PDA

View Full Version : Corrupted MFT file


robheys
2nd January 2009, 07:11
Hi
I have two external USB drives that i use on my laptop. For some reason it looks like the MFT file for one has been overwritten onto the other, so they both show up as the same drive name with the same content, except that one is actually a completely different drive with a whole bunch of other stuff on.
Can ZAR help me recover this?

thanks

rob

Alexey V. Gubin
2nd January 2009, 10:47
First of all, test the drives on a different computer.

Then, you have to try with the evaluation version of ZAR.

Based on your description, the MFT was written onto the wrong drive, but it is not possible to tell how much of the original was overwritten in process. If two MFTs are in a different physical locations on the drives, then there are two "versions" of MFT currently on the drive, - this is difficult but most likely recoverable. If they were in the same location, then the original is fully overwritten and thus lost. This has to be determined by trying an actual recovery.

robheys
2nd January 2009, 14:33
I have ried the drive in another computer and get the same result. A check disk on one of them corrected the MFT issue. On the other that actually has all the data on it i really want it made no difference.

I ran TesDisk to try and correct the MFT file on the remaining broken disk, it did not work, but it did tell me that the MFT file and it's mirror were fine, but different

Alexey V. Gubin
2nd January 2009, 14:53
Avoid making corrections to the disks.

For a drive that does not have a physical problem (or even a "bad sector" defect), the correct order would be like that


Plug the drive into different machine to see if a problem goes away. However, if system prompts you to chkdsk and fix a problem at this point, answer "no".
Try read-only recovery tools, like ZAR. Make multiple passes, with different programs, if required.
If still no result, make an image of the disk, so you can return to the initial state. After this, try chkdsk or whatever other in-place repair tool you want.
(Repeat, important: The above is only good if there is no physical problem with a drive).

Always try to make recovery attempts in the order outlined above. This sequence is slowest but produces best possible recovery outcome. Most of this can be accomplished or at least tested with evaluation versions of whatever software involved.

For now, I still suggest you try ZAR trial to see if it can bring something.