0

I have a 6 TB external NTFS drive which suddenly appears unformatted.

I imagine that the Master File Table got messed up. Is there any gratis tool which will repair it in-place? Windows or Linux

8
  • 2
    Are you talking about FAT or NTFS? There is no such thing as a FAT in a NTFS filesystem. NTFS has the MFT which has a different structure. Also, can you define "in place"? There is no tool besides chkdsk that will " repair" NTFS, of course only if the damages are minimal. Not to mention the fact that trying to fix a file system rather than extracting the data is a terrible idea if you care about the files. Sep 26 '16 at 9:56
  • I meant an NTFS file system, with whichever tables tell the o/s where to find each directory & file; I believe that is corrupt. By "in place" I mean that I don't have an external drive to recover files to - I believe that the files are still there, and just need to be pointed to again. Can I run chekdsk on a device? There is no drive letter any more. As to your last sentence - I agree, but can't afford a 2nd 6tB drive :-( Sep 26 '16 at 10:25
  • 1
    If this is the case, you should start by recovering the most important parts e.g. on a 1 TB drive. Having said so, are you really sure that the MFT is broken and it's not just a partition table problem? What is the output of sudo fdisk -l when the drive is connected? Sep 26 '16 at 12:00
  • Alas, it is all the most important parts. Yes, it may just be a partition table problem. I am running Windows (hence NTFS), but can install a Linux VM and fdisk from there Sep 26 '16 at 14:04
  • 1
    PS: if 6 TB of data are considered "the most important parts" I would humbly but firmly suggest to always have backups. Sep 26 '16 at 18:02
1

System Rescue CD is a live ISO that you can burn onto a CD or a USB drive and then attempt repair of your drive.

It is free, gratis & consists of Open Source tools. The kernel supports all important file systems (ext2/ext3/ext4, reiserfs, btrfs, xfs, jfs, vfat, ntfs), as well as network filesystems (samba and nfs)

1
  • The Linux tools (in this case ntfsfix) won't help if the MFT is actually damaged. Sep 26 '16 at 11:59
1

When I had a similar issue last time, someone recommended TestDisk which helped. I wanted to close as a duplicate, but probably it was on a different site, so I give it as an answer.

TestDisk

  • runs on Windows
  • is free and open source
  • can fix partition table, recover deleted partition
  • can recover NTFS boot sector from its backup
  • can fix MFT using MFT mirror

The usability is not ideal for Windows users, but if you have some knowledge about file systems and data recovery, you'll get it working. The Step by step guide is helpful. In my case I was able to fix the HDD directly from the running Windows where the disk got broken - no need to boot a Linux Live CD or something.

1
  • A small note on Testdisk: it's bery good when the partition table is broken (and probably it will be OK for the OP's situation). But if the MFT is really broken it won't recover any file. It does not "repair" a broken NTFS in place. Sep 28 '16 at 12:58
1

If the goal is data recovery then in-place repairs are not recommended. If you decide to try anyway, first clone the drive using something like ddrescue. This is my fist and final warning ;)

Initial notes

There is no way to repair a severely damaged file system in-place for the purpose of data recovery!

First, if MFT is damaged there realistically is no way to reliably repair. Chkdsk might, but it might by deleting data. It's goal is a consistent file system and under circumstances deleting data from the file system is one path to accomplish that. Chkdsk is not a data recovery tool!

Testdisk is often mentioned but it is incapable of repairing a corrupt MFT. The MFT repair capability it advertises is merely copying the mirror MFT on top of the damaged one. Despite popular belief this mirror is NOT a full backup, just the first few dozen records or so are in fact backed up. None of the entries referencing user files are backup and so this repair will not

RAW file system

I am making the assumption you mean a RAW file system when you mention 'unformatted'. Unfortunately this is kind of a catch all condition in which Windows can not determine the file system. It does not specify the reason for this. The case may be it's a foreign file system. But now we'll look at some damage types that are easily diagnosed and repaired.

Journey of mounting a file system starts in the partition table. Already in the partition table, whether it being an MBR type or GPT type, a file system is mentioned, but it's not really of importance to the mounting process.

Partition table points to FIRST sector of the file system. If it erroneously points to the wrong location Windows will attempt to interpret the sector pointed to as boot record and fail. IOW words it is unable to determine the file system: Result is a RAW file system.

If partition table points to correct location for the boot sector but this sector itself is corrupt Windows will fail to determine the file system: Result is a RAW file system.

In both cases Chkdsk will fail to check the drive. It's those two cases that are repairable IF these are the only issues. Testdisk can indeed be used for this, instead I propose DMDE from www.dmde.com. The ability to repair a partition table and a boot sector using the backup copy of the boot sector is available in the free version.

9 out of 10 cases where the problem is actually the partition table or the boot sector can be repaired in a matter of seconds. DMDE is not installed, you simply extract from the archive you download and run 'dmde.exe'. Now select the drive and a partition window is displayed. DMDE will execute a quick scan that normally takes a few seconds.

DMDE partition window

It will list current and found partitions, and for each it will display if several components are found:

  • E : partition table entry
  • B : boot sector
  • C : backup boot sector
  • F : file system

If we'd see for a given partition ExCx it would mean a partition is defined, no valid boot sector was found and therefor no file system either (qualifies as RAW partition). As C indicates a backup boot sector is present we can right click this partition and pick the option that repairs the boot sector using it's backup.

Example Repairs

If we see 2 partitions with following:

  • Exxx
  • xCBF

It means first partition is currently in partition table however it does not point to any valid file system structures and as such qualifies as a RAW partition. It is probably simply pointing to the wrong LBA address. Second list entry shows what seems to be a valid and complete file system but not referenced by partition table. So in that case we'd select the second entry, right click and select the partition undelete option. You may be prompted this partition overlaps with the invalid one, so we answer yes when DMDE suggests to delete it.

Hint: Before performing actual repair you can use 'Open Volume' button to check if folder structure looks intact.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.