☰

以前の$ MFTでNTFSファイルシステムを初期化する

tag-icon • tag-icon filesystems partition ntfs partition-table
以前の$ MFTでNTFSファイルシステムを初期化する

パーティションテーブルが失われましたが、パーティションの1つがNTFSとしてフォーマットされました。 （他のエラーのため）機能しませんが、次のようにファイルシステムツリーを復元できますtestdisk。parted回復ビット。残念ながら、このプログラムは、$ MFTという名前の一部のファイルと、$で始まる一部のファイルを除いて、まだ圧縮されたデータを回復できません。

それでは、この情報を組み合わせて、この情報で新しいntfsファイルシステムを初期化してデータへの基本アクセスを有効にすることは可能ですか？ファイルシステムツリーは完全であり、以前と同じです。

編集する： 最初の1024バイトの16進ダンプ：

$ head -c 1024 \$MFT | od -A x -t x1z -v
000000 46 49 4c 45 30 00 03 00 36 14 09 05 00 00 00 00  >FILE0...6.......<
000010 01 00 01 00 38 00 01 00 98 01 00 00 00 04 00 00  >....8...........<
000020 00 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00  >................<
000030 1a 00 54 94 00 00 00 00 10 00 00 00 60 00 00 00  >..T.........`...<
000040 00 00 18 00 00 00 00 00 48 00 00 00 18 00 00 00  >........H.......<
000050 28 f1 05 f0 ff 41 d2 01 28 f1 05 f0 ff 41 d2 01  >(....A..(....A..<
000060 28 f1 05 f0 ff 41 d2 01 28 f1 05 f0 ff 41 d2 01  >(....A..(....A..<
000070 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000080 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00  >................<
000090 00 00 00 00 00 00 00 00 30 00 00 00 68 00 00 00  >........0...h...<
0000a0 00 00 18 00 00 00 03 00 4a 00 00 00 18 00 01 00  >........J.......<
0000b0 05 00 00 00 00 00 05 00 28 f1 05 f0 ff 41 d2 01  >........(....A..<
0000c0 28 f1 05 f0 ff 41 d2 01 28 f1 05 f0 ff 41 d2 01  >(....A..(....A..<
0000d0 28 f1 05 f0 ff 41 d2 01 00 40 00 00 00 00 00 00  >(....A...@......<
0000e0 00 40 00 00 00 00 00 00 06 00 00 00 00 00 00 00  >.@..............<
0000f0 04 03 24 00 4d 00 46 00 54 00 00 00 00 00 00 00  >..$.M.F.T.......<
000100 80 00 00 00 48 00 00 00 01 00 40 00 00 00 01 00  >....H.....@.....<
000110 00 00 00 00 00 00 00 00 7f 06 00 00 00 00 00 00  >................<
000120 40 00 00 00 00 00 00 00 00 00 68 00 00 00 00 00  >@.........h.....<
000130 00 00 68 00 00 00 00 00 00 00 68 00 00 00 00 00  >..h.......h.....<
000140 32 80 06 00 00 0c 00 00 b0 00 00 00 48 00 00 00  >2...........H...<
000150 01 00 40 00 00 00 05 00 00 00 00 00 00 00 00 00  >..@.............<
000160 01 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  >........@.......<
000170 00 20 00 00 00 00 00 00 08 10 00 00 00 00 00 00  >. ..............<
000180 08 10 00 00 00 00 00 00 21 02 ef 51 00 00 00 00  >........!..Q....<
000190 ff ff ff ff 00 00 00 00 ff ff ff ff 00 00 00 00  >................<
0001a0 00 00 04 00 00 00 00 00 31 40 00 00 0c 00 04 9c  >........1@......<
0001b0 b0 00 00 00 50 00 00 00 01 00 40 00 00 00 05 00  >....P.....@.....<
0001c0 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  >................<
0001d0 40 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00  >@........ ......<
0001e0 08 10 00 00 00 00 00 00 08 10 00 00 00 00 00 00  >................<
0001f0 31 01 ff ff 0b 11 01 ff 00 00 01 00 00 20 1a 00  >1............ ..<
000200 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0002a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0002b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0002c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0002d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0002e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0002f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
000390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0003a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0003b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0003c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0003d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0003e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >................<
0003f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00  >................<

そしてブートレコード（少なくともそれを願っています）

> allparts
Partition #0 -> Partition (NTFS, 1.82 TB, 4706 files, Recoverable, Offset: 2048, Offset (b): 1048576, Sec/Clus: 8, MFT offset: 6293504, MFT mirror offset: 2064)
Partition #1 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 316980352, MFT mirror offset: None)
Partition #2 -> Partition (NTFS, ??? b, 6 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 152503816, MFT mirror offset: None)
Partition #3 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 79517584, MFT mirror offset: None)
Partition #4 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 9717656, MFT mirror offset: None)
Partition #5 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 151669368, MFT mirror offset: None)
Partition #6 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 628571568, MFT mirror offset: None)
Partition #7 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 395066792, MFT mirror offset: None)
Partition #8 -> Partition (NTFS, ??? b, 15 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 1953514624, MFT mirror offset: None)
Partition #9 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 662340344, MFT mirror offset: None)
Partition #10 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 302860720, MFT mirror offset: None)
Partition #11 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10357512, MFT mirror offset: None)
Partition #12 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 77430456, MFT mirror offset: None)
Partition #13 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 85578480, MFT mirror offset: None)
Partition #14 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10767168, MFT mirror offset: None)
Partition #15 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 9717856, MFT mirror offset: None)
Partition #16 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 77101768, MFT mirror offset: None)
Partition #17 -> Partition (NTFS, ??? b, 4 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 1953514608, MFT mirror offset: None)
Partition #18 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 154535088, MFT mirror offset: None)
Partition #19 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 7725240, MFT mirror offset: None)
Partition #20 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 153627072, MFT mirror offset: None)
Partition #21 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10357624, MFT mirror offset: None)
Partition #22 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716195416, MFT mirror offset: None)
Partition #23 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 6514936, MFT mirror offset: None)
Partition #24 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 98269952, MFT mirror offset: None)
Partition #25 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716141024, MFT mirror offset: None)
Partition #26 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 6820112, MFT mirror offset: None)
Partition #27 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716178792, MFT mirror offset: None)
Partition #28 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 395876840, MFT mirror offset: None)
Partition #29 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 408808056, MFT mirror offset: None)
Partition #30 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 153921904, MFT mirror offset: None)
Partition #31 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10768552, MFT mirror offset: None)
Partition #32 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 621608448, MFT mirror offset: None)
Partition #33 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716169080, MFT mirror offset: None)
Partition #34 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 154558208, MFT mirror offset: None)

ベストアンサー1

残念ながら、このプログラムは、$ MFTという名前の一部のファイルと、$で始まるいくつかのファイルを除いて、まだ圧縮されたデータを回復できません。

RecuperaBitを作成しましたが、NTFS圧縮で保存されたファイルが読み取れないことを確認しました。例外はないことに注意してください。$MFTデフォルトのファイルテーブルを保持するファイルです（すべてのメタデータファイルはこのテーブルで始まり、圧縮されませ$んが、一部は希薄です）。

あなたの目標：

データへの基本アクセスを有効にするには、これらのファイルシステムを使用して新しいntfsファイルシステムを初期化します。

MFTが実際に破損している場合は実現できないようです。ただし、そうでない可能性があることに注意してください。 16進ダンプでは、最初の項目（最も重要な項目）が正しく表示されます。おそらく、次も良いでしょう。

パーティションテーブルを復元し、少なくとも1つのNTFSブートセクタを選択するだけです。通常、バックアップブートセクタはドライブの端に配置されているため、簡単に復元できます。

出力にはファイルシステムの正確なサイズが表示されます。番号はブートセクタから読み取られるので、まだそこにあることがわかります。

Partition #0 -> Partition (NTFS, 1.82 TB, 4706 files, Recoverable, Offset: 2048, Offset (b): 1048576, Sec/Clus: 8, MFT offset: 6293504, MFT mirror offset: 2064)

Testdiskをドライブの100％で実行すると、パーティションが見つかります。その後、Testdiskを使用してファイルを一覧表示および抽出できます。バックアップされたNTFSブートセクタを復元することも、パーティションの最初のセクタにフラッシュして手動で復元することもできます。

おすすめ記事