Previously, we have discussed how to expand the NTFS partition manually if the first MFT record is available (can be read). But what should you do if the first MFT record is damaged and you can’t expand the NTFS partition manually?

在前面，我們討論了如何在第一個MFT記錄可用時手動擴展NTFS分區(qū)(可以讀取)。但是，如果第一個MFT記錄被損壞，并且無法手動擴展NTFS分區(qū)，該怎么辦呢

Let’s find it out!

In this particular ?case, we have a drive without any firmware issues – all modules are OK, heads are in good condition, the translator is ok and allows to read the whole User Area. But the surface is heavily damaged by heads. As a result, you won’t be able to expand the partition with files and folders in the Data Extractor:

在這種情況下，我們的驅(qū)動器沒有任何固件問題-所有模塊都正常，磁頭狀態(tài)良好，轉(zhuǎn)換器正常，并允許讀取整個用戶區(qū)。但是表面被頭部嚴重損壞。結果，您將無法使用Data Extractor擴展分區(qū)的文件和文件夾：

…and read the first MFT record:

并讀取第一個MFT記錄

If you try to expand the partition, the Root DE will start to read the first sector of the MFT table that it takes from the partition’s Boot record. Thus, you will know the first LBA of the MFT table (that can’t be read).

如果嘗試擴展該分區(qū)，則根DE將開始讀取該MFT表從分區(qū)的Boot記錄中獲取的第一個扇區(qū)。因此，您將知道MFT表的第一個LBA（無法讀?。?。

Check the next sectors with a “FILE0” signature:

檢查帶有FILE0簽名的下一個扇區(qū)

The sector with such signature contains the info on the File/Folder. Check the next sectors for such signature. The exact number of these sectors depends on the number of files/folders on your drive.

具有此類簽名的扇區(qū)包含有關文件/文件夾的信息。 檢查下一個扇區(qū)是否有這種簽名。 這些扇區(qū)的確切數(shù)量取決于驅(qū)動器上文件/文件夾的數(shù)量。

The drive from our example has the signature (the MFT records) from 6 291 520 LBA till 6 314 010 LBA. Read all the sectors of this chain as deep as possible:

Launch the RAW recovery scan for this chain:

…and open the map of found MFT records:

Of course, you may simply launch RAW recovery and start from this step but the RAW recovery scan will read all the sectors “as is” (using the maximal reading speed, without hardware retries, any resets and other DE settings) and if your drive has problems with the surface the basic RAW scan of the whole User Area will take a lot of time and completely ?spoil the drive.

Save the chains of the found MFT records:

…and return back to the partition tree.

Use the right mouse click on the NTFS partition and load the MFT table from the saved file:

After that all the options that belong to the MFT scans will be active:

And you will be able to try to expand the original partition “as is”:

Please note, that the RAW scan had been performed on red sectors only that’s why the “work with copy only’” option was enabled. Now you can disable this option and ‘refresh’ the partition. The utility will read other sectors that belong to the partition, all the files and folders (including other parts of the MFT and the INDX-records):

The partition structure is now available!

It’s hard to say whether it’s the full partition with all files and folders or not. But using this method you may investigate these folders/files, read directly necessary data and use all possible scans for researching.

轉(zhuǎn)載請注明：成都千喜數(shù)據(jù)恢復中心 » 使用PC-3000處理有壞道的$Mft表