Hard disks, solid state drives

HDD, SSDForum → How to overwrite MFT?

How to overwrite MFT?

Pages: 1
14.07.2007 15:49:00
Hello

terrible happened - messed up my system controller on hard courts. Because of this, I formed a pile bedsektorov program in the field of MFT (NTFS volume). Because of that, he was seen as a RAW volume in Windows and how to 32Gb FAT Volume + 80Gb Unallocated Space to R-Studio. Bede removed, all the data I pulled him, plus managed to get a second (undamaged) a copy of the MFT. Of course, the easiest in this situation - to reinstall the OS, but I for some reason is important the user's SID, so I would like to restore the file system and boot into the OS that was.

question: how, having recovered up $ MFT and $ the Extend, return them to the place of the first (damaged) a copy of the MFT?
ChkDsk of XP and Vista do not want, t. To., Refuse to recognize the fact.

OS: WinXP SP2 VLK RUS
HDD: Samsung SP1203N
If need be other items, will tell. Thanks in advance

P. S.: The question, I think, more about the operating system than about the iron, so I ask here. . .
14.07.2007 17:34:00

Thank you for an interesting topic.

managed to get a second (undamaged) a copy of the MFT
Could you clarify how exactly received a copy of the MFT?
You copy the main file system records, MFT or completely?
(By the way, $ Extend -. It is not a separate entry, as part of MFT)

Experimental setup
you need a disk editor. Because most free fichny, as far as I know, DMDE, of the paid - WinHex (the cure for greed is on open spaces Ineta).
experiments can be carried out in this case only on the cloning copies. It can be made in WinHex, or, for example, a demo version of R-Studio.

Gentlemen, start your engines!
work in this case it is easier with the logical drive.
initial cluster MFT and MFT by Mirror is in the partition's boot sector. Ibid - cluster size (sectors per cluster). To go from the cluster number to the sector number in NTFS, the cluster is sufficient to multiply the number by the number of sectors per cluster. Thus, you have enough data to identify the sector in which start MFT and MFT Mirror. Please note that the main MFT complete, but a copy (by Mirror) contains only some (initial) system records ($ MFT, $ MFTMirr, $ BadClus, $ Boot and so on. D.). If you have a working copy of the full MFT, it needs to be recorded fully only instead of the main MFT, but instead of a mirror - only system files. Actually MFT record of the file you can in WinHex, and in DMDE.
15.07.2007 19:15:00
Micha in ntfs no MFT mirror. . . MFTMirr contains a copy of the first four records, and everything else - tyutyu. . . You can try to fill the "hole" empty structures, but the right tools - alas, no. . . Is that sdampit, correct, and then pour in place. . .
15.07.2007 23:35:00

Could you clarify how exactly received a copy of the MFT?
GetDataBack for NTFS + some internal software that is used in the production process in our company. . .
R-Studio was powerless

You copy the main file system records, MFT or completely?
I believe that the second, ie. A., All critical information was raised without difficulty and correctly.

Actually MFT record of the file you can in WinHex, and in DMDE.
process, meaning I understand and I will try to do so. But if there is software to automate this process? Just a very busy schedule. . .
advance, very grateful


---
M-1024
16.07.2007 10:30:00

R-Studio was powerless
not do sector-based copy? More?

I believe that the second
What file size?

whether the software to automate the process
I did not come across such a program. You can try the free TestDisk.
In general, there is nothing in the long manual rewrite. For example
free DMDE:
1. Start the program, select "Logical", select the appropriate logical disk (partition), then click OK.
2. Press Enter. You will mount NTFS partition window. Press OK.
3. In the GoTo menu, FAT / MFT. DMDE go in the first sector, belonging to the MFT. It is better to press the F2 - Hex view.
4. Press Ctrl + E - move to the editing mode.
5. In the Tools menu select the Write file to sectors. Enter the MFT file name (the file must be located in the directory DMDE). Press OK. In the starting sector for the recording and the number of sectors will be shown the next window. These values ​​do not need to change, just Object picture click OK again. Now the file should overwrite the old MFT.

MFT Mirror - similarly (GoTo = & gt; FAT Copy / MFT Mirror), but in the dialogue, which is defined by the starting sector, and number of CETOP (Sec. 5), enter the number of sectors equal to 8 (if it is the default file size of the record - 2 sectors).

Doing this (TestDisk, DMDE) need on cloning copies , if you really want to restore the file system.
16.07.2007 10:53:00
:
And if MFT was fragmented?
16.07.2007 13:15:00

And if MFT was fragmented?
Then, if the MFT has been "re-constructed", then nothing happens (partially erased files). And if the original location MFT is stored (including the contents of the "holes"), IMHO fragmentation does not spoil.
16.07.2007 14:04:00
:
So DMDE fact take the file and put its continuous piece after a given sector?
16.07.2007 15:29:00

So DMDE fact take the file and put its continuous piece after a given sector?
Yes. Therefore, if the original MFT was fragmented, and the new - built without fragments, in one piece, it will be Kaka , ie to the MFT fall over a minimum of one "hole", which could be located the contents of files... If new MFT - it's just amended by the source, preserving the "holes" in the initial state, then everything will be fine.

And it is true that GetDataBack rebuilds MFT? I was there such an option is not found.
16.07.2007 17:16:00
:
What do you mean "with holes preservation"?
Logged-it will be continuous, and then will be read according to the Run-list in the first record. . .
16.07.2007 17:42:00

What do you mean "with holes preservation"?
So full dump of the area occupied by the MFT, from the first to the last sector. Including the intervals between the fragments.

then be read according to the Run-list in the first record
Yes, of course.

Logged-it will continuously
In this case, my user guide "does not roll" (for a fragmented MFT). Then you need to parse the MFT ranlist and paste on selected fragments.
18.07.2007 2:42:00
Listen as if all the data from the disc correctly copied what's the problem? Formatted disk and then just throw off on it all and all you will. . .
18.07.2007 8:45:00

I understand that he needs OSes work with this disk.
18.07.2007 10:31:00
:
So OSes will work if all the fill as it was to mark the boot partition.
18.07.2007 14:09:00

Yes, indeed. . . Then the question to the author, why him these troubles with MFT.
Pages: 1
HDD, SSDForum → How to overwrite MFT?

How to overwrite MFT?