PC-3000 Forum

Hi,

I have a drive that allows me to see the NTFS partition but scan MFT is not available as an option. I have tried a couple of partition analysis but these have failed before completing due to other issues on our setup.

I saw a video on the youtube channel that showed this option to scan mft becoming available but the guy on there didnt really change anything, although he did mention about playing around with the timeout settings.

Does anyone know if there is a way to bring up the Scan MFT option when it isnt availabe. The drive reads the sectors ok with no bad sectors and it doesent look like its encrypted.

thanks in advance

Can the Boot sector read? Calculate position of first MFT record (Cluster number * sectors per cluster - offset) and check this first record reads ok.

I suspect either boot sector or first MFT sector is unread.

You can load MFT map from file and scan in cases where first record is unreadable.

Yeah i think the boot sector has read. I ran partition map on the NTFS partition and scanned Boot, Data and Boot copy. these all scanned ok.

I then tried running a raw recovery on it to see if I could get the mft that way but it didnt show up in the results.

Im not too sure on how to calculate the first mft record, ill have to do more research on that as fairly new to this. I know this not perhaps the quickest way but if I was to run a raw recovery on the whole drive it should technically be able to retrieve the MFT in the raw recovery shouldn't it as long as the drive is ok and its not been written over?

Common position for MFT record is 6293504 - look here for it