How restore a backed-up MFT? (Partition repair)

A forum on data recovery using the professional data recovery software R-STUDIO.
Golken

How restore a backed-up MFT? (Partition repair)

Post by Golken » Sat Nov 19, 2016 11:18 am

During the past year, I've now unluckily had 3 cases where partitions on separate disks have had their MFT (as well as the MFT Mirror, which isn't so useful anyway) corrupted, for separate reasons, with the data still present (and recoverable), but the partition itself, understandably, inaccessible until a reformat.

R-Studio is a great program in general. :) Relevantly, it allows backing up partition metadata, including fully backing up the $MFT (and $MFTMirror). I have taken to doing so, to help with any future headaches like those described above (of course, I know that a full partition content backup is preferable). However... I can't find a way in the program to actually restore said backups to a partition. So in the event that some partition of mine has its MFT go kaput, and I have a sufficiently recent backup, I don't actually know how to restore it, or apply it, to the partition, and overwrite its current, damaged MFT with the backup, either using R-Studio or any other program. I couldn't find a way, after extensive web searches - other than hex editing the partition and manually copying the MFT backup and modifying the partition records, which is too uncomfortable for me.

Is there a suitable function within R-Studio to do this (partition metadata restoration)? If not, I request that such a feature will be added.

Thanks for your time.

Data-Medics
Posts: 220
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: How restore a backed-up MFT? (Partition repair)

Post by Data-Medics » Mon Nov 21, 2016 11:02 am

I think a better question is, why would you want to do this? Just let R-Studio analyze the filesystem, find all the files, then copy it to a newly formatted drive. Writing any data back to an original drive you're recovering off of is just stupid and reckless. It's for good reason they designed R-Studio to never do any writes to the original drive except manually in HEX.

Golken

Re: How restore a backed-up MFT? (Partition repair)

Post by Golken » Fri Dec 02, 2016 4:37 am

I believe it should have been clear from what I wrote, but the purpose is to instantly restore a working partition to working order, making it usable again, in the possible event that the only thing keeping it from being normally accessible is a corrupted MFT. This isn't intended to be used on a problematic or failing drive, but on a partition whose metadata was unluckily randomly messed up due to a system crash, power loss, bad connectivity, software or driver error or whatever else. It may be worth mentioning that there are various programs and methods to determine whether your drive is failing and its health, so it's not even difficult to confirm.
Since R-Studio already has file scanning, including filename and path discovery, capabilities then it could also be possible to design this as R-Studio rebuilding the MFT using the files and folders found using that, even without a current backup.
By the way, IIRC I'm pretty sure you can restore using R-Studio to the same drive and even partition, if you answer that you're sure that's what you want to do. It's the user's choice and prerogative, and since R-Studio allows backing up partition metadata and MFT, it seems like a missing feature that it cannot be used to apply them. Other recovery programs already allow repairing broken partition metadata, but it doesn't seem like there's any that can really fix a bad $MFT (and $MFTMirror) when that's the missing part. A backup should be usable, in such a case.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: How restore a backed-up MFT? (Partition repair)

Post by Alt » Fri Dec 02, 2016 9:04 am

One wrong move, and you can destroy everything.

Post Reply