Previously, we have discussed how to expand the NTFS partition manually if the first MFT record is available (can be read). But what should you do if the first MFT record is damaged and you can’t expand the NTFS partition manually?

在前面，我们讨论了如何在第一个MFT记录可用时手动扩展NTFS分区(可以读取)。但是，如果第一个MFT记录被损坏，并且无法手动扩展NTFS分区，该怎么办呢

Let’s find it out!

In this particular  case, we have a drive without any firmware issues – all modules are OK, heads are in good condition, the translator is ok and allows to read the whole User Area. But the surface is heavily damaged by heads. As a result, you won’t be able to expand the partition with files and folders in the Data Extractor:

在这种情况下，我们的驱动器没有任何固件问题-所有模块都正常，磁头状态良好，转换器正常，并允许读取整个用户区。但是表面被头部严重损坏。结果，您将无法使用Data Extractor扩展分区的文件和文件夹：

…and read the first MFT record:

并读取第一个MFT记录

If you try to expand the partition, the Root DE will start to read the first sector of the MFT table that it takes from the partition’s Boot record. Thus, you will know the first LBA of the MFT table (that can’t be read).

如果尝试扩展该分区，则根DE将开始读取该MFT表从分区的Boot记录中获取的第一个扇区。因此，您将知道MFT表的第一个LBA（无法读取）。

Check the next sectors with a “FILE0” signature:

检查带有FILE0签名的下一个扇区

The sector with such signature contains the info on the File/Folder. Check the next sectors for such signature. The exact number of these sectors depends on the number of files/folders on your drive.

具有此类签名的扇区包含有关文件/文件夹的信息。 检查下一个扇区是否有这种签名。 这些扇区的确切数量取决于驱动器上文件/文件夹的数量。

The drive from our example has the signature (the MFT records) from 6 291 520 LBA till 6 314 010 LBA. Read all the sectors of this chain as deep as possible:

Launch the RAW recovery scan for this chain:

…and open the map of found MFT records:

Of course, you may simply launch RAW recovery and start from this step but the RAW recovery scan will read all the sectors “as is” (using the maximal reading speed, without hardware retries, any resets and other DE settings) and if your drive has problems with the surface the basic RAW scan of the whole User Area will take a lot of time and completely  spoil the drive.

Save the chains of the found MFT records:

…and return back to the partition tree.

Use the right mouse click on the NTFS partition and load the MFT table from the saved file:

After that all the options that belong to the MFT scans will be active:

And you will be able to try to expand the original partition “as is”:

Please note, that the RAW scan had been performed on red sectors only that’s why the “work with copy only’” option was enabled. Now you can disable this option and ‘refresh’ the partition. The utility will read other sectors that belong to the partition, all the files and folders (including other parts of the MFT and the INDX-records):

The partition structure is now available!

It’s hard to say whether it’s the full partition with all files and folders or not. But using this method you may investigate these folders/files, read directly necessary data and use all possible scans for researching.

转载请注明：成都千喜数据恢复中心 » 使用PC-3000处理有坏道的$Mft表