The question:

Does anyone know how I can repair the MFT on an external USB drive without destroying the data and thus be able to reaccess the data despite a corrupted MFT, that is, essentially reinstate or rebuild the MFT?

Overview:

I have an external harddrive - 200Gb Maxtor Diamond Max 10 connected via a USB cable
I know that it should have one partition only and that partition should be formatted as NTFS - this partition is available at /dev/sdc1
I have used dd_rescue and essentially mirrored the drive to a separate location without any errors, so I have a backup!
I can use photorec to pull out various files despite the corrupted MFT but I only want to do this if recovering the drive in its original state is unachievable

Things I have checked:

I have replaced the USB cable in the event that a faulty cable was causing issues - problem still exists
I have replaced the external harddrive casing in the event that a faulty casing was causing the problem - problem still extists

Diagnostic Outputs:

* When connecting to a windows machine it advises that file system is corrupt and that chkdsk /f should run. On running chkdsk /f I am advised tha errors were found with the MFT and that windows will attempt to repair this... after much time windows advises that it cannot repair the MFT and chkdsk has been aborted
* When connecting to my Linux box (Ubuntu 8.04) it advises that it "cannot mount volume" and provides the following details: "$MFT has invalid magic. Failed to load $MFT: input/output error Failed to mount 'dev/sdc1': Input/output error NTFS is either inconsistent, or you have hardware faults, or you have a SoftRAID/FakeRAID hardware. In the first case run......."
* I can confirm that drive is available at /dev/sdc
* Running fdisk /dev/sdc and requesting to see the partition information produces the following (as I would expect):

Disk /dev/sdc: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x9503c6ab

Device Boot Start End Blocks Id System
/dev/sdc1 1 24792 199141708+ 7 HPFS/NTFS

* Running testdisk and analysing /dev/sdc1 produces the following(something seems wrong here to me though I would struggle to explain what!):

TestDisk 6.8, Data Recovery Utility, August 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 203 GB / 189 GiB - CHS 24792 255 63

Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 24791 254 63 398283417

* If I use testdisk and go into the advanced menu I get the following output:

TestDisk 6.8, Data Recovery Utility, August 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 203 GB / 189 GiB - CHS 24792 255 63
Partition Start End Size in sectors
1 P HPFS - NTFS 0 1 1 24791 254 63 398283417

Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

[ Quit ] [ List ] [Rebuild BS][Repair MFT][ Dump ]
Check MFT

* If I use testdisk and select the advanced option and request that it list files then a Segmentation fault is immediatley produced and testdisk terminates
* If I use testdisk and select the advanced option and request that it Reair MFT then a Segmentation fault is immediatley produced and testdisk terminates

Conclusion

So I am fairly sure the MFT is completely corrupted and as far as I can establish not repairable, but the question is can the MFT be rebuilt?

If anyone can help I would be very appreciative.

Thanks
Jamie.

Hi,

Everything is possible, it's just a matter of time and willingness.

Yes, we will add recovery support for NTFS-3G. However I'm sorry to say that it's not the highest priority at the moment.

Until then you could try some other recovery software. Good luck!

Regards, Szaka

Thanks for the reply Szaki...

I have now used photorec to pull out the data/files that I can!

Otherwise I will look forward to recovery support for NTFS-3G and might keep the disk image stored until it becomes available and hopefully at that time I will be able to restore the data fully.

Thanks again.
Jamie

Sorry... I meant Szaka, not Szaki!!!!!

Don't worry, in my country, Hungary, people also call me Szaki! ;-) Though it was a bit strange that your name isn't Hungarian :-)

I'm glad you could recovery files with photorec. We will try our best to do better with NTFS-3G ;-)

Cheers, Szaka