Corrupt $MFT or $Secure

Posted on 2002-07-02
Medium Priority
Last Modified: 2007-11-27
I recently attempted to resize my master XP/NTFS partition to make room for a second partition. XP seemed to be getting more unstable by the day, and I believed it was caused by file system corruption (I have a 100 GB hard drive by Maxtor which was originally formatted FAT32 and then converted to NTFS after XP installation) because it was converted, not freshly formatted NTFS. I intended to install a new copy of XP on the second partition and then move all my files/settings to second partition, then remove the first and resize the second to full size.

I used Partition magic to do it, but at first it didn't work (it asked me to reboot, but when Windows restarted and Partition magic attempted to perform its tasks in that blue "Windows XP" chkdsk screen during startup, I got "Couldn't get direct access to drive" instead). I then tried the PM boot disk. It started to resize the partition, then failed with the message "At the end of something". It reported my entire hard drive was FULL!!! Not true, I only used 25% or less of it.

I tried booting XP, but got the "STOP 0x00000024: Windows has encountered a serious problem and has been shutdown to prevent damage to your system". I put the drive into my parents' system, also running XP. Upon trying to open the drive in explorer, I get "The file or directory is corrupt and unreadable".

I used the utility R-Studio by R-Tools to verify my files are there (with the exception of some large DivX video files). I have determined that the security descriptors metafile ($secure), which R-Studio allows me to see and modify, has been zeroed out. The volume bitmap ($Bitmap) is also empty.

I have tried CHKDSK /R , but it has reported:
Replacing invalid security id with default security id for file 0.
Unable to write to attribute 16 of file 0.
Readable file record segment 0 is not writeable.

Microsoft is no help; they told me my only option is to format. I cannot copy the data off because I don't have another drive with enough size (no other drive can hold 26 GB). A preferable solution is to rebuild the $MFT or $Secure metafiles.

I have heard that Linux users, in the early NTFS driver days, encountered this problem when running the driver in RW mode and that the solution was to use a special utility (which Microsoft didn't want distributed) to change the $MFT header to pretend to be an earlier NTFS version and delete the other metafiles. XP/2000 would automatically detect the older version and "upgrade" it to the new NTFS version, thus rebuilding the metafiles/filesystem.

Any ideas?
Question by:GuyPaddock
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
LVL 44

Expert Comment

ID: 7125988
Your disk may have a problem since you stated XP was getting more unstable. I would suggest running a disk diagnostic untility from www.maxtor.com and see what it comes up with.

The Crazy One
LVL 44

Expert Comment

ID: 7126000
The stop error does seem to indicate a possiblity that the disk is the problem.


"Disk Corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and EIDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error."

Have you tried running CHKDSK /R from the Recovery Console?
Access Recovery Console

Doing a repair may work but I am not sure if it repairs a damage file system though.

Click on How To Repair Windows XP by Reinstalling
LVL 22

Accepted Solution

Adam Leinss earned 525 total points
ID: 7127509
Personally, I would go to the store and buy a hard drive temporarily.  Then I would somehow find a copy of EasyRecovery Pro 6 to do the recovery to that hard drive. Then wipe the old drive, copy whatever data that was recovered back to the old drive and then return the new drive.

How do you know rebuilding $MFT or $Secure metafiles will solve the problem???
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 7127596
I doubt that it is a PHYSICAL problem, as I have performed a cluster by cluster test about a month ago (when XP began becoming unstable).

The reason I believe it was a result of the conversion is because Windows 98 (what I had before XP) had a hard time managing the large capacity of the drive. It was not until later that I read that FAT32 cannot support drives over something like 16 GB and that anything larger can result in inaccessible information, file corruption, etc. That is why I wanted to create the second partition to copy over my files as I believed that the NTFS file system, although supportive of drives up to 2 TB, had inherited the instabilities of the previous FAT32 filesystem.

In answer to aleinss' question, I am pretty certain that rebuilding the metafiles will help because any programs I have run that depend on the metafiles to read the drive will report "There is no discernable file system present". Yet, programs like R-Studio, which read from the MFT only (if present) and also scan the disk briefly, will display all my files and also report that the two metafiles I mentioned earlier are empty/corrupt/zeroed/etc.

Author Comment

ID: 7127605
Oh, and BTW, CHKDSK does not support the /R option in the recovery console as it is implied. I tried that FIRST (which reported the same error as I stated in my first message, "Readable file record segment 0 is not writeable") as I did not yet have the drive in my parent's machine and didn't have an active copy of XP to use.
LVL 22

Expert Comment

by:Adam Leinss
ID: 7128002
Understood.  I realize that it is not a physical problem, but you stated you don't have a hard drive big enough for the recovery, thus the suggestion of the new hard drive.

I have myself recovered from Partition Magic's bad days, although I was running FAT-32 and there are freeware utilities to rebuild pouched FAT-32 partitions.  You may want to try the NTFSPro demo at http://www.winternals.com/trynow/ which will allows reads of NTFS volumes and see if it will pick it up in DOS.

I think the Ranish Partition Manager can manipulate NTFS partitions.  You may want to take a look at it here:


Author Comment

ID: 7128252
Okay, I've run the Maxtor utilities and my drive passed all tests, including the Factory re-certification test (I didn't run the burn-in test, but I didn't think it was really necessary after the drive passed the re-certification test). So we can rule out a physical cause for the problem.

As for the NTFSDos Pro from Winternals, as well as their EBD Commander and Disk Commander software, it wasn't any help (good suggestion, though). I already tried the entire Administrator's pack from Winternals (includes everything) before posting. Disk Commander told me my drive was fine (it specializes only in corrupt boot sector / partition tables, so to it my drive was fine). EBD commander didn't recognize the drive at all (nor did it recognize the GoBack-protected drive in my parents'  machine). NTFSDos complained that the drive it was attempting to mount was incorrect for the driver I was using (but it copied the driver from Windows XP's own system32 directory!!).

One last thing I might try is using the version of CHKDSK that EBD Commander comes with. It might do the repairs as it was coded by Winternals, not Microsoft. I love how Microsoft lets 3rd parties solve problems with filesystems Microsoft creates. I'll keep you all posted; thanx for all your suggestions.

Author Comment

ID: 7138748
Okay, I got a few drives together and used "GetDataBack for NTFS" to restore only important files, or files that I would not be able to recreate. Then I reformatted and reinstalled XP. I'm now restoring my apps and the backup data.
LVL 22

Expert Comment

by:Adam Leinss
ID: 7138922
Glad to hear it!

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question