Home

When a partition modifying program fails, an NTFS disk may be left in what may be best described as a confused state.  ie it may be possible to find where the MFT file is, but it does not tie with the files.  The reason for this, is a repartition program may move the location of the MFTs, and sometimes move the locations of programs.  If this process fails in the middle, there  may in effect be two groups of MFT entries, pointing to two groups of files. To recover the files, it may be necessary to recreate the partition information for the initial partition settings, and then another set of parameters for the second partition settings, and MFT locations.  The disk is then recovered in two stages

This section gives guidance on to recover such a disk.

The first stage always is to establish where the actual MFTs are located.  For this there are two tools within CnW Recovery to assist.

• The first tool is the Partition analysis routine.  If partitions have valid headers, this function will assist in searching for partition starts, and hence pointers to MFT files, ie the disk directory information.

• If the partitions do not have valid headers, then it will be necessary to set the partition to be NTFS in the partition analysis section, and go to the NTFS Recover menu and use the Analyse disk function. This will search through the disk to find the start of MFTs.

At this point we may have the start sector of the MFT, ie a sector that starts with FILE and part of the way through has the string $ M F T.  This is the value that has to be entered in MFT Start sector.  However, on recovery one may get lots of files, and valid filenames, but not valid files.  This problem is due to the start of the partition being wrong.  To establish the start of the partition can be time consuming, but very satisfying when you get the correct result. The start of the partition is determined in 2 stages.  First run the recovery program and get file names and sizes.  Secondly, run a raw recovery of an area of the disk to obtain many files that have known sizes and extensions.  Typically a jpeg file is very good for this.  Then one can match a jpeg file with a know size between the directory determined location, and the raw recovery location.  A bit of simple maths with the indicate how the value for the start of the partition should be altered.  This sounds complex, but is not actually too bad, it just takes careful thinking.  As the master disk is never changed, and data is recovered onto a different drive, multiple attempts will not corrupt your data any further.

CnW is working on ways to automate this process.