New
#21
TestDisk Step By Step - CGSecurity section "NTFS Boot sector recovery". Is Boot sector OK? Backup Boot sector OK? Are they the same?
Recovering An NTFS Boot Sector On An NTFS Partition Using Its Backup
TestDisk can use the backup boot sector to fix a corrupted NTFS boot sector. The primary boot sector is sector zero of the filesystem and the backup NTFS boot sector is located near the end of the filesystem. Even if the boot sector is accidentally overwritten, the backup should be intact. TestDisk checks the boot sector and the backup boot sector. If the boot sector and backup boot sector mismatch, you can
Dump can used to display the boot sector content in both hexadecimal and ASCII. If there is no valid boot sector available, TestDisk can still rebuild an NTFS boot sector.
- restore the NTFS boot sector from its backup (Backup BS) or;
- update the backup NTFS boot sector with the current boot sector (Org. BS).
Rebuilding An NTFS Boot Sector On An NTFS Partition
If both NTFS boot sectors are corrupted and you need to rebuild the NTFS boot sector, TestDisk searches the MFT (Master File Table: $MFT) and its backup ($MFTMirr). It reads the MFT record size, it computes the cluster size, and it reads the size of the Index Allocation Entry in the root directory index. Using all these values, TestDisk can provide a new boot sector. Finally it lets the user list the files before writing.
Repair An NTFS MFT
The MFT (Master File Table) is sometimes corrupted. If Microsoft's Checkdisk (chkdsk) failed to repair the MFT, run TestDisk. In the Advanced menu, select your NTFS partition, choose Boot, then Repair MFT. TestDisk will compare the MFT and MFT mirror (its backup). If the MFT is damaged, it will try to repair the MFT using the backup. If the MFT backup is damaged, it will use the main MFT.