Corrupt NTFS partition's MFT – Which tool is right? What tool to fix?

I used Avira Rescue Disk (Ubuntu 12.04) to access a broken NTFS boot partition. Windows 7 fails to mount it: it displays a bluescreen ("UNMOUNTABLE_BOOT_VOLUME") and restarts immediately. With the Rescue Disk I could backup the most important data (Ubuntu does not fail on mounting). Now I tried gparted to fix the partition. To analyse the partition, gparted runs a scanning-only ntfsresize first.

A similar (= non-writing) but manual run of ntfsresize -info --force /dev/sda3 gives:

ntfsresize v2012.1.15AR.1 (libntfs-3g)
Device name : /dev/sda3
NTFS volume version: 3.1
Cluster size : 4096 bytes
Current volume size: 484336226816 bytes (484337 MB)
Current device size: 484336230400 bytes (484337 MB)
Checking for bad sectors ...
Checking filesystem consistency ... 0,00 percent completed
..
..
.. 12,83 percent completed
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73604 count=1 br=-1: Eingabe-/Ausgabefehler (= I/O error)
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73605 count=1 br=-1: Eingabe-/Ausgabefehler
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73606 count=1 br=-1: Eingabe-/Ausgabefehler
ntfs_attr_pread_i: ntfs_pread failed: Eingabe-/Ausgabefehler
Failed to read of MFT, mft=73607 count=1 br=-1: Eingabe-/Ausgabefehler 12,85 percent completed
..
..
.. 100.00 percent completed
Accounting clusters ...
Cluster accounting failed at 9962391 (0x980397): extra cluster in $Bitmap
..
..
..
Cluster accounting failed at 9963113 (0x980669): extra cluster in $Bitmap
Filesystem check failed! Totally 723 cluster accounting mismatches.
ERROR: NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
and will be made to NTFS by this software until it gets repaired.

So, the $MFT seems to be broken. However, ntfsfix --no-action /dev/sda3 (non-writing) states:

avira@avira:~$ sudo ntfsfix -n /dev/sda3
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
NTFS volume version is 3.1.
NTFS partition /dev/sda3 was processed successfully.

Whom can I trust? What really happened to my $MFT? Why can Ubuntu still read most of the files, and Win 7 fails to mount (expect from being Windows)? What tool should I use to fix the MFT: gparted or testdisk or ntfsfix (without --no-action) or chkdsk /f? Haven't felt lucky yet. I've read about testdisk being able to mess up $MFT and $MFTMirr in severe cases. Could that happen?

Additionally, SMART reports one bad sector (Reallocated Sectors Count = 1). Should I renew the disk in any event?

What can I run else to (at least) locate the error (e.g. affected filenames, electromechanical failure y/n?) better?

1 Answer

If the MFT$ file got corrupted, try R-STUDIO to rescue the data on that drive.

Important: Do not perform any write operation to the corrupted drive!

1. attach the corrupted drive to a working windows system
2. analyze the drive using r-studio
3. copy any good data to a new drive
4. delete all partitions on the corrupted drive ("old drive")
5. create a new partition on the old drive and format
6. use a tool of your choice to analyze the drives hardware, if required.

Done!