After I unplugged my external drive after a phony safe removal on Ubuntu, two sectors are destroyed. The important sector contained records 4 to 7 (which is $AttrDef, $ (root), $Bitmap and $Boot) of the NTFS MFT. The sector now gives an IO error and mounting the device is impossible this way.
I copied all other accessible bytes to files on a new external drive. The file system except for the MFT is intact, everything is there.
I’d like to know which method or tool exists to recreate, regenerate these MFT records? They are not mirrored so I could not imagine them being unrecoverable. I think of recomputing these records from the available residual files.
And if there is no tool like that could you provide me a site with enough information so that I could write a simple tool or script by my own?
I don’t care, whether it takes long or whether I have to traverse the whole rescued files.
Thank you very much!
