Corrupt $MFT or $Secure

I recently attempted to resize my master XP/NTFS partition to make room for a second partition. XP seemed to be getting more unstable by the day, and I believed it was caused by file system corruption (I have a 100 GB hard drive by Maxtor which was originally formatted FAT32 and then converted to NTFS after XP installation) because it was converted, not freshly formatted NTFS. I intended to install a new copy of XP on the second partition and then move all my files/settings to second partition, then remove the first and resize the second to full size.

I used Partition magic to do it, but at first it didn't work (it asked me to reboot, but when Windows restarted and Partition magic attempted to perform its tasks in that blue "Windows XP" chkdsk screen during startup, I got "Couldn't get direct access to drive" instead). I then tried the PM boot disk. It started to resize the partition, then failed with the message "At the end of something". It reported my entire hard drive was FULL!!! Not true, I only used 25% or less of it.

I tried booting XP, but got the "STOP 0x00000024: Windows has encountered a serious problem and has been shutdown to prevent damage to your system". I put the drive into my parents' system, also running XP. Upon trying to open the drive in explorer, I get "The file or directory is corrupt and unreadable".

I used the utility R-Studio by R-Tools to verify my files are there (with the exception of some large DivX video files). I have determined that the security descriptors metafile ($secure), which R-Studio allows me to see and modify, has been zeroed out. The volume bitmap ($Bitmap) is also empty.

I have tried CHKDSK /R , but it has reported:
Replacing invalid security id with default security id for file 0.
Unable to write to attribute 16 of file 0.
Readable file record segment 0 is not writeable.

Microsoft is no help; they told me my only option is to format. I cannot copy the data off because I don't have another drive with enough size (no other drive can hold 26 GB). A preferable solution is to rebuild the $MFT or $Secure metafiles.

I have heard that Linux users, in the early NTFS driver days, encountered this problem when running the driver in RW mode and that the solution was to use a special utility (which Microsoft didn't want distributed) to change the $MFT header to pretend to be an earlier NTFS version and delete the other metafiles. XP/2000 would automatically detect the older version and "upgrade" it to the new NTFS version, thus rebuilding the metafiles/filesystem.

Any ideas?
Who is Participating?
Adam LeinssServer SpecialistCommented:
Personally, I would go to the store and buy a hard drive temporarily.  Then I would somehow find a copy of EasyRecovery Pro 6 to do the recovery to that hard drive. Then wipe the old drive, copy whatever data that was recovered back to the old drive and then return the new drive.

How do you know rebuilding $MFT or $Secure metafiles will solve the problem???
Your disk may have a problem since you stated XP was getting more unstable. I would suggest running a disk diagnostic untility from and see what it comes up with.

The Crazy One
The stop error does seem to indicate a possiblity that the disk is the problem.,_part_2.htm

"Disk Corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and EIDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error."

Have you tried running CHKDSK /R from the Recovery Console?\
Access Recovery Console

Doing a repair may work but I am not sure if it repairs a damage file system though.\
Click on How To Repair Windows XP by Reinstalling
Cloud Class® Course: MCSA MCSE Windows Server 2012

This course teaches how to install and configure Windows Server 2012 R2.  It is the first step on your path to becoming a Microsoft Certified Solutions Expert (MCSE).

GuyPaddockAuthor Commented:
I doubt that it is a PHYSICAL problem, as I have performed a cluster by cluster test about a month ago (when XP began becoming unstable).

The reason I believe it was a result of the conversion is because Windows 98 (what I had before XP) had a hard time managing the large capacity of the drive. It was not until later that I read that FAT32 cannot support drives over something like 16 GB and that anything larger can result in inaccessible information, file corruption, etc. That is why I wanted to create the second partition to copy over my files as I believed that the NTFS file system, although supportive of drives up to 2 TB, had inherited the instabilities of the previous FAT32 filesystem.

In answer to aleinss' question, I am pretty certain that rebuilding the metafiles will help because any programs I have run that depend on the metafiles to read the drive will report "There is no discernable file system present". Yet, programs like R-Studio, which read from the MFT only (if present) and also scan the disk briefly, will display all my files and also report that the two metafiles I mentioned earlier are empty/corrupt/zeroed/etc.
GuyPaddockAuthor Commented:
Oh, and BTW, CHKDSK does not support the /R option in the recovery console as it is implied. I tried that FIRST (which reported the same error as I stated in my first message, "Readable file record segment 0 is not writeable") as I did not yet have the drive in my parent's machine and didn't have an active copy of XP to use.
Adam LeinssServer SpecialistCommented:
Understood.  I realize that it is not a physical problem, but you stated you don't have a hard drive big enough for the recovery, thus the suggestion of the new hard drive.

I have myself recovered from Partition Magic's bad days, although I was running FAT-32 and there are freeware utilities to rebuild pouched FAT-32 partitions.  You may want to try the NTFSPro demo at which will allows reads of NTFS volumes and see if it will pick it up in DOS.

I think the Ranish Partition Manager can manipulate NTFS partitions.  You may want to take a look at it here:

GuyPaddockAuthor Commented:
Okay, I've run the Maxtor utilities and my drive passed all tests, including the Factory re-certification test (I didn't run the burn-in test, but I didn't think it was really necessary after the drive passed the re-certification test). So we can rule out a physical cause for the problem.

As for the NTFSDos Pro from Winternals, as well as their EBD Commander and Disk Commander software, it wasn't any help (good suggestion, though). I already tried the entire Administrator's pack from Winternals (includes everything) before posting. Disk Commander told me my drive was fine (it specializes only in corrupt boot sector / partition tables, so to it my drive was fine). EBD commander didn't recognize the drive at all (nor did it recognize the GoBack-protected drive in my parents'  machine). NTFSDos complained that the drive it was attempting to mount was incorrect for the driver I was using (but it copied the driver from Windows XP's own system32 directory!!).

One last thing I might try is using the version of CHKDSK that EBD Commander comes with. It might do the repairs as it was coded by Winternals, not Microsoft. I love how Microsoft lets 3rd parties solve problems with filesystems Microsoft creates. I'll keep you all posted; thanx for all your suggestions.
GuyPaddockAuthor Commented:
Okay, I got a few drives together and used "GetDataBack for NTFS" to restore only important files, or files that I would not be able to recreate. Then I reformatted and reinstalled XP. I'm now restoring my apps and the backup data.
Adam LeinssServer SpecialistCommented:
Glad to hear it!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.