MFT corruption + Lost data

[giz]

Lost data and MFT corruption.
I have a raid file system that started receiving MFT corruption errors so we migrated “all” the data off to a physically new storage system. Subsequently the “legasy” system is no longer accessible. Windows no longer sees it as NTFS. It is unallocated. We verified that at the time of migration all files were migrated, however it now seems there may already have been a ton of data lost possibly upto a third of my data (2+ TB’s).
My assumption is that if that now lost data was due to corruption of the MFT file the file loss should have been random? I am seeing data lost in very definable sets. Ie I have video files that are created with 3 index files. All files would have been created together and only their extension would have been different.
For example:
12345678.wmv
12345678.ix1
12345678.ix2
12345678.ix3
On top of that each wmv file is part of a set that would have been made at roughly the same time (within an hour)but typically appended as such..12345678_v1 etc.. It is important to note that there would have been other data created during this same time frame that was not lost. Where I lost data, I lost the whole set. Up to 20+ files. I never lost just some of a set and that seems like too much of a pattern to be random corruption.
Could anyone rationalize how such a pattern could be part of an MFT corruption or is there something else, possibly an external process at play here.
Thanks in advance.

 

[Ignatowski]

Lost data and MFT corruption.
I have a raid file system that started receiving MFT corruption errors so we migrated “all” the data off to a physically new storage system. Subsequently the “legasy” system is no longer accessible. Windows no longer sees it as NTFS. It is unallocated. We verified that at the time of migration all files were migrated, however it now seems there may already have been a ton of data lost possibly upto a third of my data (2+ TB’s).
My assumption is that if that now lost data was due to corruption of the MFT file the file loss should have been random? I am seeing data lost in very definable sets. Ie I have video files that are created with 3 index files. All files would have been created together and only their extension would have been different.
For example:
12345678.wmv
12345678.ix1
12345678.ix2
12345678.ix3
On top of that each wmv file is part of a set that would have been made at roughly the same time (within an hour)but typically appended as such..12345678_v1 etc.. It is important to note that there would have been other data created during this same time frame that was not lost. Where I lost data, I lost the whole set. Up to 20+ files. I never lost just some of a set and that seems like too much of a pattern to be random corruption.
Could anyone rationalize how such a pattern could be part of an MFT corruption or is there something else, possibly an external process at play here.
Thanks in advance.

hmmm.
ok so when you migrated the data it started writing the mft as files were being moved. most file copy routines work by going down the file list alphabetically rather than reading the next entry in the mft. when it gets dumped on the new disks the mft is added to sequential so all the files in your set were added to the mft as a block.

so files in x:\folder1 would all be written during the migration before files in x:\folder2 as such if the mft was corrupt for x:\folder1 files underneath that would be lost but files in x:\folder2 would exists even if the original create times for the files was identical.

at least thats my theory.