Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Corrupt $MFT or $Secure

Posted on 2002-07-02
Medium Priority
Last Modified: 2007-11-27
I recently attempted to resize my master XP/NTFS partition to make room for a second partition. XP seemed to be getting more unstable by the day, and I believed it was caused by file system corruption (I have a 100 GB hard drive by Maxtor which was originally formatted FAT32 and then converted to NTFS after XP installation) because it was converted, not freshly formatted NTFS. I intended to install a new copy of XP on the second partition and then move all my files/settings to second partition, then remove the first and resize the second to full size.

I used Partition magic to do it, but at first it didn't work (it asked me to reboot, but when Windows restarted and Partition magic attempted to perform its tasks in that blue "Windows XP" chkdsk screen during startup, I got "Couldn't get direct access to drive" instead). I then tried the PM boot disk. It started to resize the partition, then failed with the message "At the end of something". It reported my entire hard drive was FULL!!! Not true, I only used 25% or less of it.

I tried booting XP, but got the "STOP 0x00000024: Windows has encountered a serious problem and has been shutdown to prevent damage to your system". I put the drive into my parents' system, also running XP. Upon trying to open the drive in explorer, I get "The file or directory is corrupt and unreadable".

I used the utility R-Studio by R-Tools to verify my files are there (with the exception of some large DivX video files). I have determined that the security descriptors metafile ($secure), which R-Studio allows me to see and modify, has been zeroed out. The volume bitmap ($Bitmap) is also empty.

I have tried CHKDSK /R , but it has reported:
Replacing invalid security id with default security id for file 0.
Unable to write to attribute 16 of file 0.
Readable file record segment 0 is not writeable.

Microsoft is no help; they told me my only option is to format. I cannot copy the data off because I don't have another drive with enough size (no other drive can hold 26 GB). A preferable solution is to rebuild the $MFT or $Secure metafiles.

I have heard that Linux users, in the early NTFS driver days, encountered this problem when running the driver in RW mode and that the solution was to use a special utility (which Microsoft didn't want distributed) to change the $MFT header to pretend to be an earlier NTFS version and delete the other metafiles. XP/2000 would automatically detect the older version and "upgrade" it to the new NTFS version, thus rebuilding the metafiles/filesystem.

Any ideas?
Question by:GuyPaddock
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
LVL 44

Expert Comment

ID: 7125988
Your disk may have a problem since you stated XP was getting more unstable. I would suggest running a disk diagnostic untility from www.maxtor.com and see what it comes up with.

The Crazy One
LVL 44

Expert Comment

ID: 7126000
The stop error does seem to indicate a possiblity that the disk is the problem.


"Disk Corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and EIDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error."

Have you tried running CHKDSK /R from the Recovery Console?
Access Recovery Console

Doing a repair may work but I am not sure if it repairs a damage file system though.

Click on How To Repair Windows XP by Reinstalling
LVL 22

Accepted Solution

Adam Leinss earned 525 total points
ID: 7127509
Personally, I would go to the store and buy a hard drive temporarily.  Then I would somehow find a copy of EasyRecovery Pro 6 to do the recovery to that hard drive. Then wipe the old drive, copy whatever data that was recovered back to the old drive and then return the new drive.

How do you know rebuilding $MFT or $Secure metafiles will solve the problem???

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.


Author Comment

ID: 7127596
I doubt that it is a PHYSICAL problem, as I have performed a cluster by cluster test about a month ago (when XP began becoming unstable).

The reason I believe it was a result of the conversion is because Windows 98 (what I had before XP) had a hard time managing the large capacity of the drive. It was not until later that I read that FAT32 cannot support drives over something like 16 GB and that anything larger can result in inaccessible information, file corruption, etc. That is why I wanted to create the second partition to copy over my files as I believed that the NTFS file system, although supportive of drives up to 2 TB, had inherited the instabilities of the previous FAT32 filesystem.

In answer to aleinss' question, I am pretty certain that rebuilding the metafiles will help because any programs I have run that depend on the metafiles to read the drive will report "There is no discernable file system present". Yet, programs like R-Studio, which read from the MFT only (if present) and also scan the disk briefly, will display all my files and also report that the two metafiles I mentioned earlier are empty/corrupt/zeroed/etc.

Author Comment

ID: 7127605
Oh, and BTW, CHKDSK does not support the /R option in the recovery console as it is implied. I tried that FIRST (which reported the same error as I stated in my first message, "Readable file record segment 0 is not writeable") as I did not yet have the drive in my parent's machine and didn't have an active copy of XP to use.
LVL 22

Expert Comment

by:Adam Leinss
ID: 7128002
Understood.  I realize that it is not a physical problem, but you stated you don't have a hard drive big enough for the recovery, thus the suggestion of the new hard drive.

I have myself recovered from Partition Magic's bad days, although I was running FAT-32 and there are freeware utilities to rebuild pouched FAT-32 partitions.  You may want to try the NTFSPro demo at http://www.winternals.com/trynow/ which will allows reads of NTFS volumes and see if it will pick it up in DOS.

I think the Ranish Partition Manager can manipulate NTFS partitions.  You may want to take a look at it here:


Author Comment

ID: 7128252
Okay, I've run the Maxtor utilities and my drive passed all tests, including the Factory re-certification test (I didn't run the burn-in test, but I didn't think it was really necessary after the drive passed the re-certification test). So we can rule out a physical cause for the problem.

As for the NTFSDos Pro from Winternals, as well as their EBD Commander and Disk Commander software, it wasn't any help (good suggestion, though). I already tried the entire Administrator's pack from Winternals (includes everything) before posting. Disk Commander told me my drive was fine (it specializes only in corrupt boot sector / partition tables, so to it my drive was fine). EBD commander didn't recognize the drive at all (nor did it recognize the GoBack-protected drive in my parents'  machine). NTFSDos complained that the drive it was attempting to mount was incorrect for the driver I was using (but it copied the driver from Windows XP's own system32 directory!!).

One last thing I might try is using the version of CHKDSK that EBD Commander comes with. It might do the repairs as it was coded by Winternals, not Microsoft. I love how Microsoft lets 3rd parties solve problems with filesystems Microsoft creates. I'll keep you all posted; thanx for all your suggestions.

Author Comment

ID: 7138748
Okay, I got a few drives together and used "GetDataBack for NTFS" to restore only important files, or files that I would not be able to recreate. Then I reformatted and reinstalled XP. I'm now restoring my apps and the backup data.
LVL 22

Expert Comment

by:Adam Leinss
ID: 7138922
Glad to hear it!

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question