PDA

View Full Version : $MFT recovered


joset
27th February 2009, 06:48
I am currently trying to recover some files from a disk that failed during a 42GB single file copy. Machine hung in the middle, then failed to boot. The MBR and partition table are damaged. I have run zar with various options and the lates run yielded multiple files in the fragments directory called $mft*. Two of these files look like actual $mft files and are approximately 306MB in size. Can I tell zar to use these in addition to the data found on disk? If not can I image the disk and add these onto it? If imaging is required what image tool do you recommend? There are also $mftmirr* and $logfile* files in the same folder, can these help? thanks for your assistance.

Alexey V. Gubin
27th February 2009, 13:33
ZAR itself can create an image of the disk,

Right click the disk in the physical disks list,
Pick "Create image file".
The file must be stored on NTFS volume.You can then append your MFT data to it. Check that both image file size and the MFT file size are the integral multiple of 512. Then, just append the MFT file to the end of the disk image.

You may also have a look at this -
http://www.z-a-recovery.com/data-recovery-forum/showthread.php?t=679