NTFS Partition – How to Restore MFT After a Format

data-recoveryformatmftntfs

I've searched through several questions but didn't quite find anyone treating mine.

So, I have a 1TB external hard drive I use for backup purposes with only 1 NTFS partition. Today using DiskPart I formated that partition by mistake (who would have thought the disc count started in 0 and not in 1). The complete command I used was:

format recommended override quick label=Windows

So I performed a quick format, and from which I've read after a quick format it's possible to recover the data stored there. Anyway, as soon as I realized it wasn't the partition I wanted to format the one I specified I removed the access to my external drive to minimize possible damages.

Now, the MFT is the metadata part where the file name, creation date, access permissions and contents are registered; and it's mirrored too (so there's a copy of it somewhere in the disk). What I don't know is if a quick format erases that MFT mirror too, I hope not.

I'm running a program to recover files on it but I'll have to save the files to another location (once it's finished scanning, ~12 hours from now) and I don't quite have over 900GB of free storage where to put the data.

I would like to know if there's a program or procedure by which I could restore the old MFT in-place and have all the data that used to be in there accessible once again.

Any help or light you could shed on how to proceed or what programs to use is really appreciated.

Best Answer

chkdsk can possibly restore the MFT from the mirror, back up your data before doing anything, buy a usb drive if needed, or risk losing it all.

No way for anyone to know how far the quick format went before detachment.

Never used this software but looks interesting

http://dmitrybrant.com/ntfswalker

According to Jaclaz in this forum it is not possible

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=6425

For the record, unlike what a lot of people apparently thinks, the $MFTMirr is pretty much useless, as it consists of ONLY the first 4 (four) records of the $MFT. Obviously once you re-format, it represents the mirror of the first 4 records of the NEW $MFT, unless you changed CONSIDERABLY the partition size (thus causing the new $MFT and $MFTmirror to be "somewhere else") or you used a NT system that uses a different "default" for the placement of these structures - like Windows 2000, in which case the OLD filesystem structure may be not overwritten.

.

Related Question