Master Boot Record and Master File Table corruption on external drive with critical data, anyway to rebuild without compromising data?

Posted on 2007-10-09
Medium Priority
Last Modified: 2008-01-09
The only way I can properly begin this question is by first stating how devastated I will be if  I lose ten years worth of photos, music, videos etc. Ironically I was in the process of creating a copy of all the data on to another external drive, in order to have two copies in case of failure. I let it run and came back into the room to find an error message that now I cannot recall, and suddenly Windows gave me the "unable to access drive" error. It is still being recognized by windows as "local disk D" but it will not let me into the drive.  Chkdsk will not run on the drive and i'm afraid of doing anything for fear of ruining the data. I know it is still in there, it has to be because the disk is fully functional. What can I do in this situation to perhaps "rebuild" the MFT and MBR sector by sector or who knows what so that I can see the structure of the drive once again. Thank you in advance for any help!!!

-By the way i am running  Windows XP sp2.
Question by:Manzola
  • 7
  • 6
  • 2
LVL 66

Accepted Solution

johnb6767 earned 1600 total points
ID: 20043476
I would slave the disk, and start the data recovery process immediately, ad do no further testing as it will only get slower.....

EasyRecovery Data Recovery - Trial Edition  (you can scan for free, and purchase if you like what it finds...)

GetDataBack Data Recovery Software

And when slaving the drive, you might need to take ownership of the files to gain access....

How to take ownership of a file or folder in Windows XP
LVL 63

Expert Comment

ID: 20043521
1) Use an imaging program ( Ghost or Acronis ) to create a direct byte for byte copy of the bad drive, preferably by removing it from it's case and hooking it in directly to a computer.

2) Once you have an image, you can try several recovery methods.

Do not use the drive to install any of this software.

Remove it from your PC and slave it to another machine.  Everytime you write data to the disk you decrease the chance of successfully recovering erased data from it.  By installing Windows you have already overwritten a large chunk of the previous disk contents.

From  war1
1. Data Recovery: GetDataBack is good at recover data from formated drive.

PC Inspector            http://www.pcinspector.de/file_recovery/UK/welcome.htm
Restoration                  http://www.snapfiles.com/get/restoration.html              
Active Undelete            http://www.snapfiles.com/get/activeundelete.html
Flash Recovery            http://www.snapfiles.com/get/smartrecoverontracky.html
TestDisk & utilities      http://www.cgsecurity.org

GetDataBack                  http://www.runtime.org/      
FreeUndelete            http://officerecovery.com/freeundelete/index.htm
Recovery My Files            http://www.recovermyfiles.com/
Stellar                  http://www.stellarinfo.com/            
Restorer 2000            http://www.bitmart.net/
Ontrack                  http://www.ontrack.com/
Easy Recovery            http://www.ontrack.com/easyrecoveryprofessional/
Zero Assumption            http://www.z-a-recovery.com/setup.exe
2. You may need to unhide hidden files to see them. Open Windows Explorer folder and select Tools > Folders Options > View. Check "Show hidden files and folders". Click OK.

3. You may need to take ownsership of folders and files to access them.

I hope this helps !

Author Comment

ID: 20043545
Thanks for the prompt reply! I should note I have used several programs to attempt to recover data, is this potentially a problem? I have managed to get barely anything out of it, most of it is raw data.  I also have EasyRecovery but that one was the worst at finding anything. I am at the moment running getdataback but it has thus far found 10000 files out of my 90000+. I guess what I am trying to do is find a way of re-building the mft or mbr, if at all possible. What ever it takes. if i have to learn something extremely complex so be it. It would be even better if there was a program that could do it by itself.
Free recovery tool for Microsoft Active Directory

Veeam Explorer for Microsoft Active Directory provides fast and reliable object-level recovery for Active Directory from a single-pass, agentless backup or storage snapshot — without the need to restore an entire virtual machine or use third-party tools.


Author Comment

ID: 20043580
SysExpert, do these data recovery programs or testing utilities write on to the disk? I have ran several of them that scan the data to figure out what can be recoverable, but I have not done anything that would write onto the drive. I don't have any istallations on that drive, it is purely external and used for backup. So ironically I am trying to backup the backup drive. Would slaving it on my system have the potential to write data onto a NTFS volume that is not recognized by the system ( it shows up on my computer as local disk D) but it will not let me access the files inside (error).  
LVL 66

Expert Comment

ID: 20043602
Whast teh error?

Personally, I dont think they write anything, but you are doing more activity in excessive reading, and if there are physical errors, you might escalate how fast they go downhill....

Are there any DISK, ATAPI, or NTFS errors in the event logs>System?
LVL 66

Expert Comment

ID: 20043608
"Whast teh error?"

Should have read Whats teh error? Anything besides the Unable To Access Drive?

Author Comment

ID: 20043735
Here are the detailed errors from the event logs, and thanks for mentioning it forgot about this.

The fist error on the log before the crash is:

"An error was detected on device\Device\Harddisk1\D during a paging operation

Then it gives

"The system failed to flush data to the transaction log. Corruption may occur"

It gives about 40 more of that error in the log before it finally gives this one, which is the one I remember that popped up on my screen, right after I clicked ok I could no longer access my drive:

Windows- Delayed Write Failed: Windows was unable to save all the data for the file F:\$mft. The data has been lost.

I hope this helps, I truly do.
LVL 63

Assisted Solution

SysExpert earned 400 total points
ID: 20043938
Well, it could be that the drive is failing, so you may need to check that first.

http://www.hitachigst.com/hdd/support/download.htm               Drive Fitness Test
http://www.seagate.com/maxtor/           Maxtor & Quantum
http://www.fcpa.fujitsu.com/support/hard-drives/software_utilities.html#diagnostic Fujitsu
http://www.samsung.com/Products/HardDiskDrive/utilities/shdiag.htm     Samsung
http://support.wdc.com/download/#diagutils                    Western Digital
http://www.hgst.com/hdd/support/download.htm             IBM & Hitachi  DFT

I would do an image copy first, so that if one of th programs can not recover the data, you can restore and try again with a different program.

If the drive is going bad, then you need to get the data off quickly !!


Author Comment

ID: 20043975
Drive has passed DFT, I will try the maxtor drive utilities to double check. The I will also make an image copy of the disk because I am running all of these programs without having done so yet
LVL 66

Expert Comment

ID: 20044412
Can you upload the .dmp files from c:\windows\minidump to http://www.ee-stuff.com? We might be able to isolate the faulting module....

I dont believe it is a hidden folder.....

But you can always verify if it is even set to minidump...

Contro Panel>System>Advanced>Startup and Recovery, and make sure it is checked to do a small minidump, and note the directory...

Author Comment

ID: 20044550
I have the minidump on my default. I looked for it everywhere (it is supposed to be located on the system root\minidump. I unchecked hide hidden folders and I still can't find it! I even searched for .dmp files in my system and found none? Not sure what is going on here but I know it would help to have it. Any other suggestions?
LVL 66

Expert Comment

ID: 20045433
Is your SWAP file on another Drive?

Author Comment

ID: 20045464
No it's on the Main drive
LVL 66

Expert Comment

ID: 20045492
Thats odd.....

Thats the only thing I can think of that would prevent it from dumping....

Might try cycling through the dumoing, by disabling it, and rebooting. Then re enable it and even change the location....

Author Comment

ID: 20045613
It is strange. I tried what you told me to do, it still wont show up for some reason.

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We look at whether swapping a controller board on a failed hard drive is likely to solve the problem.
This article shows how to use a free utility called 'Parkdale' to easily test the performance and benchmark any Hard Drive(s) installed in your computer. We also look at RAM Disks and their speed comparisons.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Despite its rising prevalence in the business world, "the cloud" is still misunderstood. Some companies still believe common misconceptions about lack of security in cloud solutions and many misuses of cloud storage options still occur every day. …
Suggested Courses
Course of the Month17 days, 9 hours left to enroll

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question