In the same way that a printed book will have a contents page and index – an NTFS (Windows Formatted) hard disk uses what is known as a Master File Table (MFT). This file, usually 1024 bytes in size, stores information about every file such as its name, size, timestamps and other file attribute information. It also contains “pointers” which help your hard disk find data on your hard disk. It is perhaps one of the most important files on your hard disk. In hard disk volumes using FAT and FAT32, the MFT shares the same function as the File Allocation Table.
The MFT ($MFT) file was designed with disk access speed in mind because all the file metadata is stored on contiguous blocks. This, for example, saves the operating system having to parse through every file on the disk for a command such as simple file search.
However, underlying disk problems can result in a corrupt MFT. Such problems might be precipitated by a malfunctioning bus controller on a host system. Or sometimes, malfunctioning disk firmware corrupts data or writes data to the wrong location. Moreover, power surges, bad sectors, platter scratches and non-repeatable runout errors can all lead to MFT problems.
Chkdsk will be able to repair some disk issues, but in some cases, it will do more harm than good. Chkdsk will typically run “type checking”. This checks whether the disk cluster conforms to footprint of data type. “Sanity checking” will also be performed, verifying that the data structures meet the normal parameters of the NTFS file system. For example, it will check the metadata location of the boot sector to validate pointer integrity. If this utility does find errors, it can refer back to $MFTmirror (which acts an MFT backup) to reinstate files. However, this will not always work.
Last week, we recovered data from a Seagate Free Agent external USB disk. The NTFS formatted disk was inaccessible. The user let Chkdsk (Checkdisk) run when their Windows 10 computer started up. But, alas, it seemed to have complicated issues. The user received the rather ominous sounding error message:
“Windows cannot recover the master file table. Chkdsk aborted”
On recommendation of a colleague, he brought his disk to Drive Rescue. The disk was exhibiting multiple problems with bad sectors and firmware. Once these issues had been resolved, the volume was still inaccessible. On further analysis, we found that the disk’s MFT pointer files, namely, RootSecDesc and DirIndxbuf files were corrupted. These files had to be reinstated manually using a hex editor. All Word, Excel, .avi and almost 9 years of worth of priceless photos were recovered.
Drive Rescue offer a complete data recovery service for Seagate Free Agent external hard disks such as the Seagate Free Agent Desktop 500GB, Seagate Free Agent Pro 750GB, Seagate Free Agent Go 1000GB and Seagate FreeAgent GoFlex 500GB and 1000GB models. Our Seagate data retrieval service is based in Dublin, Ireland.