WIN 98SE - Problem with SCANDISK

[colin4228]

I am running WIN98SE on two near identical machines, and have done so for years. Recently one machine declined to execute SCANDISK, giving the error message "unable to carry out scandisc because your computer has insufficient memory. Try shutting down other programs which may be running" (or words to that effect).

There is in fact plenty of memory and nothing in the system has changed since previous occasions when SCANDISC ran fine.

I tried making a clone of the hard drive onto a freshly partitioned and re-formatted drive, which worked OK. However upon trying SCANDISC on the clone, that too resulted in the same error message.

Norton disk doctor still works ok on both drives.

So I conclude that there is some file which would be transferred to a "virgin" disk by a clone routine which has become corrupted somehow.

Can anyone please give me some ideas where to look and for what? A view of the partition table (via MS-DOS Prompt FDisk)indicates no apparent problem. Yet if I boot from a 98 start-up disc and run FDisk, I get a message that the drive does not contain a valid partition.

Have considered looking at the MBR, but how can one safely access and view this.

Suggestions gratefully requested.

Colin 4228

 

[G0AOZ]

Where are you running SCANDISK from? DOS prompt? Within Windows?

Consider the possibility of a virus or spyware.

Start the machine up, hit <F8> and select Command Prompt. Now run this command line:-

mem /DEBUG > c:\mem.txt

That will list what's being loaded and how much resource is being used. Do the same on the other machine, and compare.

Maybe your WIN 98 startup disk is only FAT16 and your hard disk installation is FAT32. That might explain why it can't see the partition...

ROGER - G0AOZ.

 

[colin4228]

Roger, Thank you for such a rapid response. This post primarily to acknowledge it. I will carry out what you suggest and post results here soonest.

Meanwhile I can answer some of your points :

If I try to run scandisk as normal from within windows, I get the reported problem ("scandisk is unable to continue due to insufficient memory etc. Try closing other programs"). However, I have tried this with every background program closed (via. control / alt / delete) other than explorer, with the same result.

If under windows 98se I select start / programs / MS-prompt and type "scandisk enter", I get exactly the same screen and the same result.(ie. it directs me to the same win 98se scandisk routine).

If I use my win 98 SUD to boot the machine and select "start without CD-rom support" I get a message in DOS saying that my disk does not contain a valid partition. If I then continue, run FDISK and select option 4 (view partitions) it says all is well. I have one active partition and it is FAT 32.

Alternatively, if I boot up with the SUD and at the A: prompt type "C:enter" (to direct the DOS to drive C) and then type "Scandisk enter" the system appears to try to run scandisk from there, as I believe it should. However, while the normal blue screen appears (NOT that of death!) it appears to carry out the whole routine in about a second (which is wrong) but then reports that no errors were found!

Both machines were working fine for years. Both were loaded with identical software using the selfsame win98se SUD and then the same CD.

So two faults have appeared on the troubled machine. First the scandisk problem when run from windows and second that when it is booted from the SUD it reports that there is not a valid partition (yet there is!).

I have downloaded and run a program from RANISH (details available) which enables me to view partition information, but can see no differance between the faulty machine and the good one other than that the faulty machine has a larger hard drive (160gb) than the other (80gb). The RANISH program has facilities to tweek partitions, but I an NOT playing with these because I do not wish to risk corruption / loss of data.

As to the virus possibility, I have up-to-date NORTON A.V. and have run this several times. It reports no problem whatsoever.

I do not have a separate anti-spyware program installed.

Will try what you suggest and post results. Many thanks for your reply.

Colin 4228

 

[G0AOZ]

From what you've written, I don't think you've tried running SCANDISK this way:-

Boot up from a cold start, (no floppy boot disk inserted) and once the POST screen appears immediately start tapping away on the <F8> key until the WIN98 DOS Boot Menu appears. Select Command Prompt or press <Shift><F5>. You should be at the C:\> prompt. Now try running SCANDISK and see what happens. SCANDISK /AUTOFIX will repair without prompting, and SCANDISK /SURFACE will check out all blocks on the hard drive. (That one may take a long time). Alternatively, type SCANDISK /? to get a list of all options.

My guess is that what happened when you booted up with a floppy was that SCANDISK maybe checked the floppy and not the hard drive perhaps...?

I'm not sure Windows 98 would fully support a 160Gb HDD. Perhaps that's why that partition isn't showing up correctly.

Good as Norton maybe, no single programme finds everything. When I disinfect a virus'd machine, I'll run about 8 different pieces of software to make sure it's squeeky clean. However, that may not be the issue here...

ROGER - G0AOZ.

 

[colin4228]

Roger, Thank you

I tried that routine you suggested from the MS-Dos prompt in windows (mem/debug etc.) and got an identical result on both machines. I have these in the form of .doc, but being new to this site am not sure how to attach them to show to you.

Meanwhile I will try your F8 routine, and report back results.

Colin 4228

 

[colin4228]

Roger,

Further to last, I tried that F8 boot up routine, and got it to run scandisk/autofix. Good news is that a sensible looking scandisk took place (I believe your theory that the previous one was a check of the SUD in A:, despite my having directed DOS to C.

The bad news is that it did not help. That F8 scandisk reported 3 lost chains and fixed them, but that was all. Upon re-booting normally, everything flashed up as usual, but still scandisk from windows gave that error message about lack of memory and refused to function.

So, I re-fitted to the problem machine the previous hard drive (which had displayed the same scandisk problem). [I am quite scrupulous in documenting and archiving previous material, be it hardware or software]. That drive was only 80gb, so could not have exceeded the size which win98 can readily support. On this older drive I repeated your F8 Fdisk routine, which appeared to function sensibly, but reported no errors at all!

Then upon re-booting that older drive normally and trying scandisc it was the same story - "Scandisc can not continue because there is insufficient memory.............etc..............."

So it remains my logical deduction that something "happened" to the previous hard drive, which prevented the correct operation of scandisk on it, and that this problem was passed on to the current drive when I carried out the clone (under Norton Clone). Both of those drives display identical symptoms of scandisk malfunction in what has become the problem machine.

It is tempting to try one of those problem drives in the other machine which appears to be functioning correctly, in order to see if it could somehow be a machine related problem - but the risk of potentially then transferring to that other machine the same problem (be it virus or other)precludes my doing this.

Am out of ideas, and welcome any further thoughts if you have the time.

Thank you

Colin 4228

 

[G0AOZ]

Ok, here's something to try:-

Go to Start, Programs, Accessories, System Tools, System Information. Then select Tools, and run System File Checker. This may request the WIN98 CD.

You could also try going to Start, Run, type in MSCONFIG, and compare AUTOEXEC.BAT, CONFIG.SYS etc., etc., with the other machine.

What about the swapfile? Is Windows creating it automatically? It should be here:- C:\WINDOWS\WIN386.SWP

ROGER - G0AOZ.

 

[colin4228]

Roger, I answered this last night - but must have hit the wrong key because it did not reach the Forum site, so here is a repeat :-

Ran the system file checker. It detected a glitch with setupx.dll, which was corrected from the Win 98 folder on the system CD, and it found and corrected 3 lost chains, but otherwise no problems. This did not correct the scandisc fault.

Ran MSCONFIG and compared all categories there with the "good" machine. Could see no obvious differance. However I did not detail check every sub-element of system.ini and win.ini because there are hundreds of them.

Checked for win386.swp file. It is there, and was apparently last updated yesterday at 1400. Next to it in the list is the windows update log. This seems to update several times a day and, from reading it, poles the microsoft site via internet constantly looking for updates. (I wonder if this serves any purpose now that MS does not support Win 98. But how to stop it? Anyway probably not to do with the scandisk fault).

So not much further forward.

Thinking more today, I think there must be a clue in the different behaviour of FDISK when run from the SUD and when run in windows from programs / MS-Prompt.

With SUD at start up I get the message "...drive C does not contain a valid FAT or FAT32 partition....." But if I go on into FDISK I get the "drive greater than 512mb" warning and on typing Y to this get the normal options. Selecting 4 (view partitions) it describes the drive as 1 - status A - Type Non Dos - 21553 mbytes - System Blank - usage 100%.

Running FDISK from MS-Prompt I get the "greater than 512mb" warning, to which I type Y. Then selecting option 4 the drive is described as C:1 - status A - Type Pri Dos - 21553 mbytes - System FAT 32 - usage 100%.

Thus the two FDISK methods report the same drive in a different way. FDISK via SUD says it is not OK, FDISK via ms-prompt seems to say it is fine! Why? If the scandisk routine in windows uses a process something like the SUD, that may be the area where lies the answer.

Colin 4228

 

[G0AOZ]

I haven't got a WIN98 HDD installation handy at the moment, but it seems to me there may be something wrong with the partition or file allocation table(s).

It's a lot of work for possibly little gain, but you could try formatting a spare HDD, FAT32. Check it's bootable to the DOS prompt. Now copy everything over from the "problem" drive to the newly formatted one, and then see if it boots and runs ok. Now try SCANDISK...

ROGER - G0AOZ.

 

[colin4228]

Thank you Roger. What you suggest is effectively what I did I think when I cloned the current HDD from the former 80gb one, yet this scandisk snag cloned as well. So the problem lies somewhere in what comes across at a clone, it would seem.

Since all else is working OK, and your F8 tip enables me to carry out a scandisk at selective start up and since Norton Disc doctor, system works and so forth seems OK I am reluctant to do too much more at present.

A problem with the partition, file allocation table(s) or MBR does appear to be what has developed. You have devoted much time to helping me, for which I thank you very much. As a last assist for now, can you tell me how to access and read / print out these tables and the MBR.(or where to find such info. Maybe you know a good MS-Dos book?) I could then compare those of the problem machine with those of the OK one and maybe spot a corruption which could be corrected. I can try this using the 80gb HDD from which I cloned the current, so if I make a non-recoverable error (or cock up as we say in the trade) I will not lose all my current stuff.

I have acquired a RANISH partition manager program which works with win 98 and seems to be very capable IF YOU KNOW WHAT YOU ARE DOING!.(Which I do not really). But the documentation with it is rather light. It is shareware. If you can let me know an e-address (without having to make it public on the forum) pse. do so and I will send you the zip file. My tel #44(0)1239 698683 (UK)anytime.

Colin 4228

 

[edfair]

Does the startup disk fail the same way on both machines?

In theory, startup disks from either machine should work the same on both machines. The same for any utilities. I've found it to be true on anything I've worked with but I've never had drives as large as yours.




Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[colin4228]

Thank you edfair,

The answer is no. Initially both machines were working fine in all respects. Then the "problem" machine started to refuse to carry out normal scandisk in windows (see above in thread) and also gave the reported errors when booted from its SUD.

The "OK" machine continues to work just fine running normal scandisk from windows and also when booted from exactly the same SUD reports no problems in that dos phase.

Both machines execute scandisk OK when booted as Roger suggested (above in thread) using the command prompt at start-up by means of hitting F8.

Hence my interest in being able to view / print the MBR etc. to see what is different between these machines. Frustrating!

I have previously not had a problem under 98SE with HDD up to 80gb, nor with larger HDD if single-partitioned to no more than 80gb.

Colin4228

 

[edfair]

I've had no reason to get into a FAT32 hard disk to the sector level but suspect that it could be accomplished with either an earlier version of Norton Utilities or by modifying the debug based zero fill sequence to read and store rather than write.
Probably a good time for a google search for a sector editor working on FAt32 drives.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[colin4228]

Thank you edfair for your further message.

At your suggestion, I spent some hours today searching the web for a suitable sector editor.

There are several, but I found many to be specified for Win 2000 + and not for 98, and when I downloaded some specified as 98 compatible it turned out that they only offered a limited capability for 98, which excluded disc boot analysis.

I found eventually MBR Wizard and Sectedit. Hexprobe looked good, but that was one of those which did not support 98 fully.

MBRwiz tried to run from windows, but I could not get it to go past its list of DOS / options (am not DOS familiar).

Sectedit yielded much better results. With this you can select and display each sector of 512 bytes on a page. The MBR is contained within the first 512 bytes of the hard drive. You know you are looking at it when the last 2 bytes are (hex) 55 AA.

Another internet site I found told me that windows repeats partition tables etc. 6 sectors after the main one. So I compared, using Sectedit, Sector 0 and Sector 6. These should have been the MBR. The problem was that they were both identical, so either my problem is not with a corrupted MBR or somehow both the prime and repeated (6 on) sectors have become identically corrupted.

I do not know how to decode the MBR so as to know where subsequent partitions start, but will be working on this. Maybe one of the partition headers has corrupted.

The internet search did throw up that Norton Clone can change the reported size of partitions.

For your info. some useful internet pages I found were :

http://www.geocities.com/thestarman3/tool/de/PTS-DE.htm

http://www.gull.us/tech/fat32boot-alt.html

http://forums.windrivers.com/showthread.php?t=78634

http://mbrwizard.com/download.shtml

http://www.mbrwizard.com/

I think it worth your while to at least scan these and see if of interest.


If you contact me (tel. no above in thread) I will be pleased to send you the winzip files for MBRwiz and Sectedit. (These are both freeware).
Neither is very large. I'd be interested to know if you can get MBRwiz to run, and if so how. I am unfamiliar with DOS stuff.



Another highly recommended program was PhysTechSoft Disk Editor. but I could not find a download source for this in order to try it.Apparently they sold out to Acronis, and their original download site no longer functions. Shame, because it had very good write-ups.



Colin 4228

 

[edfair]

My congratulations on the efforts you've expended. Not very many looking for help will go to the depth you have.

I was aware of the duplication of FATs. I've used it to pull systems back from the dead. Wasn't aware of the MBR being duplicated. Or if I have run across it I've forgotten.

I have a copy of WINHEX, which I've used to examine disks. Was expensive but a customer bought it for me. And I haven't had a need for it since.

At some point you may decide to reload windows. If you do, an overlay install may resolve the issue. You reinstall to the same location and all the system files are reloded without killing anything else. Be backed up if you try it, it has been effective for me and I've never lost anything, but computers are strange devices as they seem to know the most opportune time to break and create the most damage. The worst case I've had required 4 overlays to get everything straight. Each one corrected something but showed another problem on reboot.

If you put the install stuff on the hard drive you can install from there and save about 2/3 the time.



Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[colin4228]

Thanks edfair. I am the sort of engineer who likes to get to the bottom of things. However the scandisc problem can be lived with, at least for now, because it will run via start-up and using F8, and Norton Disk doctor and, I assume, Speed Disk work. Probably windows de-frag will not work, since this does a scandisc first I believe.

Using Roadkil Sectedit, I have :-
i. Displayed and printed out the 512 byte MBR of the problem machine (sector 0)
ii. Ditto the sector 6 copy of that in the same machine.
iii. Ditto the MBR of the "OK" machine.

i. and ii. are identical, which tends to indicate that the problem is not MBR related, nor the partition table which it seems is embedded in the MBR (64 bytes, starting at 01BE, finishing 01FD)
iii. is almost identical to i and ii. It is absolutely identical in this partition table area. There are some differences in the first 48 bytes of the MBR, but differences are to be expected in that it comes from a different machine fitted with a smaller hard drive.

I then wished to find out just what it the meaning of all the bytes in the MBR. There is quite a good article in Wikipedia (Google "Master Boot Record" to find it)but it does not provide enough detail, and what it says about the structure of the partition tables seems incorrect (it describes them as 18 byte, when they are only 16). Also, Wikipedia mentions only the "IBM" convention for partition tables, whereas from the hex data it rather looks as if windows uses another scheme.

So, in perseverence I would like to ask if anyone knows where I can find a very comprehensive definition of each and every of the 512 bytes in a Win 98SE MBR? Clearly there must be such a definition. I would like this if only out of interest having delved thus far into the deep realms of hard drive structure.

About WINHEX, that is one of the programs I found which did not work, or work to full functionality, under WIN 98SE.That WINHEX was free.

Thanks also for the tips about a re-load. If I do that, would I need to retrieve from MS all the latest 98 updates again? However I am not sure it is a windows problem, because I am also getting this error message when I boot from the SUD and surely at that stage the machine is not making any use of its installed OS but is solely using the disc?

So if it's not windows and not the MBR, what the h*** is it? That MBR definition would in any case prove rather interesting.

Colin 4228

 

[edfair]

I can remember 12, 16, and 32 bit FATs. Strictly a matter of how many bits are required to keep track of sectors or clusters.

I would have suspected that the boot records would have been the same up until the partition table. I would also have suspected that the PT would have been different.

The EBD stuff on the hard drive is created by the install from the CD. Then copied to an EBD when you invoke the creation of it.

The boot sector is machine language. You'll get to learn some new stuff. It is the sequence of steps for the machine to take to get the OS up and running, loading and then transferring control. The differences in machines may just be the difference in location of files. Or possibly a file name, since some names are buried in the code.

It has been a long time since I have had to dig into intel machine language or MS boot coding. Never have liked to deal with either. I was spoiled since I started with motorola stuff and their simpler architecture and implementations plus an operating system that tracked sectors via linked list.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[colin4228]

Dear Readers,

I have continued to try to find why normal scandisk will not run on one of my machines, concentrating on the master boot record and the partition table headers - but without success. However, in the process I have learnt a great deal about these tables, and have from various sources obtained a lot of info. about their format(s) so that confronted with a page of hexadecimal numbers one can decode them into meaningful system paramaters.

Since I have been using a program named DE.EXE (kindly forwarded to me by Roger) I have realised that what I previously thought was my MBR was in fact my partition table header (which looks very much like a MBR, but isn't. I have now found the correct MBR's (at absolute sector 0 and repeated by Windows at sector 6. Now, as should be expected, there is a slight difference between the MBR's of my two machines (since they have different hard-drives of different capacities). However, neither seems obviously wrong.

Lastly, I found what seems a VERY useful program called "Partition Table Doctor" of which a free demo version is available from

http://www.downloadsoftware4free.com

(a ZIP file of 4.62mb). This appears to be an extremely capable program, and it comes with a comprehensive well-illustrated set of user instructions. I thoroughly recommend this program to anyone involved in "fiddling around" with hard drives, particularly the recovery of data from damaged drives and repair of MBR etc.The program works with Win 95 onwards to XP, but they do not list VISTA on the demo version.

The bad news however is that "Partition Table Doctor" reports the drive of the machine which refuses to run Scandisk as having no problems whereas it says that of the machine which seems to work fine HAS got a problem! I am not going to go any further until I have fitted some old hard-drives to a machine and practised the use of this program. Any routine which is capable of altering the MBR / partition tables is also potentially capable of rendering one's hard drive un-usable (save for a complete wipe and re-load).

I am VERY grateful to Roger and Edfair for joining this thread. If and when I get to the bottom of my glitch, I will make a further post.

I hope that the thread will have been of interest and use to other forum members.

Colin 4228

 

[colin4228]

It's a lot of work for possibly little gain, but you could try formatting a spare HDD, FAT32. Check it's bootable to the DOS prompt. Now copy everything over from the "problem" drive to the newly formatted one, and then see if it boots and runs ok. Now try SCANDISK..."

This suggestion from Roger, GOAZ, proved to be the answer to my problem.

Cloning my operating disk (with Norton Ghost) also cloned the problem, whatever it was. However by copying every file across from the problem disk to a clean-formatted blank disk I ended up with a good operating system and program disk which booted up and runs fine.

Notes about copying all files to a blank HDD:

1. When it comes to copying the WINDOWS file, what you need to do is to create a folder on the blank disk called WINDOWS, then copy into it everything up to, but not including, the win386.swp file, then copy into it everything following the win386.swp file. It will not allow you to copy the win386.swp file itself.

2. When copying across the miscellaneous contents of what is in C:/, if you have Norton GoBack installed do not attempt to copy the gobacio.bin file. It will not copy.

3. I found it necessary to completely remove and re-install Norton system works and Norton GoBack after this procedure, but the resulting system disk now seems to be working fine, and carries out a scandisk correctly.

4. Thread 615-1527338 of this forum refers to the use of safe mode to inhibit background programs when running scandisk etc., and to a very useful program called icon restore which restores the desktop icon layout after the use of safe mode. This was kindly suggested by TouchToneTommy.


Problem solved. I hope that the information may be of use to other forum users.

colin4228

 

[johnrfsr]

hi been reading your problem.
it has been my experience that scandisk and defrag have problems with progams running in the background that write to the disk.
norton does write to the disk while the above programs are running, which gives false readings.
before running scandisk or defrag clear your memory of background programs.
this can be done with msconfig
goto start
click on run
type msconfig
when the menu comes you can go to general and clear load startup programs or goto startup and clear all checks
i would suggest that in either case you make a list of checked progams in startup.
that will allow you to restore your settings using msconfig,
when you finish with scandisk or defrag



johnrfsr