chkdsk is reporting that there was an error reading part of the Master File Table. A small number of ‘segments’ is a repairable file system. Hundreds represents a bad disk and running chkdsk further damages it.
Each segment is a 1 KB record describing each file. A very small number of segments represent localised failure. An excessive number of segments indicates the sector(s) containing the table are failing throughout the disk.
The Master File Table (MFT) is stored in NTFS as multiple file records, each being 1KB in size, with each containing information about an object, such as name, timestamp, permissions and which cluster(s) contain the actual data for the object. When ChkDsk reports that a record (segment 12345) is “unreadable”, this simply means that ChkDsk requested the record from the disk and received invalid data.
The file content almost always remains on the disk. It just needs an entry in the Master File Table to tell Windows where to find it. Most of the time this situation is recoverable; but if you fix it using the wrong technique, you may lose that option.
A handful of files during the course of what is typically a silent, speedy drive generally indicates localised corruption. This could have been caused by a loss of power, a crash, etc. If you use “chkdsk”, this may correct the problem. You can continue using your computer for many years afterward.
Hundreds or thousands of corrupted files in a row, where the drive appears to be working at a crawl (slowly) and/or is making noise while running, tells us that there is some sort of physical issue affecting the sectors of the disk which hold the master file table. This is a physical condition and will spread. It will never be corrected through any software fix. To determine if you are experiencing this type of failure, check for consistency. Run another “chkdsk” and note how many errors were found. A good disk should report the same small number each time, while a failing one reports more.
The main reason chkdsk exists is to create a good file system. Wherever chkdsk can’t read an entry in the directory, it will remove this entry from the list or truncate the file. This may be acceptable on healthy disks but on a failing drive, this removes entries that could potentially be recovered using other parts of the same disk. It also takes a lot longer to do its work because it does a complete surface scan (hours of reading all sectors) when you select the /r option which further complicates the problem since it is doing even more work on a disk that is having trouble getting to the entries needed to recover files.
Numbered .chk files show up in found.000 which preserve the content of what was lost but eliminate all information about the original file names and structure.
Copy irreplaceable items off the failed drive while it can still be read, before running anything else, to prevent loss of critical information. Once you have removed all of the important data do not use the drive again. The process of recovery involves reading the entire drive (even though it is failing) and making an exact bit-for-bit, read-only image of the device with hardware designed specifically for this purpose. From that image you will then rebuild the Master File Table (MFT) so that you can access your files. Alternatively, if the MFT is damaged beyond recognition, you may need to “carve” out individual files based upon their signatures (the way they begin).
A single drive costs from £300 +VAT after a complimentary 48-hour diagnostic period has passed. In addition, in most cases you only pay if we recover your data. Please send the drive itself, without the computer or other equipment.
When CHKDSK could not read a 1 KB record in the NTFS Master File Table (which describes each file, including its name, time stamps, etc., and tells Windows exactly where to find the file’s contents), the actual contents of the file were probably still available on the disk; it just could not locate the “pointer” that told it how to get there.
That depends on the number. Several files on a drive that is otherwise quick and quiet are usually corrupted from an improper shutdown, but hundreds of them with your disk scan crawling indicates that the sectors containing your file table are failing. That would be considered a physical problem and it spreads.
Only if the count is small and the drive is healthy. If you have a few errors but your disk drive itself is good then using chkdsk /r will rebuild your file system by removing all unrecoverable information from un-readable areas of your disk. However, this is not a good idea when dealing with multiple failure points or a physically failing disk. Using this tool is simply going to put additional wear/tear on the drive and prolong the inevitable.
These are fragments recovered by chkdsk, but those fragments did not match up with filenames and were saved as numbered files. Those fragments may contain the actual information (the data) but they do not contain enough information about where each piece of information belongs in terms of naming and organisation of folders, which is exactly how things go down when your computer cannot access the record for the filename itself.
Generally. The drive is imaged in read-only mode through all the bad sectors. Then, an attempt will be made to rebuild the Master File Table (MFT) using the copy; or if the MFT cannot be restored, files can be carved based upon signatures from the remaining good parts of the image. Single drive recovery prices are from £300 + VAT after a complimentary 48-hour diagnostic.