Fix MFT Mirror? error

Try looking for help here if you are having problems with the Ultimate Boot CD.

Moderators: Icecube, StopSpazzing

Locked
Message
Author
sifar786
Posts: 6
Joined: Tue Feb 23, 2010 2:37 pm

Fix MFT Mirror? error

#1 Post by sifar786 » Tue Feb 23, 2010 3:10 pm

Hi,

recently my winxp sp3 NTFS system got infected by a virus and soon it was not booting again. I repaired the system using a winxp sp3 cd, used bootcfg / rebuild, fixmbr, fixboot..etc....but still not booting....

finally, I had to resort to my UBCD TestDisk....
It shows all Files OK and Boots OK... I am able to browse my files too....
But when i use the Analyse option > Fix MFT, i get an error:

Code: Select all

Fix MFT Mirror? (Y/N) dos mem corrupt, first_mcb=0253
prev 0340:0000| 4d b7 05 00 00 00 00 00 00 00 00 00 00 00 00 00 .......
notMZ0341:0000| 46 49 4c 45 30 00 03 00 0f e5 63 51 00 00 00 00 .......

PANIC: MCB chain corrupted
System halted
What is wrong here? and why does my HDD not boot ? what do the above messages mean? can someone enlighten me on this? What is the right or alternative method to make my HDD boot my OS again?

I dont want to format my HDD as i have a lot of important data and applications and it will take me ages to install them again...and i dont have an additional external drive to use GetDataBack to backup my files.

Please advice ASAP.
Regards,


Sifar
_________

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#2 Post by Icecube » Tue Feb 23, 2010 3:19 pm

Did you try to run chkdsk from the recovery console?

Code: Select all

chkdsk /f
http://www.microsoft.com/resources/docu ... x?mfr=true
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/

sifar786
Posts: 6
Joined: Tue Feb 23, 2010 2:37 pm

Fix MFT Mirror? error

#3 Post by sifar786 » Tue Feb 23, 2010 3:42 pm

Yes. thats the first thing i did from the recovery console....right now i just want to get my OS running (booting)....as of now after the initial CMOS screen, instead of getting OS boot options, i get a blank screen and the system halts...
Regards,


Sifar
_________

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#4 Post by Icecube » Wed Feb 24, 2010 7:03 am

Repair your Windows installation:
viewtopic.php?t=2031&highlight=
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/

sifar786
Posts: 6
Joined: Tue Feb 23, 2010 2:37 pm

Fix MFT Mirror? error

#5 Post by sifar786 » Wed Feb 24, 2010 11:41 am

Code: Select all

I repaired the system using a winxp sp3 cd, used bootcfg / rebuild, fixmbr, fixboot..etc....but still not booting.... 
any better solution?? and anyone knows the meaning of the error i posted earlier?
Regards,


Sifar
_________

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#6 Post by Icecube » Wed Feb 24, 2010 1:34 pm

Read this link (better explained) to know how to repair a existing Windows installation (you need to apply windows updates again + installed programs are preserved):
http://michaelstevenstech.com/XPrepairinstall.htm
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/

sifar786
Posts: 6
Joined: Tue Feb 23, 2010 2:37 pm

#7 Post by sifar786 » Wed Feb 24, 2010 2:45 pm

i have read it before when i was googling information. an inplace upgrade is nothing but reinstallation of the OS by entering the product key and it does not guarantee data deletion...data is deleted after all!

BTW, i think both my MFT and MFTMirr are corrupt bcos when i start

TestDisk > Advanced > Boot

I get:

Code: Select all

boot sector
status : ok

backup boot sector
status : ok

sectors are identical

and on using :

TestDisk > Advanced > Boot > Rebuild BS

I get:

Code: Select all

Partition                Start              End                 Size in Sectors
--------------------------------------------------------------------------
1* HPFS-NTFS      0  1  1       4868   254    63      78220422

Filesystem size : 78220422
sectors_per_cluster : 8
mft_lcn : 786432
mftmirr_lcn : 4888776
clusters_per_mft_record : -10
clusters_per_index_record : 1

Extrapolated boot sector and current boot sector are identical and ok.
from above if you see, mft_lcn & mftmirr_lcn sizes are different. And when i run :

TestDisk > Advanced > Boot > Rebuild MFT

i get :

Code: Select all

Fix MFT Mirror? (Y/N) dos mem corrupt, first_mcb=0253 
prev 0340:0000| 4d b7 05 00 00 00 00 00 00 00 00 00 00 00 00 00 ....... 
notMZ0341:0000| 46 49 4c 45 30 00 03 00 0f e5 63 51 00 00 00 00 ....... 

PANIC: MCB chain corrupted 
System halted 
Now this indicates that both the Master File Table and the Master File Table Mirror are corrupt, otherwise if one of them was ok, it would have replaced the corrupt one with the good one....just an assumption...

Hope somebody enlightens me on this and also lets me know how to find which one is Ok and which one is not....

What is the option (other than format) to be used in such a scenario?

How to repair or rebuild MFT, if both its current n mirror tables are corrupt?

Hope there is some one out there who has already solved this mystery without deleting any data in the bargain... :)
Regards,


Sifar
_________

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#8 Post by Icecube » Wed Feb 24, 2010 3:18 pm

You better ask the testdisk developer what you can do the best.
You better use a more recent version of testdisk too.
Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/

sifar786
Posts: 6
Joined: Tue Feb 23, 2010 2:37 pm

#9 Post by sifar786 » Wed Feb 24, 2010 3:28 pm

i dont have the email address of the testdisk developer. If you have, please post it here for me...

i have downloaded and used the latest version of testdisk...same results..
Regards,


Sifar
_________

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#10 Post by Icecube » Wed Feb 24, 2010 3:35 pm

Download Ultimate Boot CD v5.0: http://www.ultimatebootcd.com/download.html
Use Parted Magic for handling all partitioning task: http://partedmagic.com/

sifar786
Posts: 6
Joined: Tue Feb 23, 2010 2:37 pm

#11 Post by sifar786 » Thu Feb 25, 2010 12:17 pm

well, i havent received any reply from the testdisk developer....right now i got a 20gb hdd from a friend...loaded windows xp in it as master and the corrupted 40gb hdd as slave....the corrupted one gets detected in bios but when i load windows xp in 20gb hdd, it was visible for a few minutes and then got a windows msg saying its corrupted and the hdd dissapeared....now i am not able to see it at all in windows explorer on subsequent reboots.....what should i do? i was able to view the files and folders for the few minutes it was visible....
Regards,


Sifar
_________

StopSpazzing
Posts: 462
Joined: Tue Sep 09, 2008 4:37 pm
Location: California, USA
Contact:

#12 Post by StopSpazzing » Sun Feb 28, 2010 10:48 pm

Boot Knoppix and mount the drive. Normally, Knoppix can mount anything corrupted or not. COPY all important data OFF of the HD to USB or ANOTHER HD to prevent any data loss (example: docs pics and anything you cant not replace). This is what I found on how to repair the MFT: http://www.cgsecurity.org/wiki/Advanced ... MFT_Repair

I would STILL HIGHLY recommend you delete the partition using any program and then format the drive as ntfs (full format) then Delete it AGAIN, and only then reinstall windows on that drive after doing ANOTHER full ntfs format when installing windows (gives you an option when formatting). You need to be very careful, because just reinstalling windows after a virus infection this bad, could just allow the virus to come back...and "deleted" partitions are just partitions marked as deleted...not actually removed from the drive and unrecoverable.
~Just StopSpazzing~

Visit the UBCD Wiki: http://wiki.ultimatebootcd.com
Please check your UBCD ISO MD5 Hash Sum; May prevent issues later on by not having an exact copy.

Currently Working on Common Issues and Repair Tips on the Wiki.

Locked