0

I have an external WD HDD with a unique NTFS partition on it that seems corrupted. I wish to recover the data on that disk and the disk itself if it is not physically damaged.

After a huge file copy on that disk, it started not being recognized by Windows anymore, the drive appears on "my PC" but every action related to the filesystem makes applications like Windows Explorer to freeze or hang. I am unsure why.

  • I tried using chkdsk.exe but it hangs when used on the faulty drive, I do not get any line after a chkdsk.exe D: /f
  • I used testdisk both on Windows and Linux and it detects the partition, I can list the files and extract them but the process is very long. It reports that the MFT and MFTMirr does not match when trying to repair the MFT.
  • With mount on Linux, it says "$mftmirr does not match $mft (record 3)".
  • I tried using ntfsfix on Linux but it also hangs like this.

I feel like the problem is quite easy but as chkdsk.exe does not work, I am not able to solve it.

Any help appreciated.

Jeff Bencteux
  • 148
  • 6

1 Answers1

2

I wish to recover the data on that disk and the disk itself if it is not physically damaged.

How did you determine that?

every action related to the filesystem makes applications like Windows Explorer to freeze or hang. I am unsure why.

This is actually 9 out of 10 times an indication that there is some physical issue, such as surface damage.

It reports that the MFT and MFTMirr does not match when trying to repair the MFT.

The mirror only mirrors first few records of the MFT. TestDisk reporting an inconsistency is therefor only of very limited value. We now know one of the first few records of either the MFT itself, or the mirror is probably corrupt. That's the only thing we can conclude.

This is the entire MFT mirror, four 1KB entries:

enter image description here

I wish to recover the data on that disk and the disk itself

In-place repairs - bad idea.

Seems an unrealistic idea. Any sort of automatic repair tool you tried failed. You think it's something easy but what you think means nothing. If it was something easy it would have been fixed by now.

In general in-situ repair is a bad idea. It would first require us to exactly diagnose the issue. NTFS is complex but not un-doable, but still it leaves plenty of room for error.

Even a tool like TestDisk limits itself to partition table and boot sector repair. That is due these structures being fairly straight forward without leaving much room for inconsistencies, if we can determine the location of the MFT and work out the cluster size, we can reconstruct a boot sector. It's (TestDisk's) MFT repair functionality is nothing more than copy 4 KB worth of data from the mirror to the start of the MFT.

On the other hand, damage to the MFT and repair put the door open for inconsistencies between MFT, Index records and the $Bitmap. If you have never done anything like this, it's a rabbit hole and the chances you do more harm outweigh those of you doing anything good.

I love disk editing and have been doing so for years. But let me assure you, that manual in-place repair of NTFS file system issues is not a viable option.

First determine disk health

You have asserted the drive not having physical issues, you need to establish that first.

Best approach

Since as far as we know this may be a physical issue, it's important you clone or image the drive using a tool like ddrescue. Then use a proper file recovery tool to recover folders and files.