How do I know if the MFT is complete in my recovery of NTFS drive?

1

I've been running ddrescue on a failed NTFS drive. I don't remember what's on the drive, but I doubt it's important.

GNU ddrescue was able to recover about 80% of the drive easily, but then is very slow at recovering the rest. It has bad sectors throughout the whole drive in a repeating pattern, so it will take eons to scrape every bit of data off the drive:

ddrescueview showing many errors in repeating pattern

There are bits of good data in the middle of each bad chunk (which are also in a repeating pattern):

one bad chunk with small good parts in the middle

but it is taking days to get through even the first bad chunk, and there are thousands of such chunks.

So I want to just confirm that the files on the drive are unimportant and give up.

I cannot mount the drive image as is. It says

$MFTMirr does not match $MFT (record 0).
Failed to mount '/dev/loop42': Input/output error
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

If I run ntfsfix I am able to mount the drive and see folders and files:

$MFTMirr does not match $MFT (record 0).
FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... 
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 0: Invalid argument
OK
Comparing $MFTMirr to $MFT... FAILED
Correcting differences in $MFTMirr record 0...OK
Correcting differences in $MFTMirr record 1...OK
Correcting differences in $MFTMirr record 2...OK
Correcting differences in $MFTMirr record 3...OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Checking the alternate boot sector... FIXED
NTFS volume version is 3.1.
NTFS partition /dev/loop43 was processed successfully.

So then I can mount it, and everything I can see is unimportant stuff that I have duplicate copies of.

But how do I know if it is listing all the files and folders that were on the drive?

Is there some way to view the $MFT and $MFTMirr and vbindiff them and manually correct any missing bits in one by using the copy in the other? I read that the MFT is scattered throughout the drive. How do I know if it recovered all of the MFT?

hard-drive
data-recovery
ntfs
ddrescue
asked on Super User Feb 3, 2020 by endolith

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0