Trying to recover a NTFS corrupt partition

Super User Asked by abiyi on December 8, 2020

I’m stucked with the fixing of a NTFS partition, which I kind of recovered from the MFT backup using TestDisk 7.2-WIP on Windows 7, even so the partition recovered is corrupted.

enter image description here

enter image description here

Applying on Debian Linux the instructions of to analyze the Master File Table (with I can get the partition layout of the hard drive:

debian:~# mmls /dev/sdc
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000016063   0000016064   Unallocated
002:  Meta      0000000063   0976773119   0976773057   Win95 Extended (0x0f)
003:  Meta      0000000063   0000000063   0000000001   Extended Table (#1)
004:  001:000   0000016064   0976768064   0976752001   NTFS / exFAT (0x07)
005:  -------   0976768065   0976773167   0000005103   Unallocated

I’m interested in the NTFS / exFAT (0x07) partition, starting in the offset of 16064
But instead of displaying the content of that inode, it shows an error:

debian:~# icat -o 16064 /dev/sdc 0 > mft.raw
Cannot determine file system type

Specifying the file system is futile…

debian:~# icat -f ntfs -o 16064 /dev/sdc 0 > mft.raw
Invalid magic value (Not a NTFS file system (magic))

… not even as a RAW filesystem:

debian:~# icat -f raw -o 16064 /dev/sdc 0 > mft.raw
Function/Feature not supported (Illegal analysis method for raw data )

Even fdisk says it’s a NTFS filesystem:

debian:~# fdisk -l /dev/sdc
Disk /dev/sdc: 465.8 GiB, 500107862016 bytes, 976773168 sectors
Disk model: 00LPVX-22V0TT0  
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xa5eb893d

Device     Boot Start       End   Sectors   Size Id Type
/dev/sdc1          63 976773119 976773057 465.8G  f W95 Ext'd (LBA)
/dev/sdc5       16064 976768064 976752001 465.8G  7 HPFS/NTFS/exFAT

ntfsfix finally provides some insight into the problem:

debian:~# ntfsfix /dev/sdc5
Mounting volume... NTFS signature is missing.
Attempting to correct errors... NTFS signature is missing.
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

But I was twice wrong, chkdsk can’t even work with the filesystem, it says it’s a RAW filesystem:

C:Windowssystem32>chkdsk d: /f
The type of the file system is RAW. 
CHKDSK is not available for RAW drives.

The question is: How to set the filesystem type as NTFS without formatting the partition?

Add your own answers!

Ask a Question

Get help from others!

© 2024 All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP