# MFT corrupt, Chkdsk cannot recover it



## dbboeder (Feb 19, 2008)

Hello,

I have a secondary 2TB Hitachi harddrive on my PC, its about 11 months old. I restarted my PC and a chkdsk window appeared saying



> Checking the file system on T The type of File system is NTFS volume lable in recovery One of your disks needs to be checked for consistancy. You may cancel the disk check but it is strongly recommended that you continue. Window will now check the disk. Corrupt master file table. windows will attempt to recover master file table from disk.


About 30 mins later



> Windows cannot recover master file table. Check disk aborted.


I can boot normally as this (T is not my boot drive but the hard disk itself has two partitions (T and (S, the latter has Windows 7 installed, works fine and is accessible. I have another hard disk (WD2500JS) which is my primary and has Vista on it, also fine.

What I've tried:
- Chkdsk /f, chkdsk /x
Results: 
1. I get


> Windows cannot recover master file table. Check disk aborted.


2. When clicking on T: in my computer I get


> The disk structure is corrupted and unreadable


Possible cause (guess) :
- I restarted PC without dismounting a TrueCrypt volume on T:

Please help me out guys

- How can I repair MFT?
- How can I backup my files and should I do it before repairing MFT?
- Finally: What are the odds my data will be fine? Difficult Q, I know! :4-dontkno

PC Specs
AMD Athlon 64 3400+, 3GB RAM, Vista Home Premium/7 (dualboot), 2 Hard disks - WD2500JS (primary, single partition) and Hitachi 2TB (secondary, two partition S: and T

Any help would be appreciated, I'm freaking out here :sigh:

Thanks


----------



## pip22 (Aug 22, 2004)

Try TestDisk: TestDisk - CGSecurity


----------



## dbboeder (Feb 19, 2008)

pip22 said:


> Try TestDisk: TestDisk - CGSecurity


Will it affect my data in anyway? I do not have it backed up. I really can't afford to lose anything.

If it's totally safe I'll go for it


----------



## Networks (Mar 20, 2011)

Your doing data recovery nothing about it is really "safe" however if you go buy another 2TB drive and "image" the problem drive and work off the image you are not working on the drive that is having "issues" that is the safest method you can do. Its always a bad idea working on the drive having problems. That said test disk can try to recover the mft using the backup MFT if it finds it however all changes written to the disk are permanent so you taking a risk. If you do the same to the image and it doesn't work you still have the original to go back to. If your not confident in what your attempting then hand it off to someone who has experience doing this. just a suggestion.


----------



## dbboeder (Feb 19, 2008)

Networks said:


> Your doing data recovery nothing about it is really "safe" however if you go buy another 2TB drive and "image" the problem drive and work off the image you are not working on the drive that is having "issues" that is the safest method you can do. Its always a bad idea working on the drive having problems. That said test disk can try to recover the mft using the backup MFT if it finds it however all changes written to the disk are permanent so you taking a risk. If you do the same to the image and it doesn't work you still have the original to go back to. If your not confident in what your attempting then hand it off to someone who has experience doing this. just a suggestion.


Makes sense. But will the image software (I have Acronis True Image 2010) recognize the faulty HD? Any other software you recommend?

I am pretty confident I can do it, but are there any sites/tutorials that can help?


----------



## Networks (Mar 20, 2011)

No way for me to know if Acronis will or wont image your drive you just have to try! I use DD to do a "bit stream image" which just copies each sector and doesn't look at the "MFT" or "format" it doesn't care. I know Acronis does and Ghost as well and if it thinks something is wrong it may or may not copy the data. Lots of tools also use DD for you can use FTK imager. I am not aware of any specific tutorials for your data recovery case since each recovery is different but the fundamentals are the same.
Data recovery is a closely held trade and not very much info is shared out there.
myharddrivedied.com has a ton of info that will take time to read through but since you want to go about this DIY then spend some time reading it will pay off


----------



## dbboeder (Feb 19, 2008)

Networks said:


> No way for me to know if Acronis will or wont image your drive you just have to try! I use DD to do a "bit stream image" which just copies each sector and doesn't look at the "MFT" or "format" it doesn't care. I know Acronis does and Ghost as well and if it thinks something is wrong it may or may not copy the data. Lots of tools also use DD for you can use FTK imager. I am not aware of any specific tutorials for your data recovery case since each recovery is different but the fundamentals are the same.
> Data recovery is a closely held trade and not very much info is shared out there.
> myharddrivedied.com has a ton of info that will take time to read through but since you want to go about this DIY then spend some time reading it will pay off


Appreciate it! What's "DD" though, I'm not particularly good with software acronyms :grin:


----------



## Networks (Mar 20, 2011)

Let me google that for you
dd (Unix) - Wikipedia, the free encyclopedia


----------



## dbboeder (Feb 19, 2008)

Networks said:


> Let me google that for you
> dd (Unix) - Wikipedia, the free encyclopedia


Thanks! Appearently there is a version for windows, doesn't seem to support hard drives through (only floppies and USB drives)..

Unfortunately, I do not have any experience with Unix but I think this program should work on Ubuntu, no? Where can I download it? and is it the same as dd rescue?

Thanks for all your help


----------



## Networks (Mar 20, 2011)

Linux is a much better data recovery platform hands down. If your not comfortable in Linux its only going to make it much harder for you as terminology is vastly different than in Windows world. However I did some more heavy lifting for you. The link below you can download this tool and image the drive. Data Recovery is not a simple push one button operation its a process and at times can be complicated. That is why its not a simple DIY thing as a lot of people are "for reasons unknown to me" lead to believe.
DataRescue's DD - DRDD - data-recovery oriented device imaging made easy

Your are going to have to put some time & effort into this google and reading.


----------



## dbboeder (Feb 19, 2008)

Networks said:


> Linux is a much better data recovery platform hands down. If your not comfortable in Linux its only going to make it much harder for you as terminology is vastly different than in Windows world. However I did some more heavy lifting for you. The link below you can download this tool and image the drive. Data Recovery is not a simple push one button operation its a process and at times can be complicated. That is why its not a simple DIY thing as a lot of people are "for reasons unknown to me" lead to believe.
> DataRescue's DD - DRDD - data-recovery oriented device imaging made easy
> 
> Your are going to have to put some time & effort into this google and reading.


Yeah I actually found that site a couple of minutes ago and was going to ask you about it. I also found a program that mounts a .dd file. Acronis makes clones and has the option of ignoring errors/bad sectors so that might be an option..

A question about DrDD though, in this image








it shows the Range selection in MBs and sectors, how does this apply to me, I want it to do the whole disk, how would I customize those options?

I was thinking of backing up the data using GetDataBack for NTFS, I've read that people have successfully recovered data using that program. What do you think?


----------



## Networks (Mar 20, 2011)

Here ya go. I own GetDataBack runtime.org products but I have not used it to backup or make an image. I can only assume it will work it but I think you have to purchase it either way. I have provided some free alternatives to get an image. I think you have Acronis and I think it will image the drive as well ? I have only used GDB for recovering data and rebuilding raid sets. R-Studio in some cases does a better job I own both as well as many others. Its like a tool chest and I am a mechanic I choose my tool based on what I see at the time I am working on a particular recovery case. When you do this type of work for as long as I have you get a gut feeling for what your working with and go from there. I don't have your drive in front of me but I do know you need to image the drive before attempting to repair the MFT without the MFT file recovery with names and type in tact is major difficult.


----------



## dbboeder (Feb 19, 2008)

OK so here is what I want to do

- Scan the HD with GetDataBack, see what data is there
- Buy a 2TB or 3TB HD
- Clone the damaged HD to a the new one either with Acronis or DrDD
- Attempt to fix the MFT with TestDisk

Question: in DrDD (image in previous post) what does the range selection mean? How does it apply to me since I want a whole image of my HD? How would i change the MBs and sector options?


----------



## Networks (Mar 20, 2011)

I am fairly certain the defaults it comes up with get the entire drive. Did some google searches this will help explain DataRescue's DD 1.0.0.11225 - Free DataRescue's DD Download at Downloadplex.com
You can use the up/down arrows in each box to change values if needed. Why not give the other free utility I gave you a try ? FTK imager from Access Data the imager is free to download and will create a DD image of the data its a very powerful tool for free.


----------



## dbboeder (Feb 19, 2008)

I will, I'm still in shock about what happened! I also need to go get a 2TB or 3TB HD..
One final question: from your experience, is the data in these cases preserved?


----------



## Networks (Mar 20, 2011)

Its really hard to tell without the drive in front of me. I know that running Chkdsk /f, chkdsk /x was not the best course if action initially but most normal computer users don't know that. The operating system can lie to use at times. It depends on the health of the drive itself and what happened to cause the corruption to the MFT in the first place. The files are still there if the drive can be read and you don't have other issues with the drive. Fixing MFT issues is not easy by any means. I assume you are not sending to a pro data recovery firm (which is why your here on this forum) and you are either willing to take the risks involved with "your" data which is why I have offered info to help YOU recover your data.


----------



## dbboeder (Feb 19, 2008)

Networks said:


> Its really hard to tell without the drive in front of me. I know that running Chkdsk /f, chkdsk /x was not the best course if action initially but most normal computer users don't know that. The operating system can lie to use at times. It depends on the health of the drive itself and what happened to cause the corruption to the MFT in the first place. The files are still there if the drive can be read and you don't have other issues with the drive. Fixing MFT issues is not easy by any means. I assume you are not sending to a pro data recovery firm (which is why your here on this forum) and you are either willing to take the risks involved with "your" data which is why I have offered info to help YOU recover your data.


I ran chkdsk 5 times I think, twice it was automatic, I didn't have a choice (couldn't stop in time) and forcing a reboot would cause more damage I figured.

I live in Saudi Arabia, not many data recovery pros around here and even so I certainly cannot trust them with sensitive data..but its still on an option, I might have look in some Arabic forums and see..

Thanks for ur help, will get back to you after I buy another HD


----------



## ruggedindian (Jan 3, 2013)

hey thanks for your help. My mft went corrupt for both my regular drive and my backup drive and testdisk said it was not able to recover the partition. Photorecovery in testdisk was able to recover the files that i was looking for after i searched for the extension. i am hoping that the files aren't corrupt. Easus recovery pro was also helpful but i think it writes its own mft during recovery and somehow changed the extensions to the files since i couldn't find the files when i used that tool. Your discussion helped me a ton. thanks


----------

