MFT Data Recovery

[beto]

Hello hddguru ´s

I want to put some discussion about "MFT" Overwritted"

What does it mean,? some times, when u get a HDD to DR, from a NTFS File system with the following syntomph: impossible to access to partitions from windows explorer , u try all DR Software, on the market, or some peoples like me, like´s the difficult way , begins to start analyzing hex codes ;MBR OK,, Partition table, OK, go to the sector from the Volume Sector, and its OK, then u are finding where its the problem, and u go to the MFT Records, and discover THE MFT was overwritting , search the most important records lik $MFT,$MFTMirr,$Volume,$, and u discover this was overwritted from another file code, maybe " temporal file" or "MP3" i had a case like this , so u try to search to found the rest of sectors from MFT or sometimes shifted to the end of the cylinder´s and u cant find, or find some hex code, but analyzing u discovered are garbage on the record´s, so the only way to try to get data, should be searching for Footers from the file wich u need , headers, etc , and save on a new files, but this works maybe for FAT, but with a NTFS File System u get more fragmented cluster and if u need a very long data like PST File, DOC u will be get , garbage at the file in some cases, or u data recovery percetange of sucess will be down . by this way its possible to recovery or try to rebuild the original MFT?,

Im think, this is very hard to do , even if u get a " Magic Machine" Like MFM im not talking about Radio FM im said Magetic Force Microscope ,STM programming for read´s from platter, wheres ´s the only way to works its "scanning platters" and getting bits" 1","0" or Flux " , -> <- would be the same situation if the data are fragmented, u get only some´s hex code from the headers and footer´s from the file´s wich u need to recover. wich is u opinion about this?

Best Regards

Sinceraly

Alberto

[quasimodo]

Hi Alberto,
This is an interesting topic, I hope you will get lot's of replies to start this discussion.
As with the limited knowledge I have, I am not aware of any solution that can re-create your Master File Table (MFT). I have always had to go by header and footer for the files if the MFT has been corrupted. Luckily there is some software out there that does a somewhat decent job at recovering common file types via their header and footers including pst files. As far as trying to recover your MFT, I believe it really depends on how badly it's damaged.

MFT Records:

Code:

  Header 
Attribute 
Attribute 
Attribute 
Attribute 
End marker 


If you are lucky the damage is in the header or End marker, in this case you should be able to copy header and End marker from an intact NFTS MFT via Hex editor. Also, If you compare the Header and End marker of a functional MFT with the damaged one you may be able to discover a shift in the hex values. If there is substantial damage to the Attribute's ... hmm, not sure, would definitely be difficult.

best regards,
Drew

[quasimodo]

I guess the next level, if this did not work would be to recover metadata files.
You mentioned that $MFT,$MFTMirr,$Volume, are all overwriten. I would also check header and footer of intact $MFT,$MFTMirr,$Volume, from a good NTFS partition and then perform a search in the hex editor, you might find the metadata files to be fragmented and with some work could maybe patch them back together. Systematically the next step would be to look for the fourteen system-defined attributes and use the same procedure. for $STANDARD_INFORMATION, $ATTRIBUTE_LIST , etc...

[pepe]

Hi,

Well, if the important MFT records are overwritten (I mean the records of the files U need indeed), there is nothing left other than RAW recovery. 'Sad but true'.
we may try to develop SW able to find for example portions of a PST file or extract the emails from the portions...

regards,
pepe

[pepe]

Hi,

Well, if the important MFT records are overwritten (I mean the records of the files U need indeed), there is nothing left other than RAW recovery. 'Sad but true'.
we may try to develop SW able to find for example portions of a PST file or extract the emails from the portions...
I wrote something similar for Outlook Express DBX files, but it was a long time ago, I remember very faintly.

regards,
pepe