NTFS recovery help

[banjo67xxx]

Hi all,

I've copied an NTFS filesystem from partition 6 on my 120GB HDD to a new 160GB HDD using the linux mdadm utility. I then resized the extended partition and recreated the NTFS partition with exactly the same start and end blocks as before. However, now I can't read it.

I've tried chkdsk, I've tried a BartPE recovery disk, and I've tried Pandora Recovery. Unfortunately, all these utilities say that the filesystem is corrupt or unreadable.

Code: [Select]

C:\Documents and Settings\Ken>chkdsk /r g:
The type of the file system is NTFS.
Unable to determine volume version and state.  CHKDSK aborted.
When I read the filesystem from Linux its still got all the correct NTFS headers, so please can someone help me with suggestions as to how I can recover the data on it (as I can see its still there)?

PS: Linux won't mount it, as it says
Apr 11 16:20:56 stef Captive[23441]: sandbox: FATAL: captive_shared_cache_map_page_set_lsn: assertion `captive_shared_cache_map_object->LogHandle_set' failed

[banjo67xxx]

Can I chkdsk the filesystem using its mirror copy of the MFT, like on linux you could fsck with an alternate superblock?

I see from http://ixbtlabs.com/articles/ntfs/ that there is supposed to be a mirror MFT in the middle of the partition, but I'm not sure how to decode where it is?

If it helps here is the first 256bytes of the filesystem
stef:~ # dd if=/dev/hdd6 bs=1k count=1 | od -cx
1+0 records in
1+0 records out
1024 bytes (1.0 kB) copied, 3.3e-05 seconds, 31.0 MB/s
0000000 353   R 220   N   T   F   S                  \0 002  \b  \0  \0
        52eb 4e90 4654 2053 2020 0020 0802 0000
0000020  \0  \0  \0  \0  \0 370  \0  \0   ?  \0 377  \0   ?  \0  \0  \0
        0000 0000 f800 0000 003f 00ff 003f 0000
0000040  \0  \0  \0  \0 200  \0 200  \0 243 202 226 003  \0  \0  \0  \0
        0000 0000 0080 0080 82a3 0396 0000 0000
0000060  \0  \0  \f  \0  \0  \0  \0  \0   *   h   9  \0  \0  \0  \0  \0
        0000 000c 0000 0000 682a 0039 0000 0000
0000100 366  \0  \0  \0 001  \0  \0  \0 337 356 237 334   : 240 334 372
        00f6 0000 0001 0000 eedf dc9f a03a fadc
0000120  \0  \0  \0  \0 372   3 300 216 320 274  \0   | 373 270 300  \a
        0000 0000 33fa 8ec0 bcd0 7c00 b8fb 07c0
0000140 216 330 350 026  \0 270  \0  \r 216 300   3 333 306 006 016  \0
        d88e 16e8 b800 0d00 c08e db33 06c6 000e
0000160 020 350   S  \0   h  \0  \r   h   j 002 313 212 026   $  \0 264
        e810 0053 0068 680d 026a 8acb 2416 b400
0000200  \b 315 023   s 005 271 377 377 212 361   f 017 266 306   @   f
        cd08 7313 b905 ffff f18a 0f66 c6b6 6640
0000220 017 266 321 200 342   ? 367 342 206 315 300 355 006   A   f 017
        b60f 80d1 3fe2 e2f7 cd86 edc0 4106 0f66
0000240 267 311   f 367 341   f 243      \0 303 264   A 273 252   U 212
        c9b7 f766 66e1 20a3 c300 41b4 aabb 8a55
0000260 026   $  \0 315 023   r 017 201 373   U 252   u  \t 366 301 001
        2416 cd00 7213 810f 55fb 75aa f609 01c1
0000300   t 004 376 006 024  \0 303   f   ` 036 006   f 241 020  \0   f
        0474 06fe 0014 66c3 1e60 6606 10a1 6600
0000320 003 006 034  \0   f   ; 006      \0 017 202   :  \0 036   f   j
        0603 001c 3b66 2006 0f00 3a82 1e00 6a66
0000340  \0   f   P 006   S   f   h 020  \0 001  \0 200   > 024  \0  \0
        6600 0650 6653 1068 0100 8000 143e 0000
0000360 017 205  \f  \0 350 263 377 200   > 024  \0  \0 017 204   a  \0
        850f 000c b3e8 80ff 143e 0000 840f 0061
0000400 264   B 212 026   $  \0 026 037 213 364 315 023   f   X   [  \a
        42b4 168a 0024 1f16 f48b 13cd 5866 075b
0000420   f   X   f   X 037 353   -   f   3 322   f 017 267 016 030  \0
        5866 5866 eb1f 662d d233 0f66 0eb7 0018
0000440   f 367 361 376 302 212 312   f 213 320   f 301 352 020 367   6
        f766 fef1 8ac2 66ca d08b c166 10ea 36f7
0000460 032  \0 206 326 212 026   $  \0 212 350 300 344 006  \n 314 270
        001a d686 168a 0024 e88a e4c0 0a06 b8cc

[banjo67xxx]

Looks like it might be toast, but I can't see why simply deleting the partition and then recreating another partition in exactly the same location would affect the data?

This is what GetDataBack NTFS says


Please can anyone suggest any other data recovery tools for NTFS?