2

After I unplugged my external drive after a phony safe removal on Ubuntu, two sectors are destroyed. The important sector contained records 4 to 7 (which is $AttrDef, $ (root), $Bitmap and $Boot) of the NTFS MFT. The sector now gives an IO error and mounting the device is impossible this way.

I copied all other accessible bytes to files on a new external drive. The file system except for the MFT is intact, everything is there.

I'd like to know which method or tool exists to recreate, regenerate these MFT records? They are not mirrored so I could not imagine them being unrecoverable. I think of recomputing these records from the available residual files.

And if there is no tool like that could you provide me a site with enough information so that I could write a simple tool or script by my own? I don't care, whether it takes long or whether I have to traverse the whole rescued files.

Thank you very much!

Improve this question

2 Answers 2

Reset to default
1

I am not aware of any tools that can do this, mirror of MFT only contains first 4 records if I am not mistaken despite the popular belief that a backup of the entire MFT exists somewhere. These are contents of this mirror with MFT template engaged so we can clearly see the 4 records it backs up:

enter image description here

Any documentation/info you might need should be here: https://flatcap.github.io/linux-ntfs/ntfs/files/index.html

File recovery is very possible though as for that we do not need these records. A cheap tool like DMDE ($20 - one year license) should be able to salvage everything.

Improve this answer
4
  • That documentation link is very great. Together with the microsoft documentation it is very helpful in understanding the fields. I would try to take MFT records from a healthy NTFS partition and modify them. I hope, the records did not contain the file contents and I only need to set the right reference. In the best case I could interpolate file references from other records.
    – ChrisoLosoph
    Jan 14 at 18:34
  • 1
    Extracting data is probably easier/quicker. But good luck anyway!
    – Joep van Steen
    Jan 14 at 22:53
  • Dear Joep van Steen, do you have any recommendation how to extract the files in the quickest way? I am involved in my studies and I actually would prefer to recover the files possibly fast, so that I can continue doing backups. I used already a lot of hours for this issue.
    – ChrisoLosoph
    Jan 16 at 18:48
  • 1
    DMDE (dmde.com) as I suggested is my goto tool.
    – Joep van Steen
    Jan 16 at 21:44
0

One tool that specializes in recovery partially-destroyed disks is TestDisk.

The recovering of the MFT and the partitions table is described in the article Advanced NTFS Boot and MFT Repair.

Note that a backup of the MFT should exist on the disk, and TestDisk should be able to find and restore it.

Improve this answer
7
  • mirror only cover first 4 records of $MFT AFAIK. There is no full backup of MFT.
    – Joep van Steen
    Jan 13 at 21:20
  • @JoepvanSteen: It contains a copy of the first 4 files : $MFT, $MFT Mirror, $Log, $Volume. See link.
    – harrymc
    Jan 13 at 21:24
  • No it does not, flatcap.github.io/linux-ntfs/ntfs/files/mftmirr.html. It backs up 4 records, not files.
    – Joep van Steen
    Jan 13 at 21:25
  • @JoepvanSteen: Your link says exactly the same. With this data, reconstructing the MFT might be possible. Or do you say that TestDisk is lying in its documentation?
    – harrymc
    Jan 13 at 21:27
  • I am saying backup MFT backs up 4 records. Don't put words into my mouth. Look at size of data attribute, 4096 bytes = 4 records of 1024 bytes: imgur.com/a/lup9PAy. Your link is wrong and does not say the same.
    – Joep van Steen
    Jan 13 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.