Fix MFT Mirror? error

[sifar786]

Hi,

recently my winxp sp3 NTFS system got infected by a virus and soon it was not booting again. I repaired the system using a winxp sp3 cd, used bootcfg / rebuild, fixmbr, fixboot..etc....but still not booting....

finally, I had to resort to my UBCD TestDisk....
It shows all Files OK and Boots OK... I am able to browse my files too....
But when i use the Analyse option > Fix MFT, i get an error:

Code: Select all

Fix MFT Mirror? (Y/N) dos mem corrupt, first_mcb=0253
prev 0340:0000| 4d b7 05 00 00 00 00 00 00 00 00 00 00 00 00 00 .......
notMZ0341:0000| 46 49 4c 45 30 00 03 00 0f e5 63 51 00 00 00 00 .......

PANIC: MCB chain corrupted
System halted

What is wrong here? and why does my HDD not boot ? what do the above messages mean? can someone enlighten me on this? What is the right or alternative method to make my HDD boot my OS again?

I dont want to format my HDD as i have a lot of important data and applications and it will take me ages to install them again...and i dont have an additional external drive to use GetDataBack to backup my files.

Please advice ASAP.

[Icecube]

Did you try to run chkdsk from the recovery console?

Code: Select all

chkdsk /f

http://www.microsoft.com/resources/docu ... x?mfr=true

[sifar786]

Yes. thats the first thing i did from the recovery console....right now i just want to get my OS running (booting)....as of now after the initial CMOS screen, instead of getting OS boot options, i get a blank screen and the system halts...

[Icecube]

Repair your Windows installation:
viewtopic.php?t=2031&highlight=

[sifar786]

Code: Select all

I repaired the system using a winxp sp3 cd, used bootcfg / rebuild, fixmbr, fixboot..etc....but still not booting.... 

any better solution?? and anyone knows the meaning of the error i posted earlier?

[Icecube]

Read this link (better explained) to know how to repair a existing Windows installation (you need to apply windows updates again + installed programs are preserved):
http://michaelstevenstech.com/XPrepairinstall.htm

[sifar786]

i have read it before when i was googling information. an inplace upgrade is nothing but reinstallation of the OS by entering the product key and it does not guarantee data deletion...data is deleted after all!

BTW, i think both my MFT and MFTMirr are corrupt bcos when i start

TestDisk > Advanced > Boot

I get:

Code: Select all

boot sector
status : ok

backup boot sector
status : ok

sectors are identical

and on using :

TestDisk > Advanced > Boot > Rebuild BS

I get:

Code: Select all

Partition                Start              End                 Size in Sectors
--------------------------------------------------------------------------
1* HPFS-NTFS      0  1  1       4868   254    63      78220422

Filesystem size : 78220422
sectors_per_cluster : 8
mft_lcn : 786432
mftmirr_lcn : 4888776
clusters_per_mft_record : -10
clusters_per_index_record : 1

Extrapolated boot sector and current boot sector are identical and ok.

from above if you see, mft_lcn & mftmirr_lcn sizes are different. And when i run :

TestDisk > Advanced > Boot > Rebuild MFT

i get :

Code: Select all

Fix MFT Mirror? (Y/N) dos mem corrupt, first_mcb=0253 
prev 0340:0000| 4d b7 05 00 00 00 00 00 00 00 00 00 00 00 00 00 ....... 
notMZ0341:0000| 46 49 4c 45 30 00 03 00 0f e5 63 51 00 00 00 00 ....... 

PANIC: MCB chain corrupted 
System halted 

Now this indicates that both the Master File Table and the Master File Table Mirror are corrupt, otherwise if one of them was ok, it would have replaced the corrupt one with the good one....just an assumption...

Hope somebody enlightens me on this and also lets me know how to find which one is Ok and which one is not....

What is the option (other than format) to be used in such a scenario?

How to repair or rebuild MFT, if both its current n mirror tables are corrupt?

Hope there is some one out there who has already solved this mystery without deleting any data in the bargain...

[Icecube]

You better ask the testdisk developer what you can do the best.
You better use a more recent version of testdisk too.

[sifar786]

i dont have the email address of the testdisk developer. If you have, please post it here for me...

i have downloaded and used the latest version of testdisk...same results..

[Icecube]

At he bottom of http://www.cgsecurity.org/wiki/TestDisk

[sifar786]

well, i havent received any reply from the testdisk developer....right now i got a 20gb hdd from a friend...loaded windows xp in it as master and the corrupted 40gb hdd as slave....the corrupted one gets detected in bios but when i load windows xp in 20gb hdd, it was visible for a few minutes and then got a windows msg saying its corrupted and the hdd dissapeared....now i am not able to see it at all in windows explorer on subsequent reboots.....what should i do? i was able to view the files and folders for the few minutes it was visible....

[StopSpazzing]

Boot Knoppix and mount the drive. Normally, Knoppix can mount anything corrupted or not. COPY all important data OFF of the HD to USB or ANOTHER HD to prevent any data loss (example: docs pics and anything you cant not replace). This is what I found on how to repair the MFT: http://www.cgsecurity.org/wiki/Advanced ... MFT_Repair

I would STILL HIGHLY recommend you delete the partition using any program and then format the drive as ntfs (full format) then Delete it AGAIN, and only then reinstall windows on that drive after doing ANOTHER full ntfs format when installing windows (gives you an option when formatting). You need to be very careful, because just reinstalling windows after a virus infection this bad, could just allow the virus to come back...and "deleted" partitions are just partitions marked as deleted...not actually removed from the drive and unrecoverable.