1

My computer will not boot because of a corrupted MFT and MFT mirror, I found a program that claims to be able to repair the MFT (Getdataback) but all it seems to do is recover the files that were on the drive. I can already access the files on the drive through an Ubuntu Live session, making a "recovery" tool pointless. I have already run Chkdsk and Testdisk, chkdsk says there are no problems, testdisk tells me "MFT corrupted MFT mirror corrupted repair failed" The windows installation disc doesn't help, I tried That too. Many cases of MFT damage seem to result in the drive becoming unusable, basically ceasing to exist at a software level, but if my filesystem is otherwise intact, what does it mean to "repair the MFT" does it mean to make a list of the files on the drive? From what I've been able to find that's what the MFT seems to be, but if it were that simple, it wouldn't be so hard to repair. As its complexities are unclear to me, would somebody explain the MFT?

2 Answers 2

1

The MFT is a complex and very important part of the file system, which keeps track of all the meta-data from all the files on an NTFS partition, not only their names and attributes, but also the precise location of each and every one of the clusters they occupy. Without the MFT, the files on a partition become an undecipherable bunch of bytes with no structure. Some programs can recover files by examining their so-called "signature", i.e. the header and footer, but if files are massively fragmented the result will be very poor.

If a an Ubuntu system can access the file tree, and read or extract valid files from it, it means that the MFT is not actually damaged, but still somehow corrupted enough so that Windows can't deal with it. I've had one instance where a partition became corrupt on an external HDD, and CHKDSK failed to repair the filesystem. TestDisk also failed to recover the MFT (anyway, the so-called "MFT mirror" only mirrors the first few sectors of the MFT, so there are few cases where this may work). I first saved all the files and folders (using DMDE, a complex but excellent data recovery software), then I examined the partition with WinHex : I discovered that the MFT appeared to be shifted by one sector relative to its expected location. So I made a backup of the first 5GB (normally containing the whole file system structures including the complete MFT – but not always), and first tried to shift the whole MFT by -1 sector, but it didn't work, it was still considered corrupted. Then I restored the backup, and tried to copy only the first sector onto the preceding sector, which should have been the first sector of the MFT but was now empty, and I ran CHKDSK again : guess what, this worked ! CHKDSK did effectively repair the file system and the whole file tree was accessible again from Windows Explorer.

0

MFT is the Master File Table, it's what NTFS uses to keep track of all the file names their permissions, owners, etc.

chkdisk or another similar tool should be able to repair this for you.

4
  • 1
    Let me clarify, I already know that MFT stands for Master file table, and that it is used to keep track of the files on the disk, what I need to know is why it is so hard to repair it
    – Devon M
    Sep 12, 2013 at 16:40
  • @ChuckFulminata - The reason why its hard to repair would come down to the reason it needs to be repaired.
    – Ramhound
    Sep 12, 2013 at 17:25
  • @Ramhound Which is?
    – Devon M
    Sep 12, 2013 at 21:17
  • I have no idea what the reason your MFT corruption you should tell us that
    – Ramhound
    Sep 12, 2013 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .