Solved

Corrupt Master File Table / Bad Sectors.

Seagate HDD with one partition (NTFS), no O/S only data is returning the error "Corrupt Master File Table". I've CHKDSK /F on the drive, but no progress indicator is displayed even after 13+ hours.

Running Seatools there were 73 Bad Sectors identified and "repaired". I've tried a Linux Live CD but the drive cannot be mounted due to missing MFT. Ghost and Redo backup did not work either.

I tried GetDataBack, but the application scans for less than a second and only displays 7.5GB of approximate 150GB of files the 400GB drive. One odd thing I noticed with this app is if I scan FAT32 it takes 1.5 hours and discovers 80k files, but displays nothing to be recovered.

Right now I'm running HDD Regenerator in hopes to fix bad sectors.

Can anyone suggest a method for recovering the data or MFT so I can at least get a copy?
33 answers Last reply Best Answer
More about corrupt master file table bad sectors
  1. Best answer
    Running CHKDSK in repair mode against a drive with numerous bad sectors was not a wise thing to do.

    HDD Regenerator is potentially a drive killer, especially when the drive has a weak head.

    The best approach is to clone your drive, sector by sector, using a tool (eg ddrescue) that understands how to work around bad media. Then use data recovery software against the clone.

    That said, I would use a disc editor (eg DMDE freeware) to Search for Special Sectors, eg MFT records. There should be an MFT mirror which is a copy of the first part of the MFT.
  2. I followed some instructions in another forum: Used True Image to make a sector-by-sector image, restored that image to a new hard drive, Booted to Windows XP with Hiren's BootCD, from CMD ran "chkdsk /f c:" on the restored copy and still got "Corrupt Master File Table. CHKDSK Aborted". The drive is detected as 0 Bytes.

    Tried to repair the MFT with TestDisk in my prior steps too, but it failed.

    Will DMDE still be able to search for the MFT in this state?
  3. Assuming there is nothing physically wrong with your clone HDD, DMDE will be able to search for MFT segments.

    In fact if you can show us the contents of the NTFS boot sector, this will tell us where the MFT and MFT mirror should be located.
  4. How do I show you the contents of the NTFS boot sector?

    Keep in mind TestDisk was unsuccessful in recovering the MFT and MFT_mirror. The drive is also not accessible in Windows, returning the error "The file of directory is corrupt or unreadable", not sure if that is a result in me mistakenly restoring the image to a EFI GPT partition (RAID) or not, but I'm currently restoring the the image again to an Intel/PC partition (NTFS).
  5. Select Tools -> Search for Special Sector -> NTFS Boot Sector

    You should now see the NTFS boot sector, probably at sector 63 or 2048.

    Select Tools -> Copy Sectors

    In the Source pane ...

    Start Sector = 63 or 2048 or other
    Number of Sectors = 1

    In the Destination pane select File.

    You will offered a filename such as "dev128_lba2048_1.bin".

    Save it.
  6. Edit: Running DMDE off Linux live CD, search is going to take a long time, it's only at 1% after a few mins.
  7. If it takes more than a few seconds, then this means that there is no boot sector at the beginning of the drive. Instead just show us the contents of sector 0. This will tell us where the boot sector should be located.
  8. It stopped at 2% on 45 (LBA 45720456), where can I upload this .bin for you?
  9. That might just be a boot sector template embedded in an EXE file. It's still worth a look, but I'd want to see sector 0 as well.
  10. Okay, I have both files. Doesn't seem to be a way to upload them here. Can I append .txt to them and upload to Imgur?
  11. Normally you would ZIP or RAR them.
  12. fzabkar said:
    Normally you would ZIP or RAR them.


    Both 0 and 45, also a screenshot of partitions. dmde_1.zip
  13. Sector 0 is a Windows 7 or 8 Master Boot Record:
    http://thestarman.pcministry.com/asm/mbr/W7MBR.htm#CHS

    Here is the partition table:

    Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

    000001B0 65 6D 00 00 00 63 7B 9A 7D AC 18 99 65 63 80 20
    000001C0 21 00 07 FE FF FF 00 08 00 00 00 80 93 2E 00 00

    It shows a single NTFS partition (type 0x07) beginning at sector 2048 (= 0x800) and with a capacity of 781418496 (= 0x2E938000) sectors. That corresponds to 400GB.

    0x2E938000 sectors x 512 bytes per sector = 400 086 269 952 bytes

    http://www.google.com/search?q=0x2E938000+x+512+in+decimal

    Normally there would be an NTFS boot sector at sector 2048.

    There would also be a backup NTFS boot sector at the end of the partition, namely sector 781420543 (= 2048 + 781418496 - 1).

    Could we see both of these sectors? Sectors 2049, 781420542 and 781420544 would be nice, too.
  14. As requested, 2048, 2049, 781420542 and 781420544. dmde_2.zip
  15. Here is the BIOS Parameter Block in your NTFS boot sector at sector 2048:

    Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

    00000000 EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 ...NTFS
    00000010 00 00 00 00 00 F8 00 00 3F 00 FF 00 00 08 00 00
    00000020 00 00 00 00 80 00 80 00 FF 7F 93 2E 00 00 00 00
    00000030 00 00 0C 00 00 00 00 00 FF 37 E9 02 00 00 00 00
    00000040 F6 00 00 00 01 00 00 00 56 3E 72 CC 66 72 CC 18
    00000050 00 00 00 00

    It's telling us that ...

    Sector Size = 512 bytes
    Sectors per Cluster = 8
    Starting Cluster Number for the $MFT File = 0x000C0000
    Starting Cluster Number for the $MFTMirror File = 0x02E937FF

    This means that the $MFT should have been at physical sector ...

    2048 + 0x000C0000 x 8 = 6293504

    The $MFTMirror should be at physical sector ...

    2048 + 0x02E937FF x 8 = 390711288

    When you go to those particular sectors, select Mode -> MFT Record.

    To go to a particular sector ...

    Editor -> Goto Offset
    Sector = target sector number
    Sector Offset = 0
    From Start/End radio button
    Decimal radio button

    BTW, this is what an NTFS boot sector looks like:
    http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
  16. Okay, I went to 6293504 sector as instructed, then what?

    $MFT at sector 6293504


    $MFTMirror at sector 390711288
  17. Can you see $MFTMirror at sector 390711288?

    Can you see $MFT at sector 6293504?

    If not, can you show us the contents of these sectors?
  18. fzabkar said:
    Can you see $MFTMirror at sector 390711288?

    Can you see $MFT at sector 6293504?

    If not, can you show us the contents of these sectors?



    I went to both offsets as you instructed. Please see updated screenshots above in here.
  19. Sorry, I'll be a little while.
  20. fzabkar said:
    Sorry, I'll be a little while.


    Odd, the URL worked for me. Did you see the two screenshots now?

    $MFT at sector 6293504


    $MFTMirror at sector 390711288
  21. Sorry, I have content blockers to speed up this web site. Sometimes I don't see the images. However, I do see them now:

    http://i.imgur.com/B86YLr0.png
    http://i.imgur.com/E18A9pK.png

    ISTM that both your $MFT amd $MFTMirror are present, but they are empty.

    Here is my own 20GB NTFS Windows XP volume:
    http://www.users.on.net/~fzabkar/temp/MFT_example.jpg

    I don't see an easy solution for you. Try a raw scan with PhotoRec. PhotoRec tries to locate files via their header information (aka "signature").

    http://www.cgsecurity.org/wiki/PhotoRec
  22. 1. Could I perhaps get better results if I use ddrescue sector-by-sector on the failed drive instead of TrueImage sector-by-sector?

    2. Should I try this same DMDE process on the original failing drive?

    3. Currently running PhotoRec on another image of the drive. It has discovered 6000+ files so far, but going to take a while. Unfortunately PhotoRec doesn't copy over the file names or dir the files are suppose to be in. No way around that huh?

    I know TrueDisk is similar to PhotoRec and will get filenames, but that doesn't run due to the MFT.

    4. Just found out from another forum that I followed Image restore process incorrectly. I used True Image to restore "Image restore (disks or partitions)" and it should have been restored "Sector-by-Sector".

    I'll have to restore that tomorrow and try again?
  23. The MFT (Master File Table) is where the directory structure (file names, folder names) is stored.

    If I start at my MFT sector and page down, then I eventually arrive at my files and folders:

    http://www.users.on.net/~fzabkar/temp/MFT_example_2.jpg

    I suggest you do the same. If you see nothing, then that would suggest that your MFT has been wiped. In this case you might like to try Tools -> Search for Special Sector -> MFT Record. Perhaps there are MFT fragments elsewhere on the drive.

    As for ddrescue, that appears to be the DIY tool that is most recommended for those cases where there are bad sectors. I would give it a go.
  24. What do you recommend as the best command to run ddrescue?

    p.s Also see I edited the post above with #4. My restore process may have been incorrect.
  25. I too can see named folders and files with size. Here is a screenshot. But searching for MFT only revealed entries with no file size.

    PhotoRec recovered 61,000+ files, but of course no file or directory names. I'd really like to try TestDisk (will get names) again on a ddrescue. Would I simply run the following?

    sudo ddrescue -r 3 /dev/sda /media/sdb/image /media/sdb/logfile


    sudo ddrescue -r 3 -C /dev/sda /media/sdb/image /media/sdb/logfile
  26. I think your ddrescue command lines look OK, but only you can see the actual devices on your system, so only you know if "/media/sdb" is correctly specified.

    As for the file names, it does appear that the MFT structure is still there, but the section at the beginning is damaged in some way. Perhaps you could try more data recovery software on the image, eg R-Studio or DMDE (although I haven't personally used either for automatic file recovery).

    BTW, sorry for my late response.
  27. I went ahead and tried the ddrescue option but had no luck recovering the filenames and folder structure. Using DMDE you and I have proven MFT structure is present, we can see all the naming, it's just the $MFT and $MFT_mirror are empty. I need a way to rebuild a MFT from that, or recover the files and retain naming/folders.

    I'll try both R-Studio and DMDE on the image.

    No worries about late reply, I'm very appreciative of your assistance.
  28. Update: DMDE can see the filenames and folder structure!!!! There is a recover option, so I'll play around a bit more and let you know my findings.
  29. The free version of DMDE will only recover one file at a time.
  30. Actually, the free version is limited to recovering only 4000 files. I ended up purchasing the software, it is invaluable! I was able to recover ALL my data, with file names and folder structure.

    Thank you for taking the time to assist me. If it wasn't for you introducing me to the application, I may never have recovered.
  31. GillaGal said:
    Actually, the free version is limited to recovering only 4000 files. I ended up purchasing the software, it is invaluable! I was able to recover ALL my data, with file names and folder structure.

    Thank you for taking the time to assist me. If it wasn't for you introducing me to the application, I may never have recovered.


    I have the exact same problem. Could you please explain exactly what you did in DMDE to get all the files and folder structure please?
  32. mistake sorry
  33. Darn DMDE won't work on Mac formatted disks :(
Ask a new question

Read More

Partition Storage Hard Drives Seagate