V
V
VT1002021-09-10 23:39:43
NTFS
VT100, 2021-09-10 23:39:43

Killed MFT in NTFS partition? Can I restore?

I made a mistake in one digit and copied 1 MB under the "penguin" instead of the beginning of the disk (SDx) to the partition with the NTFS system (SDx1). Questions:

  • There immediately from the beginning of the section was MFT?
  • If so, is it possible and how to restore it from a copy? MirrorMFT, like?
  • While I'm driving home to dig through the documentation - where can I read "about NTFS for dummies?


PS The answer "reinstalling Windows" is not considered due to the obviousness. This is clearly a plan B.

Answer the question

In order to leave comments, you need to log in

3 answer(s)
Z
Zettabyte, 2021-09-11
@VT100

Killed MFT in NTFS partition?

They could have damaged the ITF, they could not - not a fact. Guessing in this case, in my opinion, does not make sense.
If so, is it possible and how to restore it from a copy?

MFT has no copies. FAT has copies.
NTFS has copies of the first four entries.
In Windows 8 and above, there are copies of old entries, but they often only get in the way.
Apparently, these are the files that have changed frequently. But these are separate records and there are usually few of them.
There are also logs, but you are unlikely to do anything with them yourself, and I don’t know about custom software that could collect something from them, only professional complexes.
According to the logs, HFS is well assembled. But these are also old records and generally a separate conversation :)
Can I restore?

It is difficult to speak about the restoration of the MFT blindly, but you can get the information.
Connect the drive to another computer, grab a free data recovery program , extract it to another drive (no installation needed), and do a full scan of yours. You cannot write to your disk.
The result will be better than free programs (Recuva, testdisk) and at the level of the best paid programs (r-studio, etc.). If nothing else was done to the disk, except for writing 1 MB, then the chance to pull out all the files should be very high.

A
Armenian Radio, 2021-09-10
@gbg

There is a copy in the middle of the disk. testdisk or rstudio should fix just about everything.

M
Maxim Yaroshevich, 2021-09-23
@YMax

There is no backup - the data is not important, cannot be restored.
Cruel, but only right. You can restore normally only from a backup copy, the rest is a lottery with an unclear result.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question