Unlike most Windows messages, this one tells you exactly where your problem lies; a master file table record cannot be accessed. Once you understand what that record contains, you will also have insight into why a single file has disappeared as well as why an entire folder tree may disappear as well.
One kilobyte records are used to cover a single file. If a few are unreadable, then it's likely that there is a problem within the sector containing those files. However if hundreds of them are unreadable, then the region that contains the master file table is failing, which is a whole different story.
This information allows all other information on this page to provide context.
A master file table – or database – exists on NTFS. It has one record for each file and folder that exist on a volume. Most of these records are 1 KB in size. Each record contains the file/folder name, timestamp(s), permissions, and a list of cluster numbers for each part of the file on the disk.
If your file(s) fit into the space available in the NTFS master file table record that contains them, then they will be completely contained by that one record; otherwise, the MFT record will contain a list of cluster numbers which point to where the file's data is located. This makes sense because it is more efficient to store smaller files and their metadata in one place. If a portion of the MFT record is damaged, that damages or removes all the information associated with that particular file.
On the other hand, when you have a file that is too large to fit in a single MFT record, the MFT record for that file will include cluster numbers that indicate where the file's actual data is located. The MFT record does not actually hold any of the file's data — just a reference to where the data can be found. Therefore, if part of the MFT record fails or becomes corrupted, the file's data remains intact but cannot be referenced through the NTFS system. Thus, the extent of the damage caused by the failure of an MFT record depends upon file size, which is why some affected files recover perfectly and others do not.
This is the structural explanation of how a small number of damaged records results in a large number of lost files.
In NTFS, directories are simply files that contain indexes of the files within them — these indexes are typically maintained as B-trees for quick retrieval. Each directory has its own master file table record as would every other type of file.
Therefore if one record belonging to a directory is unreadable then all files below that will lose the indexing to link back up to the path. The files themselves are untouched, they could still have their original records intact and yet there would be nothing linking these files together any more. Windows reports the folder as unreadable and everything inside it disappears from view.
That is recoverable, and it is why recovery programs often return your files with the correct content, however without any type of folder structure. The records were preserved; and the indexes that tied them together were destroyed.
Interrupted writes occur during a power outage, or a forced shutdown while NTFS is writing entries into the master file table (MFT). This is the most common cause of this error on otherwise healthy hardware. It generally only occurs to the exact area where the interruption occurred.
The MFT occupies a certain area within your hard drive. If any sectors fail in this area of your hard drive, this particular type of bad sector will create errors reading the MFT, while other areas of the disk read normally. It is position rather than total number of bad sectors that matter.
Corruption is added during transport, not when created on the physical disk. This should be ruled out by swapping cables before deciding the issue is due to bad disks.
When new files start having errors that are the same after days or even weeks, you know the disk is getting worse, not just damaged. Stop and back up what you can.
This is what makes this particular type of behaviour important regarding this error.
chkdsk's purpose is to create consistency in your file system. If chkdsk finds an MFT record that it can't interpret, instead of attempting to recreate what it thought was there, it simply removes the reference to the record from the MFT and flags those affected clusters as available. The volume is now coherent. That is precisely what it was supposed to do.
It makes a genuine fix on a good drive after one single broken write, and the file was already corrupted. Where bad sectors are placed underneath the MFT, chkdsk can step over the damaged area in the disk removing record after record – each one a file or folder that has the potential for rebuilding from remaining structural information.
NTFS stores a partial mirror of the MFT’s first few entries, and file entries store recognisable signatures so they can be found within the image even if the original table is damaged. A recovery works from those rather than by deleting anything, against a read-only copy. Single drives in Manchester are from £300 +VAT after a complimentary 48-hour diagnostic.
NTFS was unable to read a record in its master file table – the database containing one entry per file, including the name, timestamps and a list of clusters holding the contents. The record failed, not necessarily the file.
As a directory is itself a file with an index of everything it contains. As such, one unreadable record pertaining to a directory will remove the index to all files beneath it; although all files are still valid and there is no reference to path connecting them.
Generally speaking. Typically the record contains nothing but pointers to other locations, so while the contents may still be there they have been made inaccessible. The exception is very small files stored in their own record, which are lost along with it.
Not until you check SMART and copy off whatever you can. chkdsk removes records it cannot reconcile instead of trying to rebuild the missing links — useful for maintaining good disks, and devastating for bad disks with multiple unrecoverable bad sectors located directly under the master file table.
The reason is because although each file record itself was preserved from damage, the directory index which ties them together was destroyed. Therefore, while the file contents were recovered properly, the arrangement has to be rebuilt separately, and that is not always possible.
Look at whether it spreads. A single folder that fails due to a power outage is an incident. However, if your computer displays identical errors repeatedly over days or weeks on new files, then your hard drive is failing — look at the number of reallocated and pending bad sectors.