Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations John Tel on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

frustration with NTFS chkdsk errors

Status
Not open for further replies.
qlark

qlark

Programmer
Jan 5, 2006
54
CA
Not sure what is going on ... yesterday I did a reboot instead of a hibernate and the Blue screen of death showed up ... the last updates from MS were not critical and this problem started shortly after ... I rebooted with F8 to last known boot but since then I have had nothing but problems.

Does anyone know if there may be a Virus and or trojan that stops a chkdsk /f from running?

I have;

- run an overnight Hardware Diag

- removed .net and reinstalled (chkdsk indicated a problem in the .net directories)

- sfc /scannow

- chkdsk /f does not appear to run on reboot ... chkdsk by itself indicates errors

- NIS 2K5 antivirus Scan

- Spybot 1.4 scan

- adaware scan

- bartpe chkdsk

- defrag

- Norton Systemworks disk doctor ... again startup appears to not be working

- system restore appears to also be broken ... I can select any date but the restore process won't start
 
Sort by date Sort by votes
If you can download this, then load in safe mode and run a full system scan.


Download hijackthis from the link below. Extract to desktop or prefered folder. Open it up choose do a system scan and save a logfile and post the logfile on here. Unless your sure of what your doing do not attempt to fix anything yourself as most items are legit.

 
Upvote 0 Downvote
Ewido didn't like some cookies ... I finally figured out why chkdsk wasn't showing on bootup ... I had /noguiboot on in the boot.ini

OK so chkdsk /f appears to work however subsequent chkdsk's show there are still errors ... I have run GRC's spinrite and it hasn't found any issues with the drive

However I have had a winlogin HARD FAILURE message come up on the screen which caused the machine to immediately reboot.

I am currently running windows beta 2 security software

I ran Hijack and looked up each entry and found nothing out of the ordinary

Its almost sounding like an intermittent hardware failure ... not sure how else to categorize it

First there was the blue screen then chkdsk, then messenger failing, chkdsk is still failing, then this hard failure ... just don't know what to think ... I think I will have to ghost another image do a clean install just to validate any intermittent hardware Failures.

At one point even the event logs were failing ... at this point I can see them ... on the 23rd prior to the blue screen there are numerous Information logs on .NET which confirms my reason for uninstalling .net then reinstalling it ... in the last 2 days there are Browser errors along the theme that it is stopping due to failing to retrieve a backup list ... the other main failure is the Service Control Manager complaining about path not found ... yesterday messenger was having issues with ntdll.dll but today its fine

 
Upvote 0 Downvote
With so much going on, a backup of any valuable data, followed by a reformat and re-install (or clean re-image) seem to be in order.

The drive manufacturer will have free diagnostic software to thoroughly check the condition of your hard drive in case that is failing.

If you are regularly inside the computer box, a loose connection may be the cause?

Checking the RAM is easy enough too.


You could have one final go with ChkDsk /r run from the Recovery Console.

HOW TO: Install and Use the Recovery Console for Windows XP (Q307654)
 
Upvote 0 Downvote
I would just, for sake of mind, change the IDE cables to brand new ones...

and use another PSU power plug to the drive(s) just to be safe...


Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."
 
Upvote 0 Downvote
Yeah having a good power supply unit is always good(so as badbigben suggest I would replace it if its factory with the case), because the ones that come with cases are cheap and will take out a computer sometimes when they go out. My friends computer just became an example of the massive damage one can do. It took out motherboard, processor, one ram chip and video card. So fair warning if your using the original power supply that came with the case they are made to barely get you by and can be deadly to a computer when they go out. So if you are Id reccomend getting a new one from a good known brand and check on the amperage on the power supply before you buy. Make sure it has at least 18 or more amps on the 12+ as well as good amp rating on the others. No matter how high the amperage is it wont hurt the board or hardware as they only pull how much amperage they need. If you dont have enough they will fight over it and cause heavy strain on the psu causing it to die quicker. Anyways hope this info is useful.
 
Upvote 0 Downvote
I guess I didn't mention this is a Dell Laptop so the Hardrive is fixed in terms of the cables ...

I ran Memtest overnight ... no errors

I installed Recovery consol and ran chkdsk /r ... this reported that it repaired some errors

I ran Spinrite 6.0 in mode 4 the highest level which returned a clean bill of health

started XP up and immediately did a chkdsk and still have errors .... ARRGGGG

I have a Ghost image that I may transfer to another drive and see if I can find anything having it as a slave drive in another XP pro machine

The other thought is to clean the drive and reinstall a clean install of XP to verify that the hardware is working consistantly ... if there are errors then Dell Warentee Kicks in.

 
Upvote 0 Downvote
Description of Enhanced Chkdsk, Autochk, and Chkntfs Tools in Windows 2000

Chkdsk.exe or Autochk.exe starts when you try to shut down or restart your computer

You can determine whether your file system errors are legitimate.
To know if you've got a file system error, you can type the following command at the command prompt:

fsutil dirty query c: (replace c: with your drive letter)

If the response is that the volume is dirty, then a file system error has occurred, and Chkdsk should run automatically at startup to fix the errors.


Chkdsk runs everytime on start up?
thread779-958348

Check Disk runs every bootup?
thread779-946488

How to reset the harddisk "error bit"?
thread779-608212
 
Upvote 0 Downvote
Both fsutil dirty query c: and chkntfs c: return volume is not dirty ... yet if I do a chkdsk I first received an MFT error ... running again I get index errors ...

$I30 appear to be the Index always reporting problems ... I have seen this more then once

chkntfs c: still shows not dirty

chkdsk will only run at boot time if I answer Yes to chkdsk /f

so is there possibly a virus/worm/trojan that screws around with chkdsk results?

 
Upvote 0 Downvote
Just some general links on the MFT and Metadata files.

NTFS Metadata files


Chapter 3. NTFS Files


Master File Table



"STOP 0x000000ED UNMOUNTABLE_BOOT_VOLUME" Error Message When You Restart Your Computer or Upgrade to Windows XP


 
Upvote 0 Downvote
Strange went looking through your links and found I couldn't find the mft location;

for both c:\ and c:\windows
dir /a or /ah $mft no file found

from c:\
dir /s /a $mft and dir /s /ah $mft nothing found

I have the file settings set to allow viewing hidden files I also have some utilities that scan all files and even these don't find the mft file
 
Upvote 0 Downvote
Do you have any record of them in the "View Report" after Defragmenting or Analysis of the drive with the defrag program?
 
Upvote 0 Downvote
Hmmm! Bootsector error are an easy fix. MFT errors are serious errors. Linney is correct that the defrag records will give you an indicator of the corrupt files that are not readable or movable.
This fix works and is the only way to correct an MFT error.

1. defrag the whole hard drive and note the files that have errors other than normal system file errors for files in use.
This is a great way to find the corrupt files and is better that the defrag method.

2. if you have logical partitions back up all the data on them and empty the data off the drive. you need to make sure there is no files or data in any other partition on the hard drive. turn of system restore to save room. (at this point system restore is not going to help). IF you just have a C:\ drive on that drive then this is not an issue.

3. You need a second formatted drive and a floppy for this to work.
Open the windows Backup utility and do the advance mode.
then Run the Automated System Recovery Wizard. on the next page close the window and go to tools/options then exclude list...****Exclude those files that errored**** in the Defrag report or backup.log....close and restart the backup utilities and follow the directions on these links:

and if you need this:
Use the second drive for the backup location

4. Then after all the backups are made.
Use the manufacturer of the harddrive utility and completely zero out the hard drive.

5 restore the backup


Just to note: ASR only makes a backup of your files on your System drive (usually drive C:\). If you use other hard drives, you will need to make a separate backup of your documents & files to make a complete "recovery" after disaster!


read these links for some ideas
 
Upvote 0 Downvote
I truly appreciate everyones time here ...

I did a defrag as one of the first few steps in getting this under control ... I do not recall any errors ... would there be a log file somewhere that I could review?

I now have 3 ghost images of this disk;
1) is roughly 3 months old
2) reported NTFS errors
3) was done after the recovery consol chkdsk /r and reported no errors

The machine has been stable for the last day since I removed the indexing services check mark from the C: properties. Dell wants me to do a clean install but for the moment I will just monitor the machine ... at this point the Application Failures have stopped and haven't received any more Hard Failure notices ... running the extended mem test and GRC's spinrite give me some confidence that this is not a harddrive failure and the fact that I have used the machine all of yesterday and today without incident also makes me think this is not a hardware issue ... I even got one of my kids to play a very machine intensive flight sim game for several hours last night again with no issues

the long thread from 2002 to the end of 2005 suggests the chkdsk issue has been an ongoing problem with all of the NT based products 2K, 2Kpro, XP and even 2k3.

What puzzles me is chkdsk never gives the same report 2 times in a row suggesting that the reports aren't valid (which is the same conclusion I perceive out of that long winded thread I found) ... if the MFT error is a severe error then why doesn't it show up consistently ... also if this is a severe error why doesn't chkdsk or autochk automatically set the Volume dirty flag?

Too many questions

Sorry I digress ... I was actually thinking of wiping the disk and Ghosting the 1st and or 3rd images back to the machine and test the chkdsk process again ... I Suspect that Ghost doesn't recreate a sector for sector image as it can move images between different sized drives (as long as there is enough room for the data contained in the image) to me this should rebuild the NTFS database. Rebuilding the database should rule out any issue that the database has a problem ... however it won't rule out a corrupt and or virus riddled OS.


 
Upvote 0 Downvote
qlark, The procedure I gave you is the fix for an MFT error. usually it can pass a chkdsk /r or f scan and just state there is a bad sector in the final info when it is done. this type error does not check as "dirty" after the error is found and it does not toss you into a chkdsk loop.

Can you do a complete defrag without any errors in the log other than normal open file errors?

Also the way I said to do the backup Bypasses the corrupt files and does not copy those files to a backup image.
I am betting that the Ghost Backup images that you want to reinstall have the same error as to what you have now.

The Indexing service refers to the MTF for it to work correctly. as so does the NTFS file system. so in a way it is correct that there is a different error each time it does a Chkdsk scan.

I don't give long for your system before you have a system crash and an unrecoverable HD. the last time I saw this type error the partition table was lost and the only way for data recovery was bit for bit recovery in a lab.

Dell is right that you need to start over with a clean install. AFTER YOU ZERO THE DRIVE.

you may be looking at a new harddrive.

as for rebuilding the NTFS database you will still have the corrupt MFT after the image restore

hey I wish you luck. you might be lucking and cloned before the MFT Fault.
 
Upvote 0 Downvote
Ok so what I hear you saying is that the OS is reporting correctly and that there still must be a problem ie this is not normal ... the GRC spinrite process does a deep analisys of each sector of the hard drive and it reported no errors so I still believe this is not a Drive issue ... I just reran the defrag and it came back with no errors or files left unfragmented ... I then reran the analisys and it came back with more fragmented files but I realized that this was because I left my email services running during the defrag as all the files were related to that program.

I will go and reread your MFT repair process and see whether this can be done on the laptop or if I need to clone a drive and do it in a desktop machine then clone back the resulting image.

here is the details of the last defrag;

Disk Defragmenter
Volume ATSM (C:)
Volume size = 55.85 GB
Cluster size = 4 KB
Used space = 34.06 GB
Free space = 21.79 GB
Percent free space = 39 %
Volume fragmentation
Total fragmentation = 0 %
File fragmentation = 0 %
Free space fragmentation = 0 %
File fragmentation
Total files = 129,730
Average file size = 334 KB
Total fragmented files = 0
Total excess fragments = 0
Average fragments per file = 0.99
Pagefile fragmentation
Pagefile size = 768 MB
Total fragments = 1
Folder fragmentation
Total folders = 7,426
Fragmented folders = 1
Excess folder fragments = 0
Master File Table (MFT) fragmentation
Total MFT size = 219 MB
MFT record count = 137,847
Percent MFT in use = 61 %
Total MFT fragments = 3
---------------------------------------------------------------------
Fragments File Size Files that cannot be defragmented
None
 
Upvote 0 Downvote
Looks like there is no MFT file error so you may be in luck.
But, I am not so sure. So, It's just a waiting game now to see how long stability lasts.

the errors you descibed earlier can also be contributed to bad ram. ( Iknow! I know! I may be reaching....LOL)


good luck
 
Upvote 0 Downvote
qlark,
Do you by chance use Ghost 10?
I have seen multiple posts in different forums and also the Langa list newsletter has a mention of it concerning MFT errors that come and go and assorted aplications that randomly error

I saw this excerp from the langalist and thought of you:

Hi Fred! I recently had to do a complete restore of my C: drive using Ghost 10 and thought it went fine. Now I've run into a problem I can't figure out. I keep getting the following sporadic warnings:

<application filename> - Corrupt File
The file or directory C: is corrupt and
Unreadable. Please run the Chkdsk utility.

I've run Chkdsk and it says there is no problem. The system seems to be running OK except every now and then I get one of these warnings about various applications. The applications seem to be working though.

I did some research and found out the problem is a potentially corrupt Master File Table (MFT). But so far I can't figure out what to do about it.

So I think that the main issue is the Ghost 10 that causes these random errors and maybe does not apply the MFT correctly on restore. I don't use ghost anymore because I use a mirrored backup that I can boot if there is a system crash.


I hope this helps. You should reseach and maybe even get a hold of support for the ghost 10 to see if there is an unlisted fix.





 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

spamjim
  • Locked
  • Question
Sanitizing illegal filenames on NTFS volumes
Replies
2
Views
519
spamjim
spamjim
Flinx
  • Locked
  • Question
backup fails with error code 0x81000019 and possible fix 1
Replies
5
Views
2K
Flinx
Flinx
Diane Sandstrom
  • Locked
  • Question
PDF with highlighting
Replies
2
Views
398
Diane Sandstrom
Diane Sandstrom
Flinx
  • Locked
  • Question
continuing issues with Windows 10 slow transfer to NAS
Replies
6
Views
838
pmonett
pmonett
Shengfu
  • Locked
  • Question
PROBLEM WITH FILES IN FLASHDRIVE
Replies
3
Views
417
mikrom
mikrom

Part and Inventory Search

Sponsor

Back
Top