Link to home
Start Free TrialLog in
Avatar of GuyPaddock
GuyPaddock

asked on

Corrupt $MFT or $Secure

I recently attempted to resize my master XP/NTFS partition to make room for a second partition. XP seemed to be getting more unstable by the day, and I believed it was caused by file system corruption (I have a 100 GB hard drive by Maxtor which was originally formatted FAT32 and then converted to NTFS after XP installation) because it was converted, not freshly formatted NTFS. I intended to install a new copy of XP on the second partition and then move all my files/settings to second partition, then remove the first and resize the second to full size.

I used Partition magic to do it, but at first it didn't work (it asked me to reboot, but when Windows restarted and Partition magic attempted to perform its tasks in that blue "Windows XP" chkdsk screen during startup, I got "Couldn't get direct access to drive" instead). I then tried the PM boot disk. It started to resize the partition, then failed with the message "At the end of something". It reported my entire hard drive was FULL!!! Not true, I only used 25% or less of it.

I tried booting XP, but got the "STOP 0x00000024: Windows has encountered a serious problem and has been shutdown to prevent damage to your system". I put the drive into my parents' system, also running XP. Upon trying to open the drive in explorer, I get "The file or directory is corrupt and unreadable".

I used the utility R-Studio by R-Tools to verify my files are there (with the exception of some large DivX video files). I have determined that the security descriptors metafile ($secure), which R-Studio allows me to see and modify, has been zeroed out. The volume bitmap ($Bitmap) is also empty.

I have tried CHKDSK /R , but it has reported:
Replacing invalid security id with default security id for file 0.
Unable to write to attribute 16 of file 0.
Readable file record segment 0 is not writeable.

Microsoft is no help; they told me my only option is to format. I cannot copy the data off because I don't have another drive with enough size (no other drive can hold 26 GB). A preferable solution is to rebuild the $MFT or $Secure metafiles.

I have heard that Linux users, in the early NTFS driver days, encountered this problem when running the driver in RW mode and that the solution was to use a special utility (which Microsoft didn't want distributed) to change the $MFT header to pretend to be an earlier NTFS version and delete the other metafiles. XP/2000 would automatically detect the older version and "upgrade" it to the new NTFS version, thus rebuilding the metafiles/filesystem.

Any ideas?
Avatar of CrazyOne
CrazyOne
Flag of United States of America image

Your disk may have a problem since you stated XP was getting more unstable. I would suggest running a disk diagnostic untility from www.maxtor.com and see what it comes up with.


The Crazy One
The stop error does seem to indicate a possiblity that the disk is the problem.

http://www.rambuk.dk/info/stop_message,_part_2.htm

"Disk Corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and EIDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error."

Have you tried running CHKDSK /R from the Recovery Console?
http://www.webtree.ca/windowsxp/repair_xp.htm\
Access Recovery Console

Doing a repair may work but I am not sure if it repairs a damage file system though.

http://www.webtree.ca/windowsxp/repair_xp.htm\
Click on How To Repair Windows XP by Reinstalling
ASKER CERTIFIED SOLUTION
Avatar of Adam Leinss
Adam Leinss
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of GuyPaddock
GuyPaddock

ASKER

I doubt that it is a PHYSICAL problem, as I have performed a cluster by cluster test about a month ago (when XP began becoming unstable).

The reason I believe it was a result of the conversion is because Windows 98 (what I had before XP) had a hard time managing the large capacity of the drive. It was not until later that I read that FAT32 cannot support drives over something like 16 GB and that anything larger can result in inaccessible information, file corruption, etc. That is why I wanted to create the second partition to copy over my files as I believed that the NTFS file system, although supportive of drives up to 2 TB, had inherited the instabilities of the previous FAT32 filesystem.

In answer to aleinss' question, I am pretty certain that rebuilding the metafiles will help because any programs I have run that depend on the metafiles to read the drive will report "There is no discernable file system present". Yet, programs like R-Studio, which read from the MFT only (if present) and also scan the disk briefly, will display all my files and also report that the two metafiles I mentioned earlier are empty/corrupt/zeroed/etc.
Oh, and BTW, CHKDSK does not support the /R option in the recovery console as it is implied. I tried that FIRST (which reported the same error as I stated in my first message, "Readable file record segment 0 is not writeable") as I did not yet have the drive in my parent's machine and didn't have an active copy of XP to use.
Understood.  I realize that it is not a physical problem, but you stated you don't have a hard drive big enough for the recovery, thus the suggestion of the new hard drive.

I have myself recovered from Partition Magic's bad days, although I was running FAT-32 and there are freeware utilities to rebuild pouched FAT-32 partitions.  You may want to try the NTFSPro demo at http://www.winternals.com/trynow/ which will allows reads of NTFS volumes and see if it will pick it up in DOS.

I think the Ranish Partition Manager can manipulate NTFS partitions.  You may want to take a look at it here:
http://www.ranish.com/part/.

Okay, I've run the Maxtor utilities and my drive passed all tests, including the Factory re-certification test (I didn't run the burn-in test, but I didn't think it was really necessary after the drive passed the re-certification test). So we can rule out a physical cause for the problem.

As for the NTFSDos Pro from Winternals, as well as their EBD Commander and Disk Commander software, it wasn't any help (good suggestion, though). I already tried the entire Administrator's pack from Winternals (includes everything) before posting. Disk Commander told me my drive was fine (it specializes only in corrupt boot sector / partition tables, so to it my drive was fine). EBD commander didn't recognize the drive at all (nor did it recognize the GoBack-protected drive in my parents'  machine). NTFSDos complained that the drive it was attempting to mount was incorrect for the driver I was using (but it copied the driver from Windows XP's own system32 directory!!).

One last thing I might try is using the version of CHKDSK that EBD Commander comes with. It might do the repairs as it was coded by Winternals, not Microsoft. I love how Microsoft lets 3rd parties solve problems with filesystems Microsoft creates. I'll keep you all posted; thanx for all your suggestions.
Okay, I got a few drives together and used "GetDataBack for NTFS" to restore only important files, or files that I would not be able to recreate. Then I reformatted and reinstalled XP. I'm now restoring my apps and the backup data.
Glad to hear it!