MFT Bitmap Corrupted

I have a full backup I made and verified yesterday.
I copied it to my external HD and verified it there as well.

Today my virus program identified a possible virus threat to a file that was being downloaded to my cache, so I decided to restore that backup just to make sure I didn't have any trace of a virus left.

I selected the archive, checked the C: partition and an error dialog box popped up with the following heading:

"MFT Bitmap Corrupted"

I didn't jot down the rest of the dialog contents.
I also tried the restore from the image on the USB drive with the same error.
Note... both times I was allowed to continue with the restore, and they both seemed to restore successfully.

I thought the virus must have done something really bad to my system, so I
ran chkdsk and have it automatically fix any errors, but it didn't show any errors.

Finally I decided to try and restore the backup just previous to the one that gave the error, and it restored just fine with no errors at all.

I deleted the backup that gave me the errors, and my system is working just fine.
I guess the moral of this story is even though a backup passes the validation, does not necessarily mean the backup is without errors.
So I think the only way to make sure a backup is good is to actually try and restore it.

Does anyone have any other thoughts on this?

 

There was another user here who said many times that True Image gives too many false positives and the only true test is to do an actual restore to a spare drive. And I totally agree with this. Because of this I never do a Validation - it is a waste of time.

 

So the validation process is not actually complete until a successful restore of the image has been done.
Thanks DwnNdrty for confirming my suspicions.

 

Not that the validation is not complete, but if you stop there, it gives you a false sense of security.

 

All the validation does is verify that the TIB files are internally consistent.

That does not mean that once restored, the files will constitute a valid system, or even tat the individual files are all correct.

One can use the Compare Drives Programs to compare the files in the archive to those on the hard drive.
The best result is achieved if done immediately after the backup.

 

It would be nice to know if the corrupt bitmap referred to the image or the current MFT bitmap on the C partition.

On Validating:

When TI creates the image it reads the disk processes the data by possibly compressing and putting it into the TI tib file format. It is also calculating the checksum(s?) for inclusion in the file. This is the checksum that is calculated when the archive is validated and must agree. There are a couple of things that can go wrong at this stage. The first is if the disk reads are bad for any reason then bad data is presented to TI. The checksum will be calculated based on this bad data. There can be a RAM or MB issue and this will cause the data in memory to be changed to wrong values. Again, the checksum will be calculated based on the bad data.

The archive is validated at some time and the calculated checksum will agree with the checksum placed in the file at create time - essentially saying the archive is not corrupt. However, the data is not good because of either of the above reasons. Garbage In - Garbage Out.

For this reason, running chkdsk before making an archive is a good idea since that should bring to light any disk structure issues. Memory diagnostics can be run from time-to-time but it seems that TI's Validate is good at picking up bad memory.

I do not agree that validating is useless. It is not perfect but I have more confidence that all is well after running it than if I don't. I have said it before and I'll say it again, you must validate using the boot CD version of TI on a machine that you are first running TI on, or if you are using a new device such as an external HD, DVD, etc for the first time. Windows validation is not enough because it does not use the same drivers and application. Once you know the CD version works then you can use the Windows validation with more confidence.

 

Here is exactly where the error message popped up:

- select Recovery
- select the archive
- select Restore disks or partitions
- check the box [ ] next to the partition to restore, C: in my case
- press Next
- error "MFT Bitmap Corrupted"

So since the target partition hasn't been selected yet, I would say the error was coming from the archive.

 

Not necessarily.
The error might not occur untill actually reading the archive.

One way to test is to read the archive file using ReadFile.

Check both options and set a large buffer size.

If the disk drive's MFT is bad, the ReadFile program will enounter an error.
If the problem is the MFT within the archive, the ReadFile program won't care, all it does is read bytes.

 

As I stated in the first post, I restored a backup I made previous to the one with the error, and did not get an error with that one.
I also just made another new backup to replace the questionable backup and there are no errors with it.
So I maintain the error was within the archive.

 

dougeeebear,
Just to confirm, it appears that your restore was attempted from the external drive copied file and not the originial non-copied file?

If the above is true, be careful as other files copied to the external drive could be suspect.

If you have the time, it would be nice if you would boot with the Rescue CD and then perform a validate from the CD as suggested by SeekForever.

 

Yes, I think you have proven that.

Note that the question now is what caused the error in the archive?

Was it copying to the external drive? Just an odd one-time event that we will never know any more about? Some how the effect of the virus?

What you can test is copying another image to the external drive to see if it also reports an error. That would be a useful experiment.

 

Ok, to summarize:

May 11: made a backup to the second partition, validated, copied to external HD, validated again.

May 12: got the virus "threat".

I tried to restore the backup made on May 11 and got the error.
The error occurred with both the backup on the second partition and the backup copied to the external HD.
I actually completed the restore after I got the error message and the computer booted up to Windows just fine and everything seemed to work ok, but I didn't really trust it.

I then restored a backup I made on May 9 without errors.

After that proved to be a successful restore I deleted the questionable May 11 backup.
Therefore, I cannot validate it with the CD.

May 12: I made another backup, validated, copied to ext HD, validated with no problems.
I also went through the restore process with this backup as far as the "Proceed" screen without errors (both the local backup, and the one copied to the ext HD).

So my conclusion is I had one questionable backup, but I don't really know why.

AS DwnNdrty said, it could have been a false positive, but I will probably never know for sure, all I can do at this point is speculate.
I think the virus threat and getting that error message at the same time was just a coincidence.
In the future I will take the validation process one step further and do a simulated restore (as far as the Proceed screen).
If there are no errors up to that point, it should be ok.

Thanks everyone for your input,
Doug

 

One other thing I just thought of:

Having a laptop, I let it hibernate a lot instead of always shutting it down.
As seekforever stated,

I have been doing my backups from within Windows after the computer has resumed from hibernation, and so there might have been something in memory that caused the problem.
I'm thinking now that I should reboot the computer before doing a backup.

 

If you're going to reboot, you might as well run the backup from the bootable TI cd, that way you can be sure there are no other "windows" items running in the background. It will take a little longer, but at least you will eliminate any software issues in Windows.

 

That's a good point, thanks.