Previously, we have discussed how to expand the NTFS partition manually if the first MFT record is available (can be read). But what should you do if the first MFT record is damaged and you can’t expand the NTFS partition manually?
Let’s find it out!
In this particular case, we have a drive without any firmware issues – all modules are OK, heads are in good condition, the translator is ok and allows to read the whole User Area. But the surface is heavily damaged by heads. As a result, you won’t be able to expand the partition with files and folders in the Data Extractor:
…and read the first MFT record:
If you try to expand the partition, the Root DE will start to read the first sector of the MFT table that it takes from the partition’s Boot record. Thus, you will know the first LBA of the MFT table (that can’t be read).
Check the next sectors with a “FILE0” signature:
The sector with such signature contains the info on the File/Folder. Check the next sectors for such signature. The exact number of these sectors depends on the number of files/folders on your drive.
具有此类签名的扇区包含有关文件/文件夹的信息。 检查下一个扇区是否有这种签名。 这些扇区的确切数量取决于驱动器上文件/文件夹的数量。
The drive from our example has the signature (the MFT records) from 6 291 520 LBA till 6 314 010 LBA. Read all the sectors of this chain as deep as possible:
Launch the RAW recovery scan for this chain:
…and open the map of found MFT records:
Of course, you may simply launch RAW recovery and start from this step but the RAW recovery scan will read all the sectors “as is” (using the maximal reading speed, without hardware retries, any resets and other DE settings) and if your drive has problems with the surface the basic RAW scan of the whole User Area will take a lot of time and completely spoil the drive.
Save the chains of the found MFT records:
…and return back to the partition tree.
Use the right mouse click on the NTFS partition and load the MFT table from the saved file:
After that all the options that belong to the MFT scans will be active:
And you will be able to try to expand the original partition “as is”:
Please note, that the RAW scan had been performed on red sectors only that’s why the “work with copy only’” option was enabled. Now you can disable this option and ‘refresh’ the partition. The utility will read other sectors that belong to the partition, all the files and folders (including other parts of the MFT and the INDX-records):
The partition structure is now available!
It’s hard to say whether it’s the full partition with all files and folders or not. But using this method you may investigate these folders/files, read directly necessary data and use all possible scans for researching.