "RecoverNT" from LC Technology International and EasyRecovery from OnTrack but neither works.

There must be SOMETHING that will rebuild the MFT or recover my data which is all sitting there perfectly fine just not accessible.

HELP PLEASE!!
0
Comment
Question by:trekart
  • 7
  • 4
  • 2
  • +4
17 Comments
 

Expert Comment

by:White_Buffalo
ID: 2775624
Do you have an Emergency Repair Disk? If anyone could jump in? Can you make an ERD from another machine with an identical configuration and do the repair option to restore this?
0
 

Author Comment

by:trekart
ID: 2775668
No, I don't have an ERD.

I am hoping someone can recommend a piece of softare (preferably shareware!) that will scan the drive and repair/rebuild the MFT, or at least recover the files to another drive...
0
 
LVL 1

Expert Comment

by:dudu4
ID: 2777085
Hi,

I know that System Internals have some NT utilities...Here is their adresse: http://www.sysinternals.com/

Hope it will help..
0
 

Author Comment

by:trekart
ID: 2778752
Adjusted points from 500 to 1000
0
 

Author Comment

by:trekart
ID: 2778753
Thanks for the suggestion, I looked at the site but most of the stuff seems to be for analysis. I tried a demo of NTrecover but this did not help.

I *really* need to recover this drive - I just need a utility to scan the drive and rebuild the MFT or just ignore it and recover the files as it finds them.

It *must* be possible?

Help!!
0
 
LVL 2

Expert Comment

by:pschwan
ID: 2779119
The only solution I see thusfar is provided in the following article:
http://support.microsoft.com/support/kb/articles/Q176/6/46.ASP

This involves running CHKDSK with the /F option.  There is also a /R option that locates bad sectors and recovers readable information. This requires /F so the syntax would be

CHKDSK [drive:] /F /R

Good luck...and be sure to back up your data and update your ERD in the future!:)
0
 
LVL 3

Expert Comment

by:huben
ID: 2779405
I am not sure, but can you go into F8 Recovery mode and see the files there? If yes, could you copy them?
0
 
LVL 1

Expert Comment

by:coyote050300
ID: 2779673
From the Windows 2000 Professional Resource Kit:

Error Message:
Corrupt master file table. CHKDSK aborted.

Explanation:
Chkdsk could not interpret the master file table or its mirror on the NTFS volume.

User Action:
Reformat the NTFS volume. Then restore the data from a backup.

If you can afford it, and since you have no ERD, I suggest the following:
Add another drive with Windows 2000 installed and slave the drive with the corrupt master file table to it.  You will be able to access the slave drive thru Explorer - make sure the boot drive is large enough to recover your files.  If you can't afford a new drive, check around for a used one or see if you can borrow one.  I've been there, done that - I feel your pain.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 1

Expert Comment

by:coyote050300
ID: 2780348
Errr, never mind.  I had to sleep on that before I realized what I said.  I was thinking of two different problems I had and cross linked the solutions.  I was unable to recover from the corrupt master file table error and had most of the data backed up on another drive, everything else was lost.  Sorry.
0
 

Author Comment

by:trekart
ID: 2783758
Thank you Pschwan, huban and Coyote.

Unfortunately chkdsk will not work, /f and /r still result in the same error, "Corrupt Master File Table, chkdsk aborted". Recovery Mode makes no difference, nothing will read the drive after finding the MFT corrupt.

That piece from the MS Resourse Kit - how proposterous! I thought NTFS was supposed to be a robust filing system?

I must admit that it does leave me somewhat deflated.

I have downloaded some software which claims to be able to recover files from a drive even after a repartition and reformat, yet it does not work on my drive.

I am wondering if I were to do a "quick" format of the drive (assuming Windows will let me) this will create a new MFT that indicates an empty drive. Then maybe this software would work?

Or would it just restore the corrupt MFT and put me back to square one.

I appreciate your comments before I take the plunge...
0
 

Author Comment

by:trekart
ID: 2784075
Adjusted points from 1000 to 1200
0
 
LVL 2

Expert Comment

by:pschwan
ID: 2784265
That's about the only other thing I could think of too.  By quick formatting, you're only wiping out the FAT/MFT, not actually destroying the data.  There won't be any data pointers, but perhaps that software can help you recover the data.

Up to you whether you want to do it from command line or through the MMC.  Just as easy either way.

One other thing...and it's a long shot.  There is a completely unrelated problem in the old NT4 MFT where it would crap out if you had over 4 million files.  MS issued a fix (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/ntfs-fix/).  Now I don't know what the fix does, but it could possible be that in attempting to patch it, it will recover at least some of the usable parts of the MFT.  I figure what the hell...you're gonna wipe it out anyway when you quick format it...might be worth a shot.

Good luck to ya man!  I hope it works!!
0
 
LVL 1

Expert Comment

by:coyote050300
ID: 2786544
Ok, I've had the unfortunate pleasure of running into a system problem of my own.  While spending the last two days fixing it, I rediscovered my first solution to get another drive and slave the corrupted one to it should work.  If you still have access to the partition - should be a walk in the park.

If that's not a possibility, please let me know if you can get to the F8 prompt for safe mode.  If you can, I'll supply detailed information from the Windows 2000 Professional Resource kit that should help you either to repair your problem or retrieve your files.  If you can't get to safe mode, I still may be able to provide help.  Just let me know where exactly your at and we'll take it from there.
0
 

Author Comment

by:trekart
ID: 2790221
Coyote,

sorry to hear of your own problem, thankfully if no data was lost you're at least a bit wiser on how to deal with the problem!

My system consists of 2 20 gig ATA66 hard drives, both on my primary IDE controller.

Each has two partitions, a FAT32 partition and an NTFS partition.

The first hard drive is C: (which has Win98 on FAT32)and E: (which has Windows2K on NTFS, fully working).

The second drive is D: (formatted as FAT32 storing Data) and F: (formatted as NTFS, totally buggered!)

Windows 2K sees the F: partition, on every boot-up I am told one of my drives needs to be checked for consistency, chkdsk runs and then quits saying the mft is corrupt.

F: appears in 'My Computer' and shows up as 'healthy' in disk manager. double clicking on F: gives the error "F:\ is not accessible. The disk structure is corrupt and unreadable".

I somehow doubt getting round this will be a "walk in the park" - you said yourself previously that the documented solution to this problem is to reformat (thanks a bunch MS) - but I've got nothing to loose so I'm game!

Very much appreciate you sharing what ye olde resource kit has to offer...

Stu.
0
 
LVL 1

Accepted Solution

by:
coyote050300 earned 1200 total points
ID: 2790640
There are two tools that may be able to help.  This is from the Resource Kit:

Troubleshooting Disk Problems
There are various causes of disk problems and means of recovering from them. The following are tools that you can use to troubleshoot disk problems:

DiskProbe can be used to examine and change information on individual disk sectors.  DiskMap can be used to display the layout of partitions and logical volumes on your disk.  Neither of these tools is designed for use with dynamic disks because they cannot read the dynamic Disk Management database. DiskProbe can change the values of individual bytes in any sector on a dynamic disk, but it cannot navigate the structure of a dynamic disk, so it might be impossible to find the sector you want to view or edit. Therefore it is generally recommended that these tools only be used on basic disks.

DiskProbe is part of the Support Tools collection and can be installed from the Support\Tools folder of the Windows 2000 product CD. For more information about using DiskProbe, see the document Dskprtrb.doc in the folder Program Files\Support Tools.

DiskMap is a tool included on the Windows 2000 Resource Kit companion CD and is installed with the rest of the Resource Kit tools. For more information about DiskMap, see the document Diskmap.doc in the folder C:\Program Files\Resource Kit.

---
Unload DiskProbe and all the documentation from the cab file in the support\tools folder of the Windows CD.  Read the documentation thoroughly and proceed cautiously.

I've never messed with DiskProbe so, I'm not at all sure of the possibilities or limitations of the utility.  Just a thought though:  Windows is supposed to do this automatically if it encounters a corrupted MFT.  However, if you can access the $Mft and $MftMirr with DiskProbe, try and make backups of each then rename $MftMirr to $Mft and reboot.

I'm not sure how much assistance DiskMap would provide in solving your problem.  However, if you would like it, please provide an email or alternative way to contact you and I'd be happy to let you "borrow" the utility.

Good luck and may the force be with you.
0
 

Author Comment

by:trekart
ID: 2794590
Thanks Coyote for your advice.

I haven't yet tried your suggestions, however if this don't work then most likely nothing will. I'm not sure editing the disk structure at a low level is something I want to be meddling with, and if the MftMirr was okay then ChkDsk would have restored the corrupt Mft from it anyway (but this is MS after all so probably not!!)

I'd appreciate the diskmap proggy if you are able to email it, please send to s.davis@ipresence.co.uk

1200 points are yours.

Cheers,

Stu.
0
 
LVL 2

Expert Comment

by:jvsteen
ID: 2871237
Hello,

Do you have any idea how this happened? Did you use any utilities that access the file system on a 'low level'?

The utility you really would need when the MTF is corrupt is called disk edit.

It is in SP6a (I don't have it, if anybody has it please mail it to me!).

Diskprobe does not give any info on the FS structures.

Please give more info on how this occured.]

Joep

http://how.to/use_partition_doctor
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Performance in games development is paramount: every microsecond counts to be able to do everything in less than 33ms (aiming at 16ms). C# foreach statement is one of the worst performance killers, and here I explain why.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now