我丢失了一个分区表，其中一个分区格式化为 NTFS。testdisk并且parted不起作用（由于另一个错误），但我可以使用恢复文件系统树恢复比特。不幸的是，这个程序还不能恢复压缩数据，除了一些名为 $MFT 的文件和一些以 $ 开头的文件。
那么，是否可以组装这些信息，并用这些信息初始化一个新的 ntfs 文件系统以启用对数据的本机访问？文件系统树是完整的，和以前一模一样。
编辑： 前 1024 字节的十六进制转储：
$ head -c 1024 \$MFT | od -A x -t x1z -v
000000 46 49 4c 45 30 00 03 00 36 14 09 05 00 00 00 00 >FILE0...6.......<
000010 01 00 01 00 38 00 01 00 98 01 00 00 00 04 00 00 >....8...........<
000020 00 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 >................<
000030 1a 00 54 94 00 00 00 00 10 00 00 00 60 00 00 00 >..T.........`...<
000040 00 00 18 00 00 00 00 00 48 00 00 00 18 00 00 00 >........H.......<
000050 28 f1 05 f0 ff 41 d2 01 28 f1 05 f0 ff 41 d2 01 >(....A..(....A..<
000060 28 f1 05 f0 ff 41 d2 01 28 f1 05 f0 ff 41 d2 01 >(....A..(....A..<
000070 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000080 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 >................<
000090 00 00 00 00 00 00 00 00 30 00 00 00 68 00 00 00 >........0...h...<
0000a0 00 00 18 00 00 00 03 00 4a 00 00 00 18 00 01 00 >........J.......<
0000b0 05 00 00 00 00 00 05 00 28 f1 05 f0 ff 41 d2 01 >........(....A..<
0000c0 28 f1 05 f0 ff 41 d2 01 28 f1 05 f0 ff 41 d2 01 >(....A..(....A..<
0000d0 28 f1 05 f0 ff 41 d2 01 00 40 00 00 00 00 00 00 >(....A...@......<
0000e0 00 40 00 00 00 00 00 00 06 00 00 00 00 00 00 00 >.@..............<
0000f0 04 03 24 00 4d 00 46 00 54 00 00 00 00 00 00 00 >..$.M.F.T.......<
000100 80 00 00 00 48 00 00 00 01 00 40 00 00 00 01 00 >....H.....@.....<
000110 00 00 00 00 00 00 00 00 7f 06 00 00 00 00 00 00 >................<
000120 40 00 00 00 00 00 00 00 00 00 68 00 00 00 00 00 >@.........h.....<
000130 00 00 68 00 00 00 00 00 00 00 68 00 00 00 00 00 >..h.......h.....<
000140 32 80 06 00 00 0c 00 00 b0 00 00 00 48 00 00 00 >2...........H...<
000150 01 00 40 00 00 00 05 00 00 00 00 00 00 00 00 00 >..@.............<
000160 01 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 >........@.......<
000170 00 20 00 00 00 00 00 00 08 10 00 00 00 00 00 00 >. ..............<
000180 08 10 00 00 00 00 00 00 21 02 ef 51 00 00 00 00 >........!..Q....<
000190 ff ff ff ff 00 00 00 00 ff ff ff ff 00 00 00 00 >................<
0001a0 00 00 04 00 00 00 00 00 31 40 00 00 0c 00 04 9c >........1@......<
0001b0 b0 00 00 00 50 00 00 00 01 00 40 00 00 00 05 00 >....P.....@.....<
0001c0 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 >................<
0001d0 40 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 >@........ ......<
0001e0 08 10 00 00 00 00 00 00 08 10 00 00 00 00 00 00 >................<
0001f0 31 01 ff ff 0b 11 01 ff 00 00 01 00 00 20 1a 00 >1............ ..<
000200 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0002a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0002b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0002c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0002d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0002e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0002f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
000390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0003a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0003b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0003c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0003d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0003e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >................<
0003f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 >................<
和引导记录（至少我希望如此）
> allparts
Partition #0 -> Partition (NTFS, 1.82 TB, 4706 files, Recoverable, Offset: 2048, Offset (b): 1048576, Sec/Clus: 8, MFT offset: 6293504, MFT mirror offset: 2064)
Partition #1 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 316980352, MFT mirror offset: None)
Partition #2 -> Partition (NTFS, ??? b, 6 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 152503816, MFT mirror offset: None)
Partition #3 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 79517584, MFT mirror offset: None)
Partition #4 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 9717656, MFT mirror offset: None)
Partition #5 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 151669368, MFT mirror offset: None)
Partition #6 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 628571568, MFT mirror offset: None)
Partition #7 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 395066792, MFT mirror offset: None)
Partition #8 -> Partition (NTFS, ??? b, 15 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 1953514624, MFT mirror offset: None)
Partition #9 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 662340344, MFT mirror offset: None)
Partition #10 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 302860720, MFT mirror offset: None)
Partition #11 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10357512, MFT mirror offset: None)
Partition #12 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 77430456, MFT mirror offset: None)
Partition #13 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 85578480, MFT mirror offset: None)
Partition #14 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10767168, MFT mirror offset: None)
Partition #15 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 9717856, MFT mirror offset: None)
Partition #16 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 77101768, MFT mirror offset: None)
Partition #17 -> Partition (NTFS, ??? b, 4 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 1953514608, MFT mirror offset: None)
Partition #18 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 154535088, MFT mirror offset: None)
Partition #19 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 7725240, MFT mirror offset: None)
Partition #20 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 153627072, MFT mirror offset: None)
Partition #21 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10357624, MFT mirror offset: None)
Partition #22 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716195416, MFT mirror offset: None)
Partition #23 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 6514936, MFT mirror offset: None)
Partition #24 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 98269952, MFT mirror offset: None)
Partition #25 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716141024, MFT mirror offset: None)
Partition #26 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 6820112, MFT mirror offset: None)
Partition #27 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716178792, MFT mirror offset: None)
Partition #28 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 395876840, MFT mirror offset: None)
Partition #29 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 408808056, MFT mirror offset: None)
Partition #30 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 153921904, MFT mirror offset: None)
Partition #31 -> Partition (NTFS, ??? b, 2 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 10768552, MFT mirror offset: None)
Partition #32 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 621608448, MFT mirror offset: None)
Partition #33 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 716169080, MFT mirror offset: None)
Partition #34 -> Partition (NTFS, ??? b, 1 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 154558208, MFT mirror offset: None)
答案1
不幸的是，这个程序还不能恢复压缩数据，除了一些名为 $MFT 的文件和一些以 $ 开头的文件。
我创建了 RecuperaBit，并确认它无法读取以 NTFS 压缩存储的文件。请注意，没有例外：$MFT是保存主文件表的文件（所有元数据文件都以它开头，$并且它们没有被压缩，但其中一些是稀疏的）。
你的目标：
使用这些文件系统初始化新的 ntfs 文件系统以启用对数据的本机访问
如果 MFT 确实损坏，听起来就不可行。但是，您应该注意，情况可能并非如此。您的十六进制转储显示第一个条目（最重要的条目）很好。最有可能的是，以下内容也不错。
您需要做的就是恢复分区表并选取至少一个 NTFS 引导扇区。通常，备份引导扇区可以轻松恢复，因为它位于驱动器的末尾。
您的输出显示了文件系统的确切大小。该数字是从引导扇区读取的，因此您知道它仍然存在：
Partition #0 -> Partition (NTFS, 1.82 TB, 4706 files, Recoverable, Offset: 2048, Offset (b): 1048576, Sec/Clus: 8, MFT offset: 6293504, MFT mirror offset: 2064)
如果您让 Testdisk 在 100% 的驱动器上运行，它将找到该分区。然后，您可以使用 Testdisk 列出文件并提取它们。它甚至可能可以恢复备份 NTFS 引导扇区，或者您可以通过将其刷新到分区的第一个扇区来手动执行此操作。