Recovering after NTFS/MFT corruption with TI 10 Home

I am trying to restore an NTFS volume on which the file system became corrupt. Chkdsk discovered the errors but in 'fixing' the errors, the system became unstable. I can restore from earlier image backups, but the problem remains. I need a better understanding of how an image backup and restore in TI 10 Home work with NTFS.

1) In order to avoid backing up unused space does TI rely on the MFT to tell which sectors are in use or is there another way it selects which sectors to back up.

2) If so, does it check both the MFT and its mirror for consistency?

3) If there is corruption (cross linked files, free space marked as in use etc) within the file system does the standard image backup copy sectors as is (file system errors and all) and will this also pass a validation of the backup file?

4) If a sector marked bad after a backup is made, will the restore relocate that sector to another area of the disk and correct the file table entries accordingly?

5) Is there any value in deleting, creating and formating a partition and then running chkdsk on a volume that will be restored to insure a clean, reliable destination or does an image restore effectively do all of this in one step?​

thanks!
Scott

 

I don't really know just how TI does all its magic and to what extent the MFT is used. Imaging, as opposed to a Files and Folders backup, does not use the MFT to the same extent. TI creates a bitmap of in-use sectors and bases its image on that and subsequent changes to it for incrementals etc. I know that some other computer OSs use their own bitmaps for their file allocation but whether or not FAT and NTFS do, I don't know.

TI does some checking of the disk to determine whether or not the file system is supported and if it can't make sense of it, it automatically reverts to a sector-by-sector backup. I have never heard of TI reporting file system errors but it there have been reports of it choking and a chkdsk has corrected the problem. I would say it looks but probably not in-depth and I always run a chkdsk from time-to-time to ensure that my backups are of a good file system.

Understanding the Validation process is important. When TI writes the archive file it includes a checksum after every 256K bytes of data. This amounts to about 4000/GB. When the archive is validated it reads the archive and recreates the checksum from the read data and compares it to the one stored in the archive at that point. Every one must agree perfectly or the archive is declared corrupt. TI does not do a bit-by-bit comparison of the source and destination. This is why an archive can be validated at anytime and on any machine without the original source material. The validation says that the archive file is as written it does not say that everything that was read, interpreted and written into the file is perfect. Garbage in=garbage out.

Don't know.

IMO, there is value in doing this since it does ensure the partition is in good condition. When disks are written the writer assumes the data was recorded properly on the disk. It is only when you read it that you find out the sector was bad. TI reads its archive and then reconstructs the disk from the archive which includes the NTFS or FAT32 format info because it is part of the sector contents. It is not done by doing a format and it certainly doesn't run a surface scan.

When I buy a new disk I set it up by partitioning it myself and doing a full format which reads the entire surface. These steps can by bypassed by having TI do a bare-metal restore but since the disk is new I like to ensure that it is indeed in good condition. Takes longer but I've got nowhere to go anyway.