<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="keywords" content="Advanced NTFS Boot and MFT Repair,Running TestDisk,TestDisk" />
<link rel="shortcut icon" href="favicon.ico" />
<link rel="search" type="application/opensearchdescription+xml" href="opensearch_desc.php" title="CGSecurity (English)" />
<link rel="copyright" href="http://www.gnu.org/copyleft/fdl.html" />
<title>Advanced NTFS Boot and MFT Repair - CGSecurity</title>
<style type="text/css" media="screen, projection">/*<![CDATA[*/
@import "shared.css_97.css";
@import "main.css_97.css";
/*]]>*/</style>
<link rel="stylesheet" type="text/css" media="print" href="commonprint.css_97.css" />
<!--[if lt IE 5.5000]><style type="text/css">@import "ie50fixes.css_97.css";</style><![endif]-->
<!--[if IE 5.5000]><style type="text/css">@import "ie55fixes.css_97.css";</style><![endif]-->
<!--[if IE 6]><style type="text/css">@import "ie60fixes.css_97.css";</style><![endif]-->
<!--[if IE 7]><style type="text/css">@import "ie70fixes.css_97.css";</style><![endif]-->
<!--[if lt IE 7]><script type="text/javascript" src="iefixes.js_97"></script>
<meta http-equiv="imagetoolbar" content="no" /><![endif]-->
<script type= "text/javascript">/*<![CDATA[*/
var skin = "monobook";
var stylepath = "/mw/skins";
var wgArticlePath = "/wiki/$1";
var wgScriptPath = "/mw";
var wgScript = "/mw/index.php";
var wgServer = "http://www.cgsecurity.org";
var wgCanonicalNamespace = "";
var wgCanonicalSpecialPageName = false;
var wgNamespaceNumber = 0;
var wgPageName = "Advanced_NTFS_Boot_and_MFT_Repair";
var wgTitle = "Advanced NTFS Boot and MFT Repair";
var wgAction = "view";
var wgRestrictionEdit = [];
var wgRestrictionMove = [];
var wgArticleId = "1390";
var wgIsArticle = true;
var wgUserName = null;
var wgUserGroups = null;
var wgUserLanguage = "en";
var wgContentLanguage = "en";
var wgBreakFrames = false;
var wgCurRevisionId = "4124";
/*]]>*/</script>
<script type="text/javascript" src="wikibits.js_97"><!-- wikibits js --></script>
<script type="text/javascript" src="http://www.cgsecurity.org/mw/index.php?title=-&action=raw&gen=js&useskin=monobook"><!-- site js --></script>
<style type="text/css">/*<![CDATA[*/
@import "Common.css";
@import "Monobook.css";
@import "dyn.css";
/*]]>*/</style>
<!-- Head Scripts -->
<script type="text/javascript" src="ajax.js_97"></script>
</head>
<body class="mediawiki ns-0 ltr page-Advanced_NTFS_Boot_and_MFT_Repair">
<div id="globalWrapper">
<div id="column-content">
<div id="content">
<a name="top" id="top"></a>
<h1 class="firstHeading">Advanced NTFS Boot and MFT Repair</h1>
<div id="bodyContent">
<h3 id="siteSub">From CGSecurity</h3>
<div id="contentSub"></div>
<div id="jump-to-nav">Jump to: <a href="#column-one">navigation</a>, <a href="#searchInput">search</a></div> <!-- start content -->
<table id="toc" class="toc" summary="Contents"><tr><td><div id="toctitle"><h2>Contents</h2></div>
<ul>
<li class="toclevel-1"><a href="#Repair_NTFS_Boot_Sector"><span class="tocnumber">1</span> <span class="toctext">Repair NTFS Boot Sector</span></a>
<ul>
<li class="toclevel-2"><a href="#Recovering_NTFS_Boot_Sector_on_NTFS_Partitions_using_its_backup"><span class="tocnumber">1.1</span> <span class="toctext">Recovering NTFS Boot Sector on NTFS Partitions using its backup</span></a></li>
<li class="toclevel-2"><a href="#Rebuilding_NTFS_Boot_Sector_on_NTFS_Partitions"><span class="tocnumber">1.2</span> <span class="toctext">Rebuilding NTFS Boot Sector on NTFS Partitions</span></a></li>
</ul>
</li>
<li class="toclevel-1"><a href="#Repair_NTFS_MFT"><span class="tocnumber">2</span> <span class="toctext">Repair NTFS MFT</span></a></li>
</ul>
</li>
</ul>
</td></tr></table><script type="text/javascript"> if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); } </script>
<a name="Repair_NTFS_Boot_Sector"></a><h2> <span class="mw-headline"> Repair NTFS Boot Sector </span></h2>
<p>If the NTFS boot sector is damaged, data can not be accessed.
Windows will prompt <code>The drive is not formatted, do you want to format it now?</code>
Linux mount will display <code>wrong fs type, bad option, bad superblock</code>
</p><p><a href="testdisk.html" title="TestDisk">TestDisk</a> let you manipulate and fix the boot sector of NTFS partitions.
Select the partition you want to modify and choose <b>Boot</b>.
</p>
<a name="Recovering_NTFS_Boot_Sector_on_NTFS_Partitions_using_its_backup"></a><h3> <span class="mw-headline"> Recovering NTFS Boot Sector on NTFS Partitions using its backup </span></h3>
<p>TestDisk can use backup boot sector to fix corrupted NTFS boot sector. The primary boot sector is sector zero of the filesystem, the backup NTFS boot sector is located near the end of the filesystem. TestDisk checks the boot sector and the backup boot sector. If the boot sector and backup boot sector mismatches, you can overwrite the NTFS boot sector with the backup boot sector (<b>Backup BS</b>) or vice versa (<b>Org. BS</b>).
<b>Dump</b> can used to display the boot sector content in both hexadecimal and ascii.
</p>
<a name="Rebuilding_NTFS_Boot_Sector_on_NTFS_Partitions"></a><h3> <span class="mw-headline"> Rebuilding NTFS Boot Sector on NTFS Partitions </span></h3>
<p>If both NTFS boot sector are corrupted, you need to rebuild NTFS boot sector,
TestDisk searches the MFT (Master File Table: $MFT) and its backup ($MFTMirr).
It reads the mft record size and it computes the cluster size,
It reads the Size of Index Allocation Entry in the root directory index. Using all these values,
TestDisk can provide a new boot sector. Finaly it lets the user list the files before writing.
</p>
<a name="Repair_NTFS_MFT"></a><h2> <span class="mw-headline"> Repair NTFS MFT </span></h2>
<p>The MFT (Master File Table) is sometimes corrupted. If Microsoft Check Disk (chkdsk) failed
to repair the MFT, run TestDisk and in the Advanced menu, select your NTFS partition and
choose <b>Repair MFT</b>. TestDisk will try to repair the MFT using MFT mirror, its backup.
</p><p>If both MFT and MFTMirr are damaged and thus can not be repaired using TestDisk, you might want to try commercial software as <a href="http://www.z-a-recovery.com/" class="external text" title="http://www.z-a-recovery.com/" rel="nofollow">Zero Assumption Recovery </a>, <a href="http://www.runtime.org/gdb.htm" class="external text" title="http://www.runtime.org/gdb.htm" rel="nofollow">GetDataBack</a> for NTFS or <a href="http://www.restorer2000.com/" class="external text" title="http://www.restorer2000.com/" rel="nofollow">Restorer 2000</a>.
</p><p>Back to <a href="running_testdisk.html" title="Running TestDisk">Running the TestDisk Program </a>
</p>
<!-- Saved in parser cache with key cg_mw-mw_:pcache:idhash:1390-0!1!0!!en!2!edit=0 and timestamp 20080127104820 -->
<div id="catlinks"><p class='catlinks'><a href="http://www.cgsecurity.org/wiki/Special:Categories" title="Special:Categories">Category</a>: <span dir='ltr'><a href="http://www.cgsecurity.org/wiki/Category:Data_Recovery" title="Category:Data Recovery">Data Recovery</a></span></p></div> <!-- end content -->
<div class="visualClear"></div>
</div>
</div>
</div>
<div id="column-one">
<div class="portlet" id="p-logo">
<a style="background-image: url(logo.png);" href="http://www.cgsecurity.org/" title="Visit the Main Page [z]" accesskey="z"></a>
</div>
<script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script>
<div class='portlet' id='p-Data_Recovery'>
<h5>Data Recovery</h5>
<div class='pBody'>
<ul>
<li id="n-TestDisk"><a href="testdisk.html">TestDisk</a></li>
<li id="n-PhotoRec"><a href="photorec.html">PhotoRec</a></li>
<li id="n-Download"><a href="testdisk_download.html">download</a></li>
</ul>
</div>
</div>
</div><!-- end of the left (by default at least) column -->
<div class="visualClear"></div>
<div id="footer">
<div id="f-copyrightico"><a href="http://www.gnu.org/copyleft/fdl.html"><img src="gnu_fdl.png" alt='GNU Free Documentation License 1.2' /></a></div>
<ul id="f-list">
<li id="lastmod"> This page was last modified 10:42, 27 January 2008.</li>
<li id="copyright">Content is available under <a href="http://www.gnu.org/copyleft/fdl.html" class="external " title="http://www.gnu.org/copyleft/fdl.html" rel="nofollow">GNU Free Documentation License 1.2</a>.</li>
</ul>
</div>
<script type="text/javascript">if (window.runOnloadHook) runOnloadHook();</script>
</div>
</body><!-- Cached 20080127104820 -->
</html>
