|
kmoorevs wrote: I volunteered to help a friend of the wife's last week with computer problems
Words of Wisdom: Don't ever do that again
If it's not broken, fix it until it is
|
|
|
|
|
Do you fix computers?
Not if I can avoid it!!
*actual conversation last week*
|
|
|
|
|
kmoorevs wrote: I volunteered to help a friend of the wife's last week with computer problems. The workstation belongs to a local church and contains years of business information. The workstation refuses to boot. Plugging the drive in as a slave starts chkdisk which reports that the master file table is corrupt, and aborts. The drive is not accessible through explorer, which reports the same error. I was able to recover all files on the disk using photorec however, it meant losing filenames and directory information. I am about to dig out the old XP CD's and try a repair. Has anybody had any luck fixing a corrupted master file table? Google results on this one look pretty grim. The sad thing is, this is a pro-bono job, and I already have a few hours in it. (not counting the 16 hours it took to recover the files to another disk) Here goes nothing....
Download Parted Magic[^] (will cost you USD$4.99) and burn it to a USB with YUMI[^].
Then boot from the USB and run through this tutorial[^].
If the repair of the MFT doesn't work you can at least copy off the files with folder structure from within the TestDisk command line.
Michael Martin
Australia
"I controlled my laughter and simple said "No,I am very busy,so I can't write any code for you". The moment they heard this all the smiling face turned into a sad looking face and one of them farted. So I had to leave the place as soon as possible."
- Mr.Prakash One Fine Saturday. 24/04/2004
|
|
|
|
|
If part of MFT is corrupted, you should be able to read something. This message is probably due to corruption in MBR where is the data to find and validate MFT. If system is FAT, there is probably a chance to look at the table manually and see if anything survived (the records of FAT are fixed size - easy to read). If it is NTFS, you should try some tools, but if it didn't work - sorry.
|
|
|
|
|
I'd have to make one more suggestion on this particular activity, should you ever have to do it again. Do yourself a favor and image this drive using FTK Imager (free from AccessData) or dd on a Linux live disk before formatting the drive. You could also use a forensics toolset, such as Autopsy (from the sleuthkit) to possibly examine the drive and determine why the $MFT file is corrupted. As another person posted, one of the records pertaining to the $MFT itself has been corrupted and could be recovered from $MFTMirr.
To do a more thorough data recovery, you could have used a Linux live distribution (either against the live disk or the image had you made one) and installed foremost. Foremost is more configurable as you can edit its config file and add in file headers that you would like to search for (PK for office documents and zip files, JFIF for jpg images, etc.). You can Google for file header magic numbers and find a pretty extensive list.
Just some more food for though on the subject matter at hand. A great book explaining the NTFS file system and $MFT is Brian Carrier's File System Forensic Analysis.
|
|
|
|
|
Thanks Vachaun22! (and all others who replied) Great advice and well thought out response. I shall file it away for future reference, as it was a little late for this job. In this case, I had recovered all the files on the disk, albeit without the filenames and directory structure, which is more than the A+ dude at the computer repair shop could do for them. At least I can give them back a working computer (fresh XP Home install) and a couple of sets of DVDs with the data files. They can sort out what's important.
<rant>
I am trying to create a filtered data set by searching on known file extensions and copy/pasting into folders but keep running into an error 'Cannot copy file: Cannot read from the source file or disk'. This is on XP and it happens when I try to copy all files found in the search. It seems to be one file out of hundreds that causes the error, but it doesn't tell me which one, and nothing gets copied!
"Go forth into the source" - Neal Morse
|
|
|
|
|
Divide and conquer the listing of files to copy.
Rather than try to do them all at one fell swoop, grab only a portion of the files at a time. Then when you get a group of files that won't copy due to the disk read error, then work at that group of files one at a time (or break the group up to a smaller group), rinse and repeat. At some point you will narrow it down to the file(s) that are causing you a problem.
If the disk is failing, you may get read errors. You could try dd-rescue at that point (google for samples of the command) to image the disk to a known good disk. dd-rescue will time out before the hard drive read times out, so it can continue by skipping the block and marking it. Once the forward image is completed, it revisits the blocks that it could read, and reverse reads those blocks sector by sector. Many times it can recover 7 of the 8 sectors in a 4K block. Granted, the file is still corrupt, but you may have recovered enough of the file for parts of it to be useable.
|
|
|
|
|
Last time I had a BSOD from a corrupt NTFS filesystem, I used a Knoppix disk to fix it.
Windows would blue screen when it tried to boot from the disk and if I put it in another system.
I dug out a Knoppix DVD, booted from that & used the 'ntfsfix' tools to repair the filesystem.
Booted the drive from Windows again, let it complete its own chkdsk & all then ran without trouble.
If you're worried about corruption, you could always backup the drive from within Linux (assuming you have somewhere else to put it all).
The Pedant.
|
|
|
|
|
This product has helped me in the past.
R-Studio
http://www.data-recovery-software.net/[^]
I have used it to even recover files on a Raid 5 volume, I don't know what their cost is now, but if you need the files, chances are they can recover it.
Good luck.
|
|
|
|
|
If the MFT is corrupted it means you can't access any of the files in there by default, as the MFT holds pointers to where the files are on the disk.
You need some file recovery software, if you need to recover some important data. I had good track with GetDataBackNTFS. which goes on the disk cluster by cluster and tries to make sense where files start and end.
Since the computer is old, there is a high chance that the region is affected by a bad sector, and given the nature of rotating media, there is a higher chance that the bad region will grow in size. If you have the standard single c:\ partition, then I would strongly recommend running a bad block finder on the disk and if it can't read from the sector (even though the data is corrupted) replacing the disk with a new one, since that means you have damage to the beginning of the disk. This damage will probably grow in size with age and will affect other important bits, such as the master boot record (making partitions unreadable) or the track that has the disk firmware, and geometry. ( making the whole disk unmountable)
|
|
|
|
|
The disk has a brand new OS, actually better than the original, without the dell crapware. I still need to get the 3K images (mostly bs, but I'm certainly not about to look at each one to figure it out) all together in a new folder and copy/paste is failing since one or more in the group are caueing read errors. Think I'll put together a little VBScript to do the job! ahem...sounds like an appropriate place for on error resume next! 
"Go forth into the source" - Neal Morse
|
|
|
|
|
That will be cumbersome after the fact.
Notes to self.
- Recover first, reinstall later, since reinstall will usually overwrite the actual data on the platter. Whereas quick format/delete just erases the index in the table, leaving the actual data intact, until new space is needed for new physical write.
- New windows does not mean healthy drive, it just means new operating system on potentially old broken drive.
- Conventional tools usually give up on the first problem/error. Unconventional tools ( data recovery tools) will often employ aggressive rereads/ and/or reads in reverse, use available checksums or known patterns, skip missing/broken sections to try to resurrect as much of the data on a damaged disk as they can.
|
|
|
|
|
So finally finished the latest CCTV install.
Went to the site, logged in to the router.
Port forwarded the Web Access/TCP and UDP sockets and left.
Came home, loaded up the web viewer and hey presto.
Too easy!
Normally there are problems of some description, but not this time.
Feel guilty taking so much money from him for the technical install.
However, and as Michelle pointed out, I now have access to over 100 cameras on many sites, including pubs and shops.
She reckons that I have all the makings of a psycho-killer!
Not so, but I do need to monitor the systems.
And to see who does what, at all times, everywhere.
---------------------------------
Obscurum per obscurius.
Ad astra per alas porci.
Quidquid latine dictum sit, altum videtur .
|
|
|
|
|
You will be changing your name to Zeke Hawkins[^] before long..... 
(had to look the name up, my memory isn't that good!)
modified 23-Jun-14 17:24pm.
|
|
|
|
|
Dalek Dave wrote: all the makings of a psycho-killer
qu'est-ce que c'est?
PooperPig - Coming Soon
|
|
|
|
|
Fa-fa-fa-fa-faaaa fa-fa-fa-fa-faaaaaaaaaaaaaaaaaaaaa...
|
|
|
|
|
Better run run run run run run run run awaaaaaaaaaaaaaay
PooperPig - Coming Soon
|
|
|
|
|
Getting a little too close to the screen name don't you think?
|
|
|
|
|
i'm in the market for a copy of Win7 x64, so i googled... and this turned up:
techsupplyking[^]
it's the cheapest i've seen, by far. but it's a download.
does anyone know if that is legit or not?
i've purchased lots of big-name software for download, but this is the first time i've seen anyone selling Windows that way.
(no, this isn't spam. i want to know if you can legally DL Windows)
|
|
|
|
|
Did you Google? It brings up this complaint[^], which has some valid points indicating it may be a scam. Additionally, the site says 'Microsoft Certified Partner', but this post[^] indicates that program no longer exists, and everyone was required to take that branding down in 2011.
But then, when all was said and done, this Microsoft page[^] indicates they really are certified. So it is confusing, but seems to be legit after all???
Good luck!, and if you do buy, post back your experience.
|
|
|
|
|
What about Microsoft store?
Mm... they don't sell 7! 
But they do sell Win8 at reasonable price! 
|
|
|
|
|
Might be, not sure. They are a Microsoft Certified Partner as they claim to be: http://pinpoint.microsoft.com/en-US/partners/Tech-Supply-King-4299278462[^], although that is the lowest level of partnership with Microsoft. It would be quite easy for just about any company to obtain it, but at least it shows the company is a real company and not just someone pretending to be a real company. Still for a few hundred dollars and a credit card, just about anyone can set up a business and basic website within a few hours. It does seem odd though that they use billing-secure-server.com for their shopping cart instead of using their main site.
|
|
|
|
|
Bugger me...Chris is still alive
Bryce
MCAD
---
|
|
|
|
|
|
Just get it from NewEgg. They sell all of the various flavors of Win7.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
