Does Macrium Reflect copy the MFT Bitmap during the imaging process? MFT corrupt

Topic

New Reply

Background…

I had a 2TB internal HDD that contained just data, no operating system. This was known as drive ‘D’. During an attempt to create a backup image of said drive, using Macrium Reflect version 7.3 (free edition) with default setting of ‘verify file system before backup’ checked, Macrium Reflect aborted with the message ‘Unable to read from disk – Error Code 23 – Data error (cyclic redundancy check).’ When I Googled this error it said I needed to run CHKDSK D: /R.

The first time I ran this (see attachment chkdsk d drive results 2022-03-30.txt), it said there were ‘bad clusters in user file data’ in two different folder locations on the ‘D’ drive. CHKDSK also stopped at the end of stage 4 reporting an error. I deleted the contents of the folders where there were bad clusters and then re-ran CHKDSK D: /R. This time, see (attachment chkdsk d drive results 2022-03-31.txt), it passed stage 4 without any problems and continued on and completed stage 5 successfully reporting that there were 5 bad clusters amounting to 20KB in bad sectors.

I was then able to successfully image the ‘D’ drive using Macrium Reflect. Several days later this HDD died.

I then physically removed the ‘D’ drive from my PC, and installed a brand new internal HDD into my PC. I then successfully restored the image of my ‘D’ drive onto this new HDD. When I ran CHKDSK on this new HDD (see chkdsk d drive results 2022-05-18 (new WD Red HDD).txt), I was surprised to see there were 20KB in bad sectors.

Does Macrium Reflect copy the MFT Bitmap as part of the imaging process? And if so, how do I overcome this on the brand new physical HDD which presumably should be in perfect condition? Can I get Windows to make a new MFT Bitmap based on the brand new physical HDD? Once again Macrium Reflect won’t allow me to make a backup image of my (new) ‘D’ drive, stating ‘MFT corrupt – Error code = 6. Please run chkdsk D: /r’ presumably because of these bad sectors.

Any help/advice you can give me, would be greatly appreciated.

1 user thanked author for this post.

windbg

Reply | Quote

Replies

bumblebee wrote:

error (cyclic redundancy check)

This means your disk is dying and needs replacing immediately. Modern hard disks are self checking and correcting so you should never see CRC errors. CHKDSK errors confirm this diagnosis.

bumblebee wrote:

I was surprised to see there were 20KB in bad sectors

You would not expect bad sectors on a new disk – was it actually new?

I suspect the errors are in your disk controller / cable as that is the common component.
Do you have another cable you can test?
Are you able to test the new disk in another machine?

cheers, Paul

Reply | Quote

I didn’t realise the bad sectors already existed. This may or may not be caused by the disk subsystem. I would run a CHKDSK /B to re-evaluate the bad sectors, then CHKDSK /R to test the entire disk (this will be very slow).

cheers, Paul

Reply | Quote

RE  ‘You would not expect bad sectors on a new disk – was it actually new?’

Yes, brand new. I ordered it directly from Western Digital themselves.

I’ll try the ‘B’ and ‘R’ switches as you suggest and report back.

Many thanks.

Reply | Quote

@Paul-T –

Please correct me if I’m wrong, but I thought that a disk image that is taken is just like taking a photo of the drive’s contents/data, warts and all.

That would mean that since @bumblebee took the image after completing a chkdsk routine that said there were 20k of data in bad sectors

it passed stage 4 without any problems and continued on and completed stage 5 successfully reporting that there were 5 bad clusters amounting to 20KB in bad sectors.

I was then able to successfully image the ‘D’ drive using Macrium Reflect.

those sectors would then be copied onto the new, essentially pristine, drive because they were contained in that image, right?

Reply | Quote

Bob99 wrote:

@Paul-T –

Please correct me if I’m wrong, but I thought that a disk image that is taken is just like taking a photo of the drive’s contents/data, warts and all.

That would mean that since @bumblebee took the image after completing a chkdsk routine that said there were 20k of data in bad sectors

it passed stage 4 without any problems and continued on and completed stage 5 successfully reporting that there were 5 bad clusters amounting to 20KB in bad sectors.

I was then able to successfully image the ‘D’ drive using Macrium Reflect.

those sectors would then be copied onto the new, essentially pristine, drive because they were contained in that image, right?

By default Macrium Reflect only copies used sectors when making an image file, unless you are using the “forensic” mode which copies all sectors.

That would take longer and result in a larger image file, but is the only way to capture the paging and hibernation files from the drive, as well as any unused sectors.

Windows 10 Pro 22H2

Reply | Quote

Technically, there are two different types of image backups. One copies all the sectors on the source drive sector-by-sector, even if they are empty sectors. Cloning a disk is sector-by-sector and can clone bad sectors to a brand-new drive.

HOWEVER, you were not making a clone.

Macrium images are a bitmap image of all the files on the source disk, not sectors. Image file size will vary depending on the number of files, and when you restore the image, the files on the destination drive can be in different sectors than the source drive. I use the paid ver of Macrium Reflect 8 and it’s been super solid.

Your issue is unusual.

My only suggestion is to clean and format your new SSD. Then, verify the re-formatted new SSD is healthy using “chkdsk” without any flags. You should see “no errors found” when chkdsk is done. Then, try another image restore.

Desktop mobo Asus TUF X299 Mark 1, CPU: Intel Core i7-7820X Skylake-X 8-Core 3.6 GHz, RAM: 32GB, GPU: Nvidia GTX 1050 Ti 4GB. Display: Four 27" 1080p screens 2 over 2 quad.

Reply | Quote

TechTango wrote:

Technically, there are two different types of image backups. One copies all the sectors on the source drive sector-by-sector, even if they are empty sectors. Cloning a disk is sector-by-sector and can clone bad sectors to a brand-new drive.

HOWEVER, you were not making a clone.

Macrium images are a bitmap image of all the files on the source disk, not sectors. Image file size will vary depending on the number of files, and when you restore the image, the files on the destination drive can be in different sectors than the source drive. I use the paid ver of Macrium Reflect 8 and it’s been super solid.

I’m sorry, but that is incorrect information about Macrium Reflect imaging.

According to the Macrium Reflect User Guide, there are two copy modes that Macrium Reflect can use when making an image. Selected under “Advanced Options”:

https://knowledgebase.macrium.com/display/KNOW80/Advanced+Options

1. Intelligent sector copy: Copy only file system sectors/clusters that are in use. This reduces the size of the disk image file as unused file system clusters are not copied.
2. Make an exact copy: Copy every sector/cluster used by the partition. This will also copy unused space and will make the image file significantly larger than ‘Intelligent sector copy’.

Windows 10 Pro 22H2

Reply | Quote

Bob99 wrote:

I thought that a disk image that is taken is just like taking a photo of the drive’s contents/data, warts and all.

Bad sectors are parts of the disk that the disk reports as unusable, not added by a utility. They could be anywhere on the disk. Backup utilities ignore that information because there are no files stored there.

Modern (last 20 years) disks store all data with additional ECC data so bad sectors do not destroy data, but if the damage is too great the data will be lost and you get CRC errors. This is one reason we backup.

cheers, Paul

1 user thanked author for this post.

Cybertooth

Reply | Quote

Attached are the results for the CHKDSK /B.

Interesting to see that it DID identify the bad clusters attributes from my previous disk and make corrections.

All of my Macrium Reflect images are done with the default setting of ‘Intelligent sector copy’.

@Paul T  –  Is there still a need to run CHKDSK /R as well?

Reply | Quote

The implication of the bad sectors having tested OK is that you have errors in your controller / cable.
I would perform a lot of copy / verify operations on that disk to try to force some errors. TeraCopy will allow you to copy and verify easily.

cheers, Paul

p.s. no need for CHKDSK /R

Reply | Quote

I think I’ll try another pristine brand new disk. I’ll run CHKDSK on the empty disk, and assuming all is ok, then restore my Macrium Reflect image onto it and then run CHKDSK on it again. If CHKDSK then reports bad sectors, that confirms that the bad sector attributes have come across in the image from my old dying disk. I’ll report back here my findings.

Thanks everyone for your input.

Reply | Quote

I’m now at the stage where I can answer my own question that I started out with on this thread. For the benefit of anyone else following this thread, I will report my findings below.

I installed another pristine brand new HDD, ran a scan of the disks SMART subsystem using HDDScan [hddscan.com]. This showed everything was ok and in the green. I then ran CHKDSK (see file ‘chkdsk q drive results.txt’ attached) and it showed all was ok, particularly, no bad sectors.

Next I restored the Macrium Reflect image of my ‘D’ drive onto this new disk, ran a scan of the disks SMART using HDDScan. This showed everything was ok and in the green. I then ran CHKDSK (see file ‘chkdsk d drive results 2022-08-17 1648.txt’ attached) and it showed the exact 20kb in bad sectors as my other disk that I’d restored my ‘D’ drive image onto. Compare the results with attachment ‘chkdsk d drive results 2022-05-18-new-WD-Red-HDD.txt’ on my first post).

My conclusion therefore is that there is nothing wrong with either of the pristine brand new disks the images were restored onto. The MFT Bitmap IS copied during the Macrium Reflect imaging process (when using the default settings).

My lesson learnt from all of this? When you’ve restored from a backup image onto a brand new pristine disk, run chkdsk with the ‘/b’ parameter to force Windows to clear the list of bad clusters on a volume and rescan all allocated and free clusters for errors. I’ve discovered Microsoft’s own documentation on chkdsk /b says “Use this parameter after imaging a volume to a new hard disk drive.” [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/chkdsk]

4 users thanked author for this post.

opti1, windbg, PKCano, Cybertooth

Reply | Quote