It is currently Fri Oct 31, 2014 12:11 pm

All times are UTC - 8 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 12 posts ] 
Author Message
 Post subject: Fix MFT Mirror? error
PostPosted: Tue Feb 23, 2010 3:10 pm 
Offline

Joined: Tue Feb 23, 2010 2:37 pm
Posts: 6
Hi,

recently my winxp sp3 NTFS system got infected by a virus and soon it was not booting again. I repaired the system using a winxp sp3 cd, used bootcfg / rebuild, fixmbr, fixboot..etc....but still not booting....

finally, I had to resort to my UBCD TestDisk....
It shows all Files OK and Boots OK... I am able to browse my files too....
But when i use the Analyse option > Fix MFT, i get an error:

Code:
Fix MFT Mirror? (Y/N) dos mem corrupt, first_mcb=0253
prev 0340:0000| 4d b7 05 00 00 00 00 00 00 00 00 00 00 00 00 00 .......
notMZ0341:0000| 46 49 4c 45 30 00 03 00 0f e5 63 51 00 00 00 00 .......

PANIC: MCB chain corrupted
System halted


What is wrong here? and why does my HDD not boot ? what do the above messages mean? can someone enlighten me on this? What is the right or alternative method to make my HDD boot my OS again?

I dont want to format my HDD as i have a lot of important data and applications and it will take me ages to install them again...and i dont have an additional external drive to use GetDataBack to backup my files.

Please advice ASAP.

_________________
Regards,


Sifar
_________


Top
 Profile  
 
 Post subject:
PostPosted: Tue Feb 23, 2010 3:19 pm 
Offline

Joined: Fri Jan 11, 2008 2:52 pm
Posts: 1278
Did you try to run chkdsk from the recovery console?
Code:
chkdsk /f

http://www.microsoft.com/resources/docu ... x?mfr=true

_________________
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/


Top
 Profile  
 
 Post subject: Fix MFT Mirror? error
PostPosted: Tue Feb 23, 2010 3:42 pm 
Offline

Joined: Tue Feb 23, 2010 2:37 pm
Posts: 6
Yes. thats the first thing i did from the recovery console....right now i just want to get my OS running (booting)....as of now after the initial CMOS screen, instead of getting OS boot options, i get a blank screen and the system halts...

_________________
Regards,


Sifar
_________


Top
 Profile  
 
 Post subject:
PostPosted: Wed Feb 24, 2010 7:03 am 
Offline

Joined: Fri Jan 11, 2008 2:52 pm
Posts: 1278
Repair your Windows installation:
viewtopic.php?t=2031&highlight=

_________________
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/


Top
 Profile  
 
 Post subject: Fix MFT Mirror? error
PostPosted: Wed Feb 24, 2010 11:41 am 
Offline

Joined: Tue Feb 23, 2010 2:37 pm
Posts: 6
Code:
I repaired the system using a winxp sp3 cd, used bootcfg / rebuild, fixmbr, fixboot..etc....but still not booting....


any better solution?? and anyone knows the meaning of the error i posted earlier?

_________________
Regards,


Sifar
_________


Top
 Profile  
 
 Post subject:
PostPosted: Wed Feb 24, 2010 1:34 pm 
Offline

Joined: Fri Jan 11, 2008 2:52 pm
Posts: 1278
Read this link (better explained) to know how to repair a existing Windows installation (you need to apply windows updates again + installed programs are preserved):
http://michaelstevenstech.com/XPrepairinstall.htm

_________________
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/


Top
 Profile  
 
 Post subject:
PostPosted: Wed Feb 24, 2010 2:45 pm 
Offline

Joined: Tue Feb 23, 2010 2:37 pm
Posts: 6
i have read it before when i was googling information. an inplace upgrade is nothing but reinstallation of the OS by entering the product key and it does not guarantee data deletion...data is deleted after all!

BTW, i think both my MFT and MFTMirr are corrupt bcos when i start

TestDisk > Advanced > Boot

I get:
Code:
boot sector
status : ok

backup boot sector
status : ok

sectors are identical



and on using :

TestDisk > Advanced > Boot > Rebuild BS

I get:

Code:
Partition                Start              End                 Size in Sectors
--------------------------------------------------------------------------
1* HPFS-NTFS      0  1  1       4868   254    63      78220422

Filesystem size : 78220422
sectors_per_cluster : 8
mft_lcn : 786432
mftmirr_lcn : 4888776
clusters_per_mft_record : -10
clusters_per_index_record : 1

Extrapolated boot sector and current boot sector are identical and ok.


from above if you see, mft_lcn & mftmirr_lcn sizes are different. And when i run :

TestDisk > Advanced > Boot > Rebuild MFT

i get :

Code:
Fix MFT Mirror? (Y/N) dos mem corrupt, first_mcb=0253
prev 0340:0000| 4d b7 05 00 00 00 00 00 00 00 00 00 00 00 00 00 .......
notMZ0341:0000| 46 49 4c 45 30 00 03 00 0f e5 63 51 00 00 00 00 .......

PANIC: MCB chain corrupted
System halted


Now this indicates that both the Master File Table and the Master File Table Mirror are corrupt, otherwise if one of them was ok, it would have replaced the corrupt one with the good one....just an assumption...

Hope somebody enlightens me on this and also lets me know how to find which one is Ok and which one is not....

What is the option (other than format) to be used in such a scenario?

How to repair or rebuild MFT, if both its current n mirror tables are corrupt?

Hope there is some one out there who has already solved this mystery without deleting any data in the bargain... :)

_________________
Regards,


Sifar
_________


Top
 Profile  
 
 Post subject:
PostPosted: Wed Feb 24, 2010 3:18 pm 
Offline

Joined: Fri Jan 11, 2008 2:52 pm
Posts: 1278
You better ask the testdisk developer what you can do the best.
You better use a more recent version of testdisk too.

_________________
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/


Top
 Profile  
 
 Post subject:
PostPosted: Wed Feb 24, 2010 3:28 pm 
Offline

Joined: Tue Feb 23, 2010 2:37 pm
Posts: 6
i dont have the email address of the testdisk developer. If you have, please post it here for me...

i have downloaded and used the latest version of testdisk...same results..

_________________
Regards,


Sifar
_________


Top
 Profile  
 
 Post subject:
PostPosted: Wed Feb 24, 2010 3:35 pm 
Offline

Joined: Fri Jan 11, 2008 2:52 pm
Posts: 1278
At he bottom of http://www.cgsecurity.org/wiki/TestDisk

_________________
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/


Top
 Profile  
 
 Post subject:
PostPosted: Thu Feb 25, 2010 12:17 pm 
Offline

Joined: Tue Feb 23, 2010 2:37 pm
Posts: 6
well, i havent received any reply from the testdisk developer....right now i got a 20gb hdd from a friend...loaded windows xp in it as master and the corrupted 40gb hdd as slave....the corrupted one gets detected in bios but when i load windows xp in 20gb hdd, it was visible for a few minutes and then got a windows msg saying its corrupted and the hdd dissapeared....now i am not able to see it at all in windows explorer on subsequent reboots.....what should i do? i was able to view the files and folders for the few minutes it was visible....

_________________
Regards,


Sifar
_________


Top
 Profile  
 
 Post subject:
PostPosted: Sun Feb 28, 2010 10:48 pm 
Offline

Joined: Tue Sep 09, 2008 4:37 pm
Posts: 462
Location: California, USA
Boot Knoppix and mount the drive. Normally, Knoppix can mount anything corrupted or not. COPY all important data OFF of the HD to USB or ANOTHER HD to prevent any data loss (example: docs pics and anything you cant not replace). This is what I found on how to repair the MFT: http://www.cgsecurity.org/wiki/Advanced ... MFT_Repair

I would STILL HIGHLY recommend you delete the partition using any program and then format the drive as ntfs (full format) then Delete it AGAIN, and only then reinstall windows on that drive after doing ANOTHER full ntfs format when installing windows (gives you an option when formatting). You need to be very careful, because just reinstalling windows after a virus infection this bad, could just allow the virus to come back...and "deleted" partitions are just partitions marked as deleted...not actually removed from the drive and unrecoverable.

_________________
~Just StopSpazzing~

Visit the UBCD Wiki: http://wiki.ultimatebootcd.com
Please check your UBCD ISO MD5 Hash Sum; May prevent issues later on by not having an exact copy.

Currently Working on Common Issues and Repair Tips on the Wiki.


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 12 posts ] 

All times are UTC - 8 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  

Protected by Anti-Spam ACP Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group