Solved

Fixing: corrupt master file table

Posted on 2011-02-28
28
1,271 Views
Last Modified: 2012-05-16
Hi all. I have a harddrive that suddenly is became non-accessible.
I have tried running CHKDSK on it with a number of switches,
but nothing works. I immediately get the message:
"corrupt master file table". It doesn't look like CHKDSK is even
able to start doing any work.

I am running Windows XP and just installed SP3 yesterday
(I don't suppose there is any connection?)  Is there anyway to
repair the master file table, or rebuild it or replace it?  

This is pretty critical, because I have quite a bit on this drive.
No - I don't have a backup.

Any help would be appreciated.
0
Comment
Question by:sshani
  • 11
  • 8
  • 4
  • +3
28 Comments
 
LVL 1

Expert Comment

by:TNP_Doug
Comment Utility
You can boot to a Windows XP install disc and press R at the first screen.  This will get into a repair mode.   You may have to enter in the Administrator password if you have one set.

Once you do that you can type:

fixmbr

This will rewrite the MFT on the disk and hopefully resolve your issue.
0
 
LVL 6

Expert Comment

by:rnicolaus
Comment Utility
First of all, Do you have another computer you can put this drive in as a "slave"?

SP3 almost certainly didn't "cause" this, it probably just came across bad sectors and something happened.
0
 
LVL 33

Expert Comment

by:paulmacd
Comment Utility
Try FIXBOOT and FIXMBR.
0
 
LVL 35

Accepted Solution

by:
torimar earned 500 total points
Comment Utility
The FIXMBR and FIXBOOT commands will not help in any way, because they repair the Master Boot Record or the Boot Sector - both have nothing to do with the Master File Table (MFT).

CHKDSK is indeed the Windows tool to repair a damaged MFT. If, as you say, CHKDSK did not work, try the following:
-- download the "Parted Magic" live CD: www.partedmagic.com
-- boot the computer off it
-- first: try to mount your hard drive (click the 'Mount' tool) and see if you can access your data via the Linux file manager that will automatically open; if so, make a backup of important data.
-- then start TestDisk (via the Start menu)
-- follow the advice given here for repairing an NTFS MFT: http://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair
-- more info on Testdisk here: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

If that fails, consider using a recovery program on your dive to get your data back, then reinstall Windows. Take the drive out and slave it to another computer if you want to use such a program.
Here is a list:
http:/www.piriform.com/recuva
http://www.pcinspector.de/default.htm?Language=1
http://www.runtime.org/data-recovery-software.htm
http://www.data-recovery-software.net/
http://www.r-undelete.com/

(The first two are free, the others have demo versions which help test what they may recover.)
0
 

Author Comment

by:sshani
Comment Utility
All,

Thanks for the tips. I will definitely try them.  This drive, luckily, is NOT my main drive, so it IS in my machine as a "slave" (it's SATA). Nonetheless, I will throw it into another machine and run the FIXMBR command. Hopefully it will be that easy.... Will keep you posted.
0
 

Author Comment

by:sshani
Comment Utility
ok.  Tried it - didn't help.
0
 

Author Comment

by:sshani
Comment Utility
Genius ID:  34999376,  I will try your suggestions. Stay tuned...
0
 
LVL 35

Expert Comment

by:torimar
Comment Utility
If the drive is a second HDD in a working machine you can also use the Windows version of TestDisk:
http://www.cgsecurity.org/wiki/TestDisk_Download

But it is always worth trying to boot with Parted Magic, simply to test if Linux lets you access your data. With that particular Linux CD I managed to access hard drives that weren't even recognized by the BIOS ....


ps:
I told you FIXMBR would not fix it :)
0
 
LVL 6

Expert Comment

by:rnicolaus
Comment Utility
Yeah - I would be careful throwing around the FixMBR - could have (not highly likely but possible) actually caused a problem on the main drive since the drive was already a slave.  

I agree with torimar on trying one of the demos (ie. http://www.runtime.org/data-recovery-software.htm) then possibly buying if it shows good chance of recovering the data.
0
 

Author Comment

by:sshani
Comment Utility
torimar:

The results of running partedmagic are not good.  BOTH main MFT and mirrored MFT are bad. it was not able to rebuild or fix.  I am trying a recovery tool from "zero-assumption-recovery".  I am not too hopefull, but we'll see...
0
 

Author Comment

by:sshani
Comment Utility
One more thing:  I am fairly certain the data (files and folders) is still there. It's just that the Master File Table is corrupt, so windows can't get to the files and folders.
0
 
LVL 35

Expert Comment

by:torimar
Comment Utility
Did you try to access the files in Parted Magic? Sometimes it works.

Yes, the data will still be there, as long as you continue to use tools that don't overwrite anything on the faulty disk, or try to restore to that disk.
This is very important: only use good recovery tools that will access that disk in read-only mode.
I never heard of the "zero-assumption" tool in many many years, so I am very sceptic about it. All the tools I recommended, especially GetDataBack by Runtime.org, will do a good job though.
0
 

Author Comment

by:sshani
Comment Utility
torimar:

I tried to access the files - it showed me nothing.

I was "directed" to zero-assumption from one of your recommended steps: http://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair

There was a link to their software on that page, so I followed it.  :)
 I'll take a look at GetBackData too
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 35

Expert Comment

by:torimar
Comment Utility
I see. :)
I even read that page again before I posted it here. I guess one can never remember all the tools out there.

But I'd blindly trust the guys on CGSecurity; they really know a lot about hard drives and recovery. So I think I need to retract my warning.
0
 

Author Comment

by:sshani
Comment Utility
torimar,

No worries.  Actually, I just finished running GetDataBack (for NTFS), and it didn't show as much recoverable data as ZeroAssumption did. Unless that's part of their trial deal (which it didn't seems to be).

I'll make a decision on which way to go (I am leaning towards Zero Assumption) and keep you posted.
0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
try running HDDregenerator :  http://www.dposoft.net/      
it has helped me in the past...
0
 

Author Comment

by:sshani
Comment Utility
Hello all.  Well, my files have been completely recovered.  I actually got a tip from another software vendor whose software I use and was able to recover ALL 89Gb worth of files (something in the order of 64000 files.

I purchased a $35 package called Active File Recovery (http://www.file-recovery.net/).

The software ran flawlessly and recovered all the files without compromising or degrading anything.

I wish I can award the points to someone, but I actually found this solution on my own. I hope that my sharing this information will be considered a "fair" trade for points.  :)

Thanks to all that helped me dig into this issue and point me in some directions, which helped me find a solution.
0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
well - your question was not about recovering data, but about fixing an MFT which is quite another horse...
0
 
LVL 35

Expert Comment

by:torimar
Comment Utility
I agree with nobus.

Do you really mean to suggest that "Go and buy Active File Recovery" would have been the correct solution to "Is there anyway to
repair the master file table, or rebuild it or replace it? "
- which is, after all, the wording of your question?

In my comment (ID:34999376) I gave a detailed description of one of the best methods to recover the MFT, provided it is still recoverable - which, unfortunately, turned out to not be the case. This means that your original question has to be answered: "No, it cannot be done in this specific case" - which would also be a solution in terms of Experts-Exchange: http://www.experts-exchange.com/help.jsp#hs=29&hi=405

In my comment, I continue: "If that fails, consider using a recovery program on your drive to get your data back". That is the solution. I also suggest a couple of example recovery programs. You cannot expect me to list all of the many dozens of commercial tools out there: I am here to help people solve their problems, not to advertise software that you need to pay for. Also, no expert can test all those tools for all empirical eventualities.
Since you needed to "do a little more research" you were free to reduce the grade of my solution (http://www.experts-exchange.com/help.jsp#hs=29&hi=403 ), or to accept your own comment as an assisted solution, but you can only select your own post as the sole solution if you received "no assistance by any expert" (http://www.experts-exchange.com/help.jsp#hs=29&hi=407 ).
0
 

Author Comment

by:sshani
Comment Utility
nobus, torimar:

Easy does it!    Yes, my original question was about repairing a Master File Table, and yes through your specific (combined knowledge) conversations I determined that both of my MFT files were bad - I would NOT have been able to determine that without your help...granted.  This is a collaborative forum, at least that was my impression, if we were all working for the same company on the same team - we would stand around discussing this as ideas and revelations would be flying around. Meaning - your advice actually made me realize that I simply need to recover the files (since the drive was not the master and had no OS on it).

Yes, you recommended a couple of data recovery tools, which I looked into. The free ones didn't really offer anything special (which I wouldn't expect them to from the price.. ;-) ), and the "at cost" ones looked promising. One, in particular: Zero Assumption looked like it would do the job, but was $75 to purchase.

Looking for a slightly better deal, which we all do!, I found another solution for less money which worked perfectly to solve my issue and recover the files.

If it is about the points - I'll be more than happy to go back and award them all to you. But, I thought it was about people helping people find solutions.  I will say again - I could NOT have solved my issue without your help.  

I am not suggesting for one minute that folks here spend time looking and listing all available (free or otherwise) solutions or software packages out there. We don't all know everything - that's why Experts-Exchange is a great place.  I hope someone else would benefit from my experience here as well, under the same situation...I would not care so much about the points either.

Please let me know if you would like for me to go back and award the points. No ill will, please - did not mean to upset anyone or step on any toes!

Good day.

0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
i'm only flabbergasted...you can do with the points as you seem fit, no offense taken here.
but you asked a question on MFT repair, and end up with accepting data recovery options from yourself
0
 

Author Comment

by:sshani
Comment Utility
Things do not always work out as you expect them - I initially thought the solution would need to involve MFT repair, but through conversation with you and torimar came to realize that i just need to get to the files, and the MFT was not as important.  I guess I should have retracted the original MFT question.

I accepted the solution simply to mark it as "done".
0
 
LVL 35

Expert Comment

by:torimar
Comment Utility
sshani,

please accept my apologies for letting the impression arise that there could be ill will involved. It was my fault to not check your member profile first. I would have seen that this is your first question on E-E, and I would have formulated my objection in some other way to help you get acquainted with the inner workings and principles of this site.

For it appears to me that you have a number of conceptions about this place which are not quite correct. Our admins and moderators are usually very good at explaining; you may want to wait for one of them to pass by and revise this thread (which will happen because of my objection), or you could refer to the Help section: http://www.experts-exchange.com/help.jsp

Let me say only this much: in order to understand E-E you need to know that it is not a "discussion forum" or a "community", it is a problem-oriented expert system. The contributing experts are neither bored individuals nor payed employees - they are volunteers. In order to make them return here and continue spending what IT experts have least of, i.e. time, Experts-Exchange needed to device a complex system of incentives. As you may see, the system works. But it will only work as long as the experts receive what they consider fair and just treatment.
In order to regulate this treatment in a manner as objective as possible, E-E has established a number of rules. You will find them when browsing the help section. A lot depends on the responsible way in which askers deal with the questions they asked, and how they finalize them.

In my above comment (ID:35043604) I point out why I think that your proposed way of closing this thread does not completely conform to those rules. I also point out why I think that my comment ID:34999376 is a solution to your original question, maybe a solution grade B, maybe an assisted solution (that is your call), but a solution nonetheless.


ps:
Please let me point out that nobus' and my position in this issue are quite different. If you re-read the thread, you will realize that nobus came too late to be involved in a solution. And he only joined the discussion to express his amazement. It was me who objected, and I did so because I thought I had posted a solution which was not being taken into account.
0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
i also offered a possible solution...but he never said he tried it
0
 
LVL 35

Expert Comment

by:torimar
Comment Utility
Yes, and that is why it remains merely hypothetical.

There is a difference between "potential solutions" and actual solutions. Most every comment in a thread represents a 'possible solution', but only those who point into the way in which the problem actually was solved can be taken into account when finalizing a question.

Twelve hours before you offered your solution, sshani had already begun to test recovery software, and it was by means of recovery software that she managed to get her files and data back. If you re-read the original question you will see that getting the data back was the principle concern. It was only an assumption that a repair of the MFT was the exclusive way to accomplish this.
0
 

Author Closing Comment

by:sshani
Comment Utility
Links and comments provided by torimar led me to the right solution, which was a commercially available file recovery package. After multiple attempts to recover and rebuild the MFT, it occured to me that file recovery is really all I needed. A link provided by torimar mentioned file recovery and that was the "light bulb" for me.
0
 
LVL 35

Expert Comment

by:torimar
Comment Utility
Thank you very much, sshani.

I apologize for any inconvenience.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Introduction: When experiencing some peculiar problem with the functioning of your PC, how many times has it happened that you look for a solution and even google can’t help? It could be that you are one of the only few people on earth who ma…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now