We received a Hitachi Travelstar hard disk drive in NTFS format with a corrupt master file table (MFT). Visual examinations of the drive showed the warranty seals were intact. The drive was opened in the clean room, where further examination under a microscope determined that it was suffering from internal mechanical failure causing physical media damage to the MFT.

The log file records each file and directory on the volume, much like an index. The MFT allocates a certain amount of space for each file record, detailing the attributes of each. Without these MFT records, files are a series of meaningless binary code. It is these records, which have been physically destroyed and need to be rebuilt. Unfortunately, no data can be retrieved until the master file table has been rebuilt.

Rarely does a MFT become corrupted. NTFS stores a copy of MFT that is called MFT mirror. If problem occurs, NTFS tries to synchronize these copies. However in this instance the damage was serious and standard utilities like CHKDSK and Recovery Console would not work.

The client was only looking for the PST file and the rest of the data was not required. Unfortunately there are no data recovery techniques, which will allow a partial recovery of selected files, without first rebuilding the master file table. Once we had repaired the hard drive we bypassed the bad sectors and imaged the data. Using a third party utility we were able to rebuild the MFT and access the PST file which was subsequently FTP to the client.