HDD GURU FORUMS

Seems like a bad sector in the MFT - you could confirm this in DE

labtech wrote:Seems like a bad sector in the MFT - you could confirm this in DE

DE can recognize the file name (in log only) and the located folder, but i cannot see it in the file tree, so i cannot click save file.


I am wounding if i do raw recovery will i get this file ?

Scan MFT+IDX and see if you can find it in "Lost & Found" when it finishes.
If not, you can of course attempt a raw scan, it will most possibly recover your file.

Seems like you are working directly off the failing drive. You should image it or at least key parts of it, e.g. MFT for starters.

I agree with Labtech See this on a day to day basis. Image the drive (or at least the area where that file is, try using chain imaging in DE) and work from the image or you will end up getting diminishing results. Even if you client only wants one file its the best way to get it so charge accordingly.

"INDEX entry has BAD MFT Record 198784" means exactly that: The file X with ID 198784 referenced in the INDX folder file has a bad MFT entry record. Sometimes this is due to a weak or bad head, unable to read the MFT entry #198784 (UNC errors), sometimes it is simply due to data corruption, BUT SOMETIMES this is due to problems reading the $MFT entry record inside the $MFT itself (ID=0), both in the base copy and the mirror copy (this is, although DE was able to reconstruct part of the file tree, at some point the MFT becomes fragmented and DE has no idea where the rest of the MFT is). So you need a thorough scan, and you need to know what you do and what the problem really is.

Of course, if the MFT entry is corrupted or is not located where it's supposed to be, you'll not be able to read the data runs - you have no idea where the file is. So DE hides it from unexperienced eyes.