Thread: Computer Help - MFT corrupted, data recovery how?

Hoping the collective can help me out here -

I have an external hard drive that I was writing something to the other day, and windows froze. I had to unplug everything and turn it back on, and upon doing so the external hard drive had an error about "file system corrupted". Now when I plug it in, the computer knows something is in the usb port but doesn't recognize it as a hard drive.

From a bit of research, it sounds like my MFT is corrupted. The drive still spins so I'm hoping I can get everything back. Anyone recommend any tools to do this, preferably freeware but will pay if it's better?

Also, I read somewhere there's usually a backup to the MFT, but how do I access/restore this?

you could try physically putting it into the computer, boot to windows system restore and get to the command prompt. run the command "chkdsk /r". It takes a long time to finish.
It does not delete files.

Thanks for the input, i only have a laptop though and the external is a 3.5" drive...and i'd probably break more trying to rig that.

edit: is there any way to run checkdisk on it now, as an external drive that's not recognized as such?

Searching would result in a number of threads about data recovery on here. There are software packages - some free some of the better ones you have to pay for the license to use that will scan the drive and attempt to recover the data- if the drive is still recognized by the PC.

Are you sure of your diagnostics being the MFT corrupted? NTFS makes a copy of this and duplicate for situations where the main one is corrupted.

Recuva, PC File Inspector Recovery for data recovery are both free downloads. GetDataBack for NTFS is a good package that you can get the trial and then purchase if it reports recovery success with the trial download.

I'd start with basic hard drive diagnostics - Drive Fitness Test (Hitachi) or Seatools (Seagate) for testing the drive and see what the report shows. But they require the drive to be placed inside a desktop and directly to the mainboard to run their tests. You can't do that with a laptop - must have another system to stick the drive into. Also it could be the controller on the external enclosure- could be worth a shot at trying another enclosure if available to stick the drive into it.

If you can get to the point where you can scan the drive and the files are gone file recovery software is obviously what anybody would tell you that you should use. I once had to rent equipment to make measurements at work that cost $5K/week (not to mention 40+ hours labor) and when I tried to transfer the data alot of it got lost (lesson learned -- don't cut and past). I tried the freeware but it didn't work. Went to Bestbuy or some other place and paid $30 and got all the files back and saved my ass. If you can get access to your drive how much are your files worth? You get what you pay for sometimes.

Edit: As Rshea mentioned, put the drive in a desktop. New enclosure is not a bad idea but I seem to have bad luck with those but they are cheap so it's worth a try to get all your photos back, etc.

This is why I started backing everything up to two external hard drives in case one craps out. They are pretty cheap these days so not a bad idea in the future.

Found this software called Recuva from the people who make CCleaner. Interesting and free!
http://www.piriform.com/recuva

you can run the command chkdsk [drive:] from command prompt on any drive not booted from. (it must be able to be locked, or unmounted, I forget what the term was, that goes all the way back to last semester, lol). Remember /? gives you all the params you can run with.

Originally Posted by stuckathuntermtn

Found this software called Recuva from the people who make CCleaner. Interesting and free!
http://www.piriform.com/recuva

you can run the command chkdsk [drive:] from command prompt on any drive not booted from. (it must be able to be locked, or unmounted, I forget what the term was, that goes all the way back to last semester, lol). Remember /? gives you all the params you can run with.

Recuva, PC File Inspector Recovery for data recovery are both free downloads.

was in my earlier posting on the subject above. As for the chkdsk you can do it a couple of different ways- command prompt without the /f or /r (read only mode if it is the boot drive), no requirement for non boot partition so go ahead and do the /f /r parameters (but the USB drive has to be detected in the OS- and not sure that is happening). Easier method is to right mouse click on the drive letter and go to My Computer and select the drive letter - then properties and select the Tools- there is the Error Checking and you can select it. If it reports that the drive is in use and locked it will ask if you want it to run on next reboot...

Hey C.O. Jones, any idea if the drive inside the enclosure is a Seagate Barracuda Drive? If it is then it could have been a Series 11 that are bricking and failing pretty regularly. Seagate knows about the problem but has not done a recall. If it is a Seagate Series 11 then the drive is not detected by the OS and you have to re flash the firmware to get the data back. These can be 500 gig, 750 gig, 1 TB and or 1.5 TB capacities.

http://www.tomshardware.com/news/sea...ling,6844.html

Thanks for the input. I actually found a few good tools, haven't run them all yet as I'm waiting for an extra hdd to show up to pull all the stuff on to.

I actually had two problems, first, that the drive wasn't showing as recognized. Fixed that by unplugging everything, taking out the battery so the motherboard couldn't draw any power and therefore reset the usb device history. This made the drive show, but it shows 100% free space. I guess this is a symptom of corrupted MFT also. The drive passes all tests and there's nothing mechanically wrong with it.

So I'm trying to figure out how to use test disk to repair the MFT. Supposedly it can do this without touching any data, which would be ideal.

If I can't get that to work, recuva is next on the list, after my replacement hd shows up.

For anyone in the future searching, lifehacker has a pretty good article on different tools.

Oh, and checkdisk doesn't do anything, literally - I start it, the box pops up, then it goes away with no processes happening. Who knows...works for my other drives, but i don't think it's going to do anything with this one.

Thanks RShea, it's a WD (luckily, I thought, until now). I did just order two seagate 1tb externals as future backups though

Originally Posted by RShea

was in my earlier posting on the subject above. As for the chkdsk you can do it a couple of different ways- command prompt without the /f or /r (read only mode if it is the boot drive), no requirement for non boot partition so go ahead and do the /f /r parameters (but the USB drive has to be detected in the OS- and not sure that is happening). Easier method is to right mouse click on the drive letter and go to My Computer and select the drive letter - then properties and select the Tools- there is the Error Checking and you can select it. If it reports that the drive is in use and locked it will ask if you want it to run on next reboot...

Will you be my new daddy?

Originally Posted by stuckathuntermtn

Will you be my new daddy?

NO...!!!

Originally Posted by C.O. Jones

Thanks RShea, it's a WD (luckily, I thought, until now). I did just order two seagate 1tb externals as future backups though

Just check the drives when they arrive- they probably are their newer Series 12, but if they are not then do the firmware update before the Seagate drives brick on you.

If it is the MFT issue (now that you have confirmed that it is recognized then you could try this thread:

http://www.cgsecurity.org/wiki/Advan...and_MFT_Repair