2

I used Avira Rescue Disk (Ubuntu 12.04) to access a broken NTFS boot partition. Windows 7 fails to mount it: it displays a bluescreen ("UNMOUNTABLE_BOOT_VOLUME") and restarts immediately. With the Rescue Disk I could backup the most important data (Ubuntu does not fail on mounting). Now I tried gparted to fix the partition. To analyse the partition, gparted runs a scanning-only ntfsresize first.

A similar (= non-writing) but manual run of ntfsresize -info --force /dev/sda3 gives:

ntfsresize v2012.1.15AR.1 (libntfs-3g)
Device name        : /dev/sda3
NTFS volume version: 3.1
Cluster size       : 4096 bytes
Current volume size: 484336226816 bytes (484337 MB)
Current device size: 484336230400 bytes (484337 MB)
Checking for bad sectors ...
Checking filesystem consistency ...
  0,00 percent completed
..
..
..
 12,83 percent completed
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73604 count=1 br=-1: Eingabe-/Ausgabefehler (= I/O error)
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73605 count=1 br=-1: Eingabe-/Ausgabefehler
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73606 count=1 br=-1: Eingabe-/Ausgabefehler
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73607 count=1 br=-1: Eingabe-/Ausgabefehler
 12,85 percent completed
..
..
..   
 100.00 percent completed
Accounting clusters ...
Cluster accounting failed at 9962391 (0x980397): extra cluster in $Bitmap
..
..
..   
Cluster accounting failed at 9963113 (0x980669): extra cluster in $Bitmap
Filesystem check failed! Totally 723 cluster accounting mismatches.
ERROR: NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.

So, the $MFT seems to be broken. However, ntfsfix --no-action /dev/sda3 (non-writing) states:

avira@avira:~$ sudo ntfsfix -n /dev/sda3
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
NTFS volume version is 3.1.
NTFS partition /dev/sda3 was processed successfully.

Whom can I trust? What really happened to my $MFT? Why can Ubuntu still read most of the files, and Win 7 fails to mount (expect from being Windows)? What tool should I use to fix the MFT: gparted or testdisk or ntfsfix (without --no-action) or chkdsk /f? Haven't felt lucky yet. I've read about testdisk being able to mess up $MFT and $MFTMirr in severe cases. Could that happen?

Additionally, SMART reports one bad sector (Reallocated Sectors Count = 1). Should I renew the disk in any event?

What can I run else to (at least) locate the error (e.g. affected filenames, electromechanical failure y/n?) better?

Improve this question
4
  • Your hdd failed your MFT was on the corrupted sector.
    – Ramhound
    Apr 7, 2014 at 11:19
  • 1
    @Ramhound Obviously, yes. What next? Should I try chkdsk /r?
    – unndreay
    Apr 7, 2014 at 14:32
  • TestDisk will be the savior, read its documentation and do the actions carefully.
    – Ĭsααc tիε βöss
    Aug 11, 2016 at 4:57
  • Linux doesn't have a (free) equivalent of Window's chkdsk. That's why it's suggested for use by the Linux utilities you used. I don't see where you followed those suggestions . . .
    – kreemoweet
    Jan 27, 2017 at 19:36

1 Answer 1

Reset to default
2

If the MFT$ file got corrupted, try R-STUDIO to rescue the data on that drive.

Important: Do not perform any write operation to the corrupted drive!

  1. attach the corrupted drive to a working windows system
  2. analyze the drive using r-studio
  3. copy any good data to a new drive
  4. delete all partitions on the corrupted drive ("old drive")
  5. create a new partition on the old drive and format
  6. use a tool of your choice to analyze the drives hardware, if required.

Done!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .