I used Avira Rescue Disk (Ubuntu 12.04) to access a broken NTFS boot partition. Windows 7 fails to mount it: it displays a bluescreen ("UNMOUNTABLE_BOOT_VOLUME") and restarts immediately. With the Rescue Disk I could backup the most important data (Ubuntu does not fail on mounting). Now I tried gparted
to fix the partition. To analyse the partition, gparted runs a scanning-only ntfsresize
first.
A similar (= non-writing) but manual run of ntfsresize -info --force /dev/sda3
gives:
ntfsresize v2012.1.15AR.1 (libntfs-3g)
Device name : /dev/sda3
NTFS volume version: 3.1
Cluster size : 4096 bytes
Current volume size: 484336226816 bytes (484337 MB)
Current device size: 484336230400 bytes (484337 MB)
Checking for bad sectors ...
Checking filesystem consistency ...
0,00 percent completed
..
..
..
12,83 percent completed
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73604 count=1 br=-1: Eingabe-/Ausgabefehler (= I/O error)
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73605 count=1 br=-1: Eingabe-/Ausgabefehler
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73606 count=1 br=-1: Eingabe-/Ausgabefehler
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73607 count=1 br=-1: Eingabe-/Ausgabefehler
12,85 percent completed
..
..
..
100.00 percent completed
Accounting clusters ...
Cluster accounting failed at 9962391 (0x980397): extra cluster in $Bitmap
..
..
..
Cluster accounting failed at 9963113 (0x980669): extra cluster in $Bitmap
Filesystem check failed! Totally 723 cluster accounting mismatches.
ERROR: NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.
So, the $MFT seems to be broken. However, ntfsfix --no-action /dev/sda3
(non-writing) states:
avira@avira:~$ sudo ntfsfix -n /dev/sda3
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
NTFS volume version is 3.1.
NTFS partition /dev/sda3 was processed successfully.
Whom can I trust? What really happened to my $MFT? Why can Ubuntu still read most of the files, and Win 7 fails to mount (expect from being Windows)? What tool should I use to fix the MFT: gparted
or testdisk
or ntfsfix
(without --no-action
) or chkdsk /f
? Haven't felt lucky yet. I've read about testdisk
being able to mess up $MFT and $MFTMirr in severe cases. Could that happen?
Additionally, SMART reports one bad sector (Reallocated Sectors Count = 1). Should I renew the disk in any event?
What can I run else to (at least) locate the error (e.g. affected filenames, electromechanical failure y/n?) better?
Best Answer
If the MFT$ file got corrupted, try R-STUDIO to rescue the data on that drive.
Important: Do not perform any write operation to the corrupted drive!
Done!