Solved

Corrupt $MFT or $Secure

Posted on 2002-07-02
9
2,589 Views
Last Modified: 2007-11-27
I recently attempted to resize my master XP/NTFS partition to make room for a second partition. XP seemed to be getting more unstable by the day, and I believed it was caused by file system corruption (I have a 100 GB hard drive by Maxtor which was originally formatted FAT32 and then converted to NTFS after XP installation) because it was converted, not freshly formatted NTFS. I intended to install a new copy of XP on the second partition and then move all my files/settings to second partition, then remove the first and resize the second to full size.

I used Partition magic to do it, but at first it didn't work (it asked me to reboot, but when Windows restarted and Partition magic attempted to perform its tasks in that blue "Windows XP" chkdsk screen during startup, I got "Couldn't get direct access to drive" instead). I then tried the PM boot disk. It started to resize the partition, then failed with the message "At the end of something". It reported my entire hard drive was FULL!!! Not true, I only used 25% or less of it.

I tried booting XP, but got the "STOP 0x00000024: Windows has encountered a serious problem and has been shutdown to prevent damage to your system". I put the drive into my parents' system, also running XP. Upon trying to open the drive in explorer, I get "The file or directory is corrupt and unreadable".

I used the utility R-Studio by R-Tools to verify my files are there (with the exception of some large DivX video files). I have determined that the security descriptors metafile ($secure), which R-Studio allows me to see and modify, has been zeroed out. The volume bitmap ($Bitmap) is also empty.

I have tried CHKDSK /R , but it has reported:
Replacing invalid security id with default security id for file 0.
Unable to write to attribute 16 of file 0.
Readable file record segment 0 is not writeable.

Microsoft is no help; they told me my only option is to format. I cannot copy the data off because I don't have another drive with enough size (no other drive can hold 26 GB). A preferable solution is to rebuild the $MFT or $Secure metafiles.

I have heard that Linux users, in the early NTFS driver days, encountered this problem when running the driver in RW mode and that the solution was to use a special utility (which Microsoft didn't want distributed) to change the $MFT header to pretend to be an earlier NTFS version and delete the other metafiles. XP/2000 would automatically detect the older version and "upgrade" it to the new NTFS version, thus rebuilding the metafiles/filesystem.

Any ideas?
0
Comment
Question by:GuyPaddock
  • 4
  • 3
  • 2
9 Comments
 
LVL 44

Expert Comment

by:CrazyOne
ID: 7125988
Your disk may have a problem since you stated XP was getting more unstable. I would suggest running a disk diagnostic untility from www.maxtor.com and see what it comes up with.


The Crazy One
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 7126000
The stop error does seem to indicate a possiblity that the disk is the problem.

http://www.rambuk.dk/info/stop_message,_part_2.htm

"Disk Corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and EIDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error."

Have you tried running CHKDSK /R from the Recovery Console?
http://www.webtree.ca/windowsxp/repair_xp.htm\
Access Recovery Console

Doing a repair may work but I am not sure if it repairs a damage file system though.

http://www.webtree.ca/windowsxp/repair_xp.htm\
Click on How To Repair Windows XP by Reinstalling
0
 
LVL 22

Accepted Solution

by:
Adam Leinss earned 175 total points
ID: 7127509
Personally, I would go to the store and buy a hard drive temporarily.  Then I would somehow find a copy of EasyRecovery Pro 6 to do the recovery to that hard drive. Then wipe the old drive, copy whatever data that was recovered back to the old drive and then return the new drive.

How do you know rebuilding $MFT or $Secure metafiles will solve the problem???
0
 

Author Comment

by:GuyPaddock
ID: 7127596
I doubt that it is a PHYSICAL problem, as I have performed a cluster by cluster test about a month ago (when XP began becoming unstable).

The reason I believe it was a result of the conversion is because Windows 98 (what I had before XP) had a hard time managing the large capacity of the drive. It was not until later that I read that FAT32 cannot support drives over something like 16 GB and that anything larger can result in inaccessible information, file corruption, etc. That is why I wanted to create the second partition to copy over my files as I believed that the NTFS file system, although supportive of drives up to 2 TB, had inherited the instabilities of the previous FAT32 filesystem.

In answer to aleinss' question, I am pretty certain that rebuilding the metafiles will help because any programs I have run that depend on the metafiles to read the drive will report "There is no discernable file system present". Yet, programs like R-Studio, which read from the MFT only (if present) and also scan the disk briefly, will display all my files and also report that the two metafiles I mentioned earlier are empty/corrupt/zeroed/etc.
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:GuyPaddock
ID: 7127605
Oh, and BTW, CHKDSK does not support the /R option in the recovery console as it is implied. I tried that FIRST (which reported the same error as I stated in my first message, "Readable file record segment 0 is not writeable") as I did not yet have the drive in my parent's machine and didn't have an active copy of XP to use.
0
 
LVL 22

Expert Comment

by:Adam Leinss
ID: 7128002
Understood.  I realize that it is not a physical problem, but you stated you don't have a hard drive big enough for the recovery, thus the suggestion of the new hard drive.

I have myself recovered from Partition Magic's bad days, although I was running FAT-32 and there are freeware utilities to rebuild pouched FAT-32 partitions.  You may want to try the NTFSPro demo at http://www.winternals.com/trynow/ which will allows reads of NTFS volumes and see if it will pick it up in DOS.

I think the Ranish Partition Manager can manipulate NTFS partitions.  You may want to take a look at it here:
http://www.ranish.com/part/.

0
 

Author Comment

by:GuyPaddock
ID: 7128252
Okay, I've run the Maxtor utilities and my drive passed all tests, including the Factory re-certification test (I didn't run the burn-in test, but I didn't think it was really necessary after the drive passed the re-certification test). So we can rule out a physical cause for the problem.

As for the NTFSDos Pro from Winternals, as well as their EBD Commander and Disk Commander software, it wasn't any help (good suggestion, though). I already tried the entire Administrator's pack from Winternals (includes everything) before posting. Disk Commander told me my drive was fine (it specializes only in corrupt boot sector / partition tables, so to it my drive was fine). EBD commander didn't recognize the drive at all (nor did it recognize the GoBack-protected drive in my parents'  machine). NTFSDos complained that the drive it was attempting to mount was incorrect for the driver I was using (but it copied the driver from Windows XP's own system32 directory!!).

One last thing I might try is using the version of CHKDSK that EBD Commander comes with. It might do the repairs as it was coded by Winternals, not Microsoft. I love how Microsoft lets 3rd parties solve problems with filesystems Microsoft creates. I'll keep you all posted; thanx for all your suggestions.
0
 

Author Comment

by:GuyPaddock
ID: 7138748
Okay, I got a few drives together and used "GetDataBack for NTFS" to restore only important files, or files that I would not be able to recreate. Then I reformatted and reinstalled XP. I'm now restoring my apps and the backup data.
0
 
LVL 22

Expert Comment

by:Adam Leinss
ID: 7138922
Glad to hear it!
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now