URGENT - MFT Corrupted, need to repair??

The second partition of my drive, a Win2K NTFS partition, has developed a "corrupted Master File Table". I cannot access any files on the drive.

Running CHKDSK, all it does is tell me I have a corrupted MFT and aborts.

I am in total despair!! I have tried "RecoverNT" from LC Technology International and EasyRecovery from OnTrack but neither works.

There must be SOMETHING that will rebuild the MFT or recover my data which is all sitting there perfectly fine just not accessible.

Who is Participating?
coyote050300Connect With a Mentor Commented:
There are two tools that may be able to help.  This is from the Resource Kit:

Troubleshooting Disk Problems
There are various causes of disk problems and means of recovering from them. The following are tools that you can use to troubleshoot disk problems:

DiskProbe can be used to examine and change information on individual disk sectors.  DiskMap can be used to display the layout of partitions and logical volumes on your disk.  Neither of these tools is designed for use with dynamic disks because they cannot read the dynamic Disk Management database. DiskProbe can change the values of individual bytes in any sector on a dynamic disk, but it cannot navigate the structure of a dynamic disk, so it might be impossible to find the sector you want to view or edit. Therefore it is generally recommended that these tools only be used on basic disks.

DiskProbe is part of the Support Tools collection and can be installed from the Support\Tools folder of the Windows 2000 product CD. For more information about using DiskProbe, see the document Dskprtrb.doc in the folder Program Files\Support Tools.

DiskMap is a tool included on the Windows 2000 Resource Kit companion CD and is installed with the rest of the Resource Kit tools. For more information about DiskMap, see the document Diskmap.doc in the folder C:\Program Files\Resource Kit.

Unload DiskProbe and all the documentation from the cab file in the support\tools folder of the Windows CD.  Read the documentation thoroughly and proceed cautiously.

I've never messed with DiskProbe so, I'm not at all sure of the possibilities or limitations of the utility.  Just a thought though:  Windows is supposed to do this automatically if it encounters a corrupted MFT.  However, if you can access the $Mft and $MftMirr with DiskProbe, try and make backups of each then rename $MftMirr to $Mft and reboot.

I'm not sure how much assistance DiskMap would provide in solving your problem.  However, if you would like it, please provide an email or alternative way to contact you and I'd be happy to let you "borrow" the utility.

Good luck and may the force be with you.
Do you have an Emergency Repair Disk? If anyone could jump in? Can you make an ERD from another machine with an identical configuration and do the repair option to restore this?
trekartAuthor Commented:
No, I don't have an ERD.

I am hoping someone can recommend a piece of softare (preferably shareware!) that will scan the drive and repair/rebuild the MFT, or at least recover the files to another drive...
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.


I know that System Internals have some NT utilities...Here is their adresse: http://www.sysinternals.com/

Hope it will help..
trekartAuthor Commented:
Adjusted points from 500 to 1000
trekartAuthor Commented:
Thanks for the suggestion, I looked at the site but most of the stuff seems to be for analysis. I tried a demo of NTrecover but this did not help.

I *really* need to recover this drive - I just need a utility to scan the drive and rebuild the MFT or just ignore it and recover the files as it finds them.

It *must* be possible?

The only solution I see thusfar is provided in the following article:

This involves running CHKDSK with the /F option.  There is also a /R option that locates bad sectors and recovers readable information. This requires /F so the syntax would be

CHKDSK [drive:] /F /R

Good luck...and be sure to back up your data and update your ERD in the future!:)
I am not sure, but can you go into F8 Recovery mode and see the files there? If yes, could you copy them?
From the Windows 2000 Professional Resource Kit:

Error Message:
Corrupt master file table. CHKDSK aborted.

Chkdsk could not interpret the master file table or its mirror on the NTFS volume.

User Action:
Reformat the NTFS volume. Then restore the data from a backup.

If you can afford it, and since you have no ERD, I suggest the following:
Add another drive with Windows 2000 installed and slave the drive with the corrupt master file table to it.  You will be able to access the slave drive thru Explorer - make sure the boot drive is large enough to recover your files.  If you can't afford a new drive, check around for a used one or see if you can borrow one.  I've been there, done that - I feel your pain.
Errr, never mind.  I had to sleep on that before I realized what I said.  I was thinking of two different problems I had and cross linked the solutions.  I was unable to recover from the corrupt master file table error and had most of the data backed up on another drive, everything else was lost.  Sorry.
trekartAuthor Commented:
Thank you Pschwan, huban and Coyote.

Unfortunately chkdsk will not work, /f and /r still result in the same error, "Corrupt Master File Table, chkdsk aborted". Recovery Mode makes no difference, nothing will read the drive after finding the MFT corrupt.

That piece from the MS Resourse Kit - how proposterous! I thought NTFS was supposed to be a robust filing system?

I must admit that it does leave me somewhat deflated.

I have downloaded some software which claims to be able to recover files from a drive even after a repartition and reformat, yet it does not work on my drive.

I am wondering if I were to do a "quick" format of the drive (assuming Windows will let me) this will create a new MFT that indicates an empty drive. Then maybe this software would work?

Or would it just restore the corrupt MFT and put me back to square one.

I appreciate your comments before I take the plunge...
trekartAuthor Commented:
Adjusted points from 1000 to 1200
That's about the only other thing I could think of too.  By quick formatting, you're only wiping out the FAT/MFT, not actually destroying the data.  There won't be any data pointers, but perhaps that software can help you recover the data.

Up to you whether you want to do it from command line or through the MMC.  Just as easy either way.

One other thing...and it's a long shot.  There is a completely unrelated problem in the old NT4 MFT where it would crap out if you had over 4 million files.  MS issued a fix (ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP5/ntfs-fix/).  Now I don't know what the fix does, but it could possible be that in attempting to patch it, it will recover at least some of the usable parts of the MFT.  I figure what the hell...you're gonna wipe it out anyway when you quick format it...might be worth a shot.

Good luck to ya man!  I hope it works!!
Ok, I've had the unfortunate pleasure of running into a system problem of my own.  While spending the last two days fixing it, I rediscovered my first solution to get another drive and slave the corrupted one to it should work.  If you still have access to the partition - should be a walk in the park.

If that's not a possibility, please let me know if you can get to the F8 prompt for safe mode.  If you can, I'll supply detailed information from the Windows 2000 Professional Resource kit that should help you either to repair your problem or retrieve your files.  If you can't get to safe mode, I still may be able to provide help.  Just let me know where exactly your at and we'll take it from there.
trekartAuthor Commented:

sorry to hear of your own problem, thankfully if no data was lost you're at least a bit wiser on how to deal with the problem!

My system consists of 2 20 gig ATA66 hard drives, both on my primary IDE controller.

Each has two partitions, a FAT32 partition and an NTFS partition.

The first hard drive is C: (which has Win98 on FAT32)and E: (which has Windows2K on NTFS, fully working).

The second drive is D: (formatted as FAT32 storing Data) and F: (formatted as NTFS, totally buggered!)

Windows 2K sees the F: partition, on every boot-up I am told one of my drives needs to be checked for consistency, chkdsk runs and then quits saying the mft is corrupt.

F: appears in 'My Computer' and shows up as 'healthy' in disk manager. double clicking on F: gives the error "F:\ is not accessible. The disk structure is corrupt and unreadable".

I somehow doubt getting round this will be a "walk in the park" - you said yourself previously that the documented solution to this problem is to reformat (thanks a bunch MS) - but I've got nothing to loose so I'm game!

Very much appreciate you sharing what ye olde resource kit has to offer...

trekartAuthor Commented:
Thanks Coyote for your advice.

I haven't yet tried your suggestions, however if this don't work then most likely nothing will. I'm not sure editing the disk structure at a low level is something I want to be meddling with, and if the MftMirr was okay then ChkDsk would have restored the corrupt Mft from it anyway (but this is MS after all so probably not!!)

I'd appreciate the diskmap proggy if you are able to email it, please send to s.davis@ipresence.co.uk

1200 points are yours.



Do you have any idea how this happened? Did you use any utilities that access the file system on a 'low level'?

The utility you really would need when the MTF is corrupt is called disk edit.

It is in SP6a (I don't have it, if anybody has it please mail it to me!).

Diskprobe does not give any info on the FS structures.

Please give more info on how this occured.]


Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.