Advanced NTFS Boot and MFT Repair
From CGSecurity
english version
deutsche Version
versión español
version française
Contents |
Repair NTFS Boot Sector
If the NTFS boot sector is damaged, data can not be accessed.
Windows will prompt The drive is not formatted, do you want to format it now?
Linux mount will display wrong fs type, bad option, bad superblock
TestDisk let you manipulate and fix the boot sector of NTFS partitions. Select the partition you want to modify and choose Boot.
Recovering NTFS Boot Sector on NTFS Partitions using its backup
TestDisk can use backup boot sector to fix corrupted NTFS boot sector. The primary boot sector is sector zero of the filesystem, the backup NTFS boot sector is located near the end of the filesystem, so even if the boot sector is accidentally overwritten, the backup should be intact. TestDisk checks the boot sector and the backup boot sector. If the boot sector and backup boot sector mismatches, you can
- restore the NTFS boot sector from its backup (Backup BS) or
- update the backup NTFS boot sector with the current boot sector (Org. BS).
Dump can used to display the boot sector content in both hexadecimal and ascii. If there is no valid boot sector available, TestDisk can still rebuild a new NTFS boot sector.
Rebuilding NTFS Boot Sector on NTFS Partitions
If both NTFS boot sector are corrupted, you need to rebuild NTFS boot sector, TestDisk searches the MFT (Master File Table: $MFT) and its backup ($MFTMirr). It reads the mft record size and it computes the cluster size, It reads the Size of Index Allocation Entry in the root directory index. Using all these values, TestDisk can provide a new boot sector. Finaly it lets the user list the files before writing.
Repair NTFS MFT
The MFT (Master File Table) is sometimes corrupted. If Microsoft Check Disk (chkdsk) failed to repair the MFT, run TestDisk and in the Advanced menu, select your NTFS partition and choose Repair MFT. TestDisk will compare the MFT and MFT mirror, its backup. If the MFT is damaged, it will try to repair the MFT using its backup. If the MFT backup is damaged, it will use this main MFT.
If both MFT and MFTMirr are damaged and thus can not be repaired using TestDisk, you might want to try commercial software as Zero Assumption Recovery , GetDataBack for NTFS or Restorer 2000.
Back to Running the TestDisk Program