Recover NTFS MFT

ComputerTime · 06-18-2008, 09:03 AM

Hi,

I have raised this question in the WinXP Support Thread, but I think this thread is more appropriate. I will close the other thread.

I have a WD HDD of 200GB. I split it into 3 partitions of 20GB, 100GB and 80GB respectively. The 20GB is mainly for OS, and the other 2 partitions are used for my photos. All of them are in NTFS Format.

Recently, I had decided to reformat my 20GB partition due to a lot of installation and uninstallation of software done on my Win XP system. But I am not able to install WinXP due to 1 of my other hdd (Seagate) giving problem. So I chose to use the Image created by Norton Ghost quite a long time back to restore my C:\ drive. Instead of restoring partition, I restored drive, and end up the whole WD HDD becomes 1 huge partition. I used the Partition magic to restore back my C:\ drive size, and used some freeware (I cannot remember which software, as I have downloaded quite a number of them). I manage to recover the partition, and later on, recover the files in the partition.

However, when I browse through the photos, a number of them are corrupted, as in I cannot open the images or the images are corrupted.

Here are my queries:
1) Is there any software that is able to link back the file in MFT automatically, or I need to manually edit the MFT to link the fragmented files back? If manually edit, is there any freeware to do the editing? What precautions do I need to take?

2) I used the nfi to browse my system, and discovered that MFT contains the following records:
fileXXXX
g:\....\image09-32.tif
it display the 4 attributes of the file, i.e. 10, 20, 30, 30, and not data (80)

fileYYYY
g:\....\m~879.TIF
it contains only the data portion.

Is fileXXXX considered corrupted and file YYYY consider lost file? Is yes, how shall I link back the fileYYYY to fileXXXX?

3) If I am able to edit the MFT, is the amendment immediate? do I need to handle the freespace issues in NTFS?

Thanks in advance.

Regards.

ComputerTime · 06-19-2008, 09:13 AM

Anybody advises?

ComputerTime · 06-24-2008, 09:06 AM

Nobody can help? Or because it will spoilt the market?

ComputerTime · 06-26-2008, 03:58 AM

Any help?

Simo_PC · 11-19-2008, 06:39 AM

Hi Computertime,
I'm in the same situation!!
And with the same questions,
did you find a solution?

Thanks in advance,

Simone

ComputerTime · 11-20-2008, 09:30 AM

Hi Simone,

Unfortunately, I still don't have any solution. Did not have the time, energy and software to try fixing myself.

I did send my hdd to recovering company to try to restore the files, but they said that a lot of information has been overwritten, so unable to recover.

Hope you have some findings, and we can try to work out something.

Regards.

06-18-2008, 09:03 AM	#1 (permalink)
ComputerTime Registered User Join Date: Jun 2008 Posts: 12 OS: XP	Recover NTFS MFT Hi, I have raised this question in the WinXP Support Thread, but I think this thread is more appropriate. I will close the other thread. I have a WD HDD of 200GB. I split it into 3 partitions of 20GB, 100GB and 80GB respectively. The 20GB is mainly for OS, and the other 2 partitions are used for my photos. All of them are in NTFS Format. Recently, I had decided to reformat my 20GB partition due to a lot of installation and uninstallation of software done on my Win XP system. But I am not able to install WinXP due to 1 of my other hdd (Seagate) giving problem. So I chose to use the Image created by Norton Ghost quite a long time back to restore my C:\ drive. Instead of restoring partition, I restored drive, and end up the whole WD HDD becomes 1 huge partition. I used the Partition magic to restore back my C:\ drive size, and used some freeware (I cannot remember which software, as I have downloaded quite a number of them). I manage to recover the partition, and later on, recover the files in the partition. However, when I browse through the photos, a number of them are corrupted, as in I cannot open the images or the images are corrupted. Here are my queries: 1) Is there any software that is able to link back the file in MFT automatically, or I need to manually edit the MFT to link the fragmented files back? If manually edit, is there any freeware to do the editing? What precautions do I need to take? 2) I used the nfi to browse my system, and discovered that MFT contains the following records: fileXXXX g:\....\image09-32.tif it display the 4 attributes of the file, i.e. 10, 20, 30, 30, and not data (80) fileYYYY g:\....\m~879.TIF it contains only the data portion. Is fileXXXX considered corrupted and file YYYY consider lost file? Is yes, how shall I link back the fileYYYY to fileXXXX? 3) If I am able to edit the MFT, is the amendment immediate? do I need to handle the freespace issues in NTFS? Thanks in advance. Regards.

06-19-2008, 09:13 AM	#2 (permalink)
ComputerTime Registered User Join Date: Jun 2008 Posts: 12 OS: XP	Re: Recover NTFS MFT Anybody advises?

06-24-2008, 09:06 AM	#3 (permalink)
ComputerTime Registered User Join Date: Jun 2008 Posts: 12 OS: XP	Re: Recover NTFS MFT Nobody can help? Or because it will spoilt the market?

06-26-2008, 03:58 AM	#4 (permalink)
ComputerTime Registered User Join Date: Jun 2008 Posts: 12 OS: XP	Re: Recover NTFS MFT Any help?

11-19-2008, 06:39 AM	#5 (permalink)
Simo_PC Registered User Join Date: Nov 2008 Posts: 1 OS: xp	Re: Recover NTFS MFT Hi Computertime, I'm in the same situation!! And with the same questions, did you find a solution? Thanks in advance, Simone

11-20-2008, 09:30 AM	#6 (permalink)
ComputerTime Registered User Join Date: Jun 2008 Posts: 12 OS: XP	Re: Recover NTFS MFT Hi Simone, Unfortunately, I still don't have any solution. Did not have the time, energy and software to try fixing myself. I did send my hdd to recovering company to try to restore the files, but they said that a lot of information has been overwritten, so unable to recover. Hope you have some findings, and we can try to work out something. Regards.