[Help] MFT problem or NTFS damage

[Scorpion]

Hi All,

A known problem which I guess everyone deals from time to time but now it is really important to me to fix.
R-studio gave me all the files with the right order, dates, size and structure but non of them work. Each file is corrupted - how to fix it?
(Raw recovery gave access to all data without a problem but as you know the files lost their names and stucture in such way.

Backgroud case
I got a case which seems like an easy one - formatted drive (from a raid1 nass box).
I mannaged to recover full complete structure & original dates and size file names and folders out of lost NTFS file system but unfortunatly none of the files work (not due to ransom virus but as a result of electricity failure).
The only way to get access the files is by Raw recovery but

I guess that there is a corruption in the MFT so the reocvery software doesn't seems to deal with that and create for output all the files as corrupted.
How can I reocver the structure and keep on working files without using raw recovery?

Would be very happy for any suggestion.

[Scorpion]

- Maybe something on the drive went wrong and you did end up with translator shifting LBAs ?

- What is the full model of the drive ? Did you apply any firmware fix to the drive ?

- Did you image/clone the original damaged drive ? With what ?

...

* The same sympthom is on the other drive too :/
* The raid got damaged by electrical problem which lead to auto format or to user format
* I tried several other tools (also reclaime's) but R-studio and got the same results
* I didn't mess with the translator becuase got sector access imidiatly (after some "HDD ID" modifications under Seagate utility)
* ST1000DM003-1CH162 , CC47 - > Both drives started with BSY state and solved after modify the FW under "HDD ID" to:
a) "Show additional diag msg in terminal"
b) "Disable IDLE activities"
all the rest are unchecked
* First drive wasn't necessary to be image since after those modifications got back to full good condition without any single bad sector. The second drive is still under imaging right now with bad sectors.
* DE in PC3K didn't find any NTFS remaings on any of the drives. It ONLY found three EXT (2,3,4) partions without any real data inside (seems like the defults folder for EXT partion).

[jermy]

You didn't answer the question what RAID is it ? 1 ?

[fzabkar]

You didn't answer the question what RAID is it ? 1 ?

Backgroud case
I got a case which seems like an easy one - formatted drive (from a raid1 nass box).

[Scorpion]

This is Raid 1 mirror

[jermy]

Have you tried UFS explorer ?

[DR-Kiev]

I know the problem)
1) It is NAS , than it shouldnt be NTFS
2) If you find NTFS , than you found VM inside different File System (VMFS or Ext3/4 or XFS)
3) If you didnt get any shot in MFT entries , than it is most probably VHD vm file coz in VMDK shifting could be caused due of fragmatation only

[Scorpion]

Have you tried UFS explorer ?

Yes I have, the same results :/

I know the problem)
1) It is NAS , than it shouldnt be NTFS
2) If you find NTFS , than you found VM inside different File System (VMFS or Ext3/4 or XFS)
3) If you didnt get any shot in MFT entries , than it is most probably VHD vm file coz in VMDK shifting could be caused due of fragmatation only

R-Studio and UFS recognized few losts partions and only the NTFS gave the right file names with the size and date. All the other file system gave nothing.
So I guess the original file system was NTFS.

It seems like there is kind of shifting in the files.. So if the file system will start a little bit farther or closer than all the files will be open.

Is there a way to detect where the file system should start and tell the software to open it as I set?

[DR-Kiev]

If you scan VM files with NTFS inside, you will get directory structure and files names and so on. But they won't be working properly. NAS can't be created based on NTFS anyhow. Search for different FS in UFs explorer

[S.Haran]

If you post the model name of the NAS. We can confirm the native filesystem type of the data volume. As DR-Kiev states it is likely not NTFS.