Home \ Archive \ How do I repair the MFT on an NTFS partition?

How do I repair the MFT on an NTFS partition?

ZAR has been discontinued
After about twenty years, I felt ZAR can no longer be updated to match the modern requirements, and I decided to retire it.

ZAR is replaced by Klennet Recovery, my new general-purpose DIY data recovery software.

If you are looking specifically for recovery of image files (like JPEG, CR2, and NEF), take a look at Klennet Carver, a separate video and photo recovery software.
Question
Do you know of any software that will repair the MFT? Chkdsk is reporting

CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap.
and other errors. But it does not fix it when running chkdsk /f or /r on a boot. another note....I have tried a zillion things to fix this and nothing has worked....
the problem seems to be not a virus or rootkit, but a problem in the NTFS system itself.
I'm not sure where to start.....can you point me to instructions?
Answer
ZAR does not repair the partition. It copies data to another, known-good partition.

Trying to repair the MFT is not always safe. In some cases, it is possible that the repair attempt would actually make things worse. Even CHKDSK can sometimes aggravate the problem.

It is almost always better to make a copy of the data, reformat the volume, and copy the data back to it.

Start with the Unformat tutorial.
Demo version will allow you to copy a limited amount of files, available for download here.
Question
The problem is my c: drive (primary partition), which is the boot drive (partition) and is where the operating system is (Windows XP). That is where I'm getting the CHKDSK errors...when the machine is up and running.

The other partitions (D, E, F) on the same hard drive do not have CHKDSK errors.

I have run CHKDSK /r C: from the command console during the boot and it sometimes finds errors. If I run it a second time in the command console there are no errors.

Is there no problem?
Answer
It is normal for chkdsk report errors on a volume on which an operating system resides. This is because the OS is doing something in parallel with a chkdsk analysis, and what chkdsk reports as errors, are just modifications made to the volume while chkdsk runs. Chkdsk requires exclusive access for precise verification and repairs, but you cannot get it on a system volume when system runs.

Because of that, you cannot run chkdsk /F against the system volume other than upon reboot. Only upon reboot, chkdsk gets an exclusive access and can properly check and fix the volume.

This boils down to understanding CHKDSK
  1. It is normal to have a chkdsk complain about filesystem if you run it within Windows. Furthermore, it is normal to have different error messages every run.
  2. It is acceptable to have a chkdsk complain and fix the errors upon reboot once in a while. If you immediately run CHKDSK /F once again, and immediately reboot, there should be no errors reported during that second pass; or otherwise you have a problem.
And anyway the chkdsk issues should be rare, in order of one in several month (except for "minor inconsistences"; when it complains about "minor inconsistences", you just ignore it). If it is more often then that, you should start looking for a reason.
Copyright © 2001 - 2024 Alexey V. Gubin.