nneonneo / ntfsrecover

NTFS data-recovery program written in Python
118 stars 38 forks source link

$MFT truncated saving MFT #8

Open radiolondra opened 3 years ago

radiolondra commented 3 years ago

OS: Windows 10 Disk: 0 Partition 1

python ntfsrecovery.py \\.\Harddisk0Partition1 --save-mft mft

Reading MFT
Loading MBR from cluster 46848
WARNING: Failed to load $MFT ($MFT truncated), proceeding with partial MFT.
Parsing MFT: Done!
$MFT
$MFTMirr
$LogFile
$Volume
$AttrDef

$Bitmap
$Boot
$BadClus
$Secure
$UpCase
$Extend
$Extend/$Quota
$Extend/$ObjId
$Extend/$Reparse
$Extend/$RmMetadata
$Extend/$RmMetadata/$Repair
$Extend/$Deleted
$Extend/$RmMetadata/$TxfLog
$Extend/$RmMetadata/$Txf
$Extend/$RmMetadata/$TxfLog/$Tops
$Extend/$RmMetadata/$TxfLog/$TxfLog.blf
$Extend/$RmMetadata/$TxfLog/$TxfLogContainer00000000000000000001
$Extend/$RmMetadata/$TxfLog/$TxfLogContainer00000000000000000002
Boot
Boot/bg-BG
Boot/bg-BG/bootmgr.exe.mui
Boot/BOOTSTAT.DAT
Boot/BCD
Boot/bootuwf.dll
Boot/bootvhd.dll
Boot/cs-CZ
Boot/cs-CZ/bootmgr.exe.mui
Boot/cs-CZ/memtest.exe.mui
Boot/da-DK
Boot/da-DK/bootmgr.exe.mui
Boot/da-DK/memtest.exe.mui
Boot/de-DE
Boot/de-DE/bootmgr.exe.mui
Boot/de-DE/memtest.exe.mui
Boot/el-GR
Boot/el-GR/bootmgr.exe.mui
Boot/el-GR/memtest.exe.mui
Boot/en-GB
Boot/en-GB/bootmgr.exe.mui
Boot/en-US
Boot/en-US/bootmgr.exe.mui
Boot/en-US/memtest.exe.mui
Boot/es-ES
Boot/es-ES/bootmgr.exe.mui
Boot/es-ES/memtest.exe.mui
Boot/es-MX
Boot/es-MX/bootmgr.exe.mui
Boot/et-EE
Boot/et-EE/bootmgr.exe.mui
Boot/fi-FI
Boot/fi-FI/bootmgr.exe.mui
Boot/fi-FI/memtest.exe.mui
Boot/fr-CA
Boot/fr-CA/bootmgr.exe.mui
Boot/fr-FR
Boot/fr-FR/bootmgr.exe.mui
Boot/fr-FR/memtest.exe.mui
Boot/hr-HR
Boot/hr-HR/bootmgr.exe.mui
Boot/hu-HU
Boot/hu-HU/bootmgr.exe.mui
Boot/hu-HU/memtest.exe.mui
Boot/it-IT
Boot/it-IT/bootmgr.exe.mui
Boot/it-IT/memtest.exe.mui
Boot/ja-JP
Boot/ja-JP/bootmgr.exe.mui
Boot/ja-JP/memtest.exe.mui
Boot/ko-KR
Boot/ko-KR/bootmgr.exe.mui
Boot/ko-KR/memtest.exe.mui
Boot/lt-LT
Boot/lt-LT/bootmgr.exe.mui
Boot/lv-LV
Boot/lv-LV/bootmgr.exe.mui
Boot/memtest.exe
Boot/nb-NO
Boot/nb-NO/bootmgr.exe.mui
Boot/nb-NO/memtest.exe.mui
Boot/nl-NL
Boot/nl-NL/bootmgr.exe.mui
Boot/nl-NL/memtest.exe.mui
Boot/pl-PL
Boot/pl-PL/bootmgr.exe.mui
Boot/pl-PL/memtest.exe.mui
Boot/pt-BR
Boot/pt-BR/bootmgr.exe.mui
Boot/pt-BR/memtest.exe.mui
Boot/pt-PT
Boot/pt-PT/bootmgr.exe.mui
Boot/pt-PT/memtest.exe.mui
Boot/qps-ploc
Boot/qps-ploc/bootmgr.exe.mui
Boot/qps-ploc/memtest.exe.mui
Boot/qps-plocm
Boot/qps-plocm/bootmgr.exe.mui
Boot/ro-RO
Boot/ro-RO/bootmgr.exe.mui
Boot/ru-RU
Boot/ru-RU/bootmgr.exe.mui
Boot/ru-RU/memtest.exe.mui
Boot/sk-SK
Boot/sk-SK/bootmgr.exe.mui
Boot/sl-SI
Boot/sl-SI/bootmgr.exe.mui
Boot/sr-Latn-RS
Boot/sr-Latn-RS/bootmgr.exe.mui
Boot/sv-SE
Boot/sv-SE/bootmgr.exe.mui
Boot/sv-SE/memtest.exe.mui
Boot/tr-TR
Boot/tr-TR/bootmgr.exe.mui
Boot/tr-TR/memtest.exe.mui
Boot/uk-UA
Boot/uk-UA/bootmgr.exe.mui
Boot/zh-CN
Boot/zh-CN/bootmgr.exe.mui
Boot/zh-CN/memtest.exe.mui
Boot/zh-TW
Boot/zh-TW/bootmgr.exe.mui
Boot/zh-TW/memtest.exe.mui
bootmgr
Boot/Fonts
Boot/Fonts/chs_boot.ttf
Boot/Fonts/cht_boot.ttf
Boot/Fonts/jpn_boot.ttf
Boot/Fonts/kor_boot.ttf
Boot/Fonts/malgunn_boot.ttf
Boot/Fonts/malgun_boot.ttf
Boot/Fonts/meiryon_boot.ttf
Boot/Fonts/meiryo_boot.ttf
Boot/Fonts/msjhn_boot.ttf
Boot/Fonts/msjh_boot.ttf
Boot/Fonts/msyhn_boot.ttf
Boot/Fonts/msyh_boot.ttf
Boot/Fonts/segmono_boot.ttf
Boot/Fonts/segoen_slboot.ttf
Boot/Fonts/segoe_slboot.ttf
Boot/Fonts/wgl4_boot.ttf
Boot/Resources
Boot/Resources/bootres.dll
Boot/Resources/en-US
Boot/Resources/en-US/bootres.dll.mui
BOOTNXT
Boot/BCD.LOG
Boot/BCD.LOG1
Boot/BCD.LOG2
BOOTSECT.BAK
System Volume Information
System Volume Information/tracking.log
Recovery
Recovery/Logs
Recovery/WindowsRE
Recovery/WindowsRE/Winre.wim
Recovery/WindowsRE/boot.sdi
Recovery/WindowsRE/ReAgent.xml
Boot/bootmgr
Boot/bootnxt

No files are got in the mft copy and obviously nothing is recovered. This happens in ALL my PCs / Disks Any idea?

babam86 commented 3 years ago

Same issue, unable to get MFT on sda2 (on Windows it's drive C:)

sudo python ntfsrecover.py --save-mft mft /dev/sda2

Reading MFT
Loading MBR from cluster 786432
WARNING: Failed to load $MFT ($MFT truncated), proceeding with partial MFT.

Parsing MFT: 0/984
Parsing MFT: 791/984
Parsing MFT: Done!              
$MFT
$MFTMirr
$LogFile
$Volume
$AttrDef

$Bitmap
$Boot
$BadClus
$Secure
$UpCase
$Extend