Bad Sector Retesting tool for NTFS?

  • Thread starter Thread starter Sheridan Hutchinson
  • Start date Start date
If someone wants to experiment, open the volume with dskprobe. View the boot
sector as NTFS, go to the MFT, and read 10 sectors. Sector 8 should be the
$badclus record. Zero the first few bytes and run chkdsk /f. I know chkdsk
will rebuild $bitmap, so it should also do $badclus.
 
Eric Gisin said:
If someone wants to experiment, open the volume with dskprobe. View the boot
sector as NTFS, go to the MFT, and read 10 sectors. Sector 8 should be the
$badclus record. Zero the first few bytes and run chkdsk /f. I know chkdsk
will rebuild $bitmap, so it should also do $badclus.

One sector is 512 bytes and one MFT record is 1024 bytes. $badclus is
the 9th MFT record or 8th if we start counting at 0. Thus the
instructions aren't correct. But actually this doesn't really matter
since the MFT records aren't necessarily placed consecutively and in
this situation one could just delete totally unrelated data randomly
if followed the advices.

The modified, free open source tool below does reset the NTFS bad
block list at the right place.
 
Sz. Csetey said:
One sector is 512 bytes and one MFT record is 1024 bytes. $badclus is
the 9th MFT record or 8th if we start counting at 0. Thus the
instructions aren't correct. But actually this doesn't really matter
since the MFT records aren't necessarily placed consecutively and in
this situation one could just delete totally unrelated data randomly
if followed the advices.
OK, I confused records and sectors. Record 8, or sector 16, under Win 2K3.
It's pretty obvious were the name is in there. Everyone should learn dskprobe,
and find their way to FATs and MFTs.
The modified, free open source tool below does reset the NTFS bad
block list at the right place.
But you have to patch and build a Linux utility. Most NT users don't have a
full Linux install.
 
Eric Gisin said:
But you have to patch and build a Linux utility. Most NT users don't have a
full Linux install.

Quoting from http://www.bodden.de/misc/ntfsrecovery/ referred twice
earlier:

1) [...] go to e.g. Knoppix.de and get yourself a Linux
that boots entirely from CD-ROM.

2) Download a pre-patched version of the ntfs tools here
and extract it.

In other words, you don't need to patch, you don't need to build the
utility and you don't need Linux installed.

There are many Linux live distros that boot and run only in RAM from a
floppy, cd, dvd, usb keys, etc. Actually most of the very low level
recovery, filesystem manipulation tools work the same way: they don't
use the the installed OS because it can use, lock critical files and
the files either can't be safely modified or modofocation is denied by
the installed OS.
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sz. Csetey said:
The only way to reset NTFS bad block list is explained at
http://www.bodden.de/misc/ntfsrecovery/

Thank you very much! This is just what I've been looking for!

- --
Regards,
Sheridan Hutchinson
(e-mail address removed) or ICQ# 332-123-498


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQA/AwUBQJh3Bvw9TKasPKYwEQJc0ACfVDQFVXLwg0k4oYJP94dYXifkwp0Ani8o
G7J/glgQMwwwDRSwX54m076O
=hdbY
-----END PGP SIGNATURE-----
 
Does anyone know of any less complex way to solve this problem?

FWIW I just had an unreadable block reported by my image backup
software (acronis trueimage). A chkdsk /R found the block and mapped
it out with no loss of data.
 
Interesting, especially so in that my issue concerns Acronis TrueImage 7.0,
which you say maps out the bad sectors. I did a chkdsk /r prior to creating
an image using Acronis and yet TrueImage copied the same 44 KB in bad
sectors to the cloned new drive which I verified as having no bad sectors.
The bad sectors are reported after doing a chkdsk from the command prompt,
but do not show if I run tests on the hard drive using the manufacturers
check disking software. In other words, the 44KB in bad sectors reflects
only on the restored image, not on the hard disk itself.
 
Interesting, especially so in that my issue concerns Acronis TrueImage 7.0,
which you say maps out the bad sectors. I did a chkdsk /r prior to creating
an image using Acronis and yet TrueImage copied the same 44 KB in bad
sectors to the cloned new drive which I verified as having no bad sectors.
The bad sectors are reported after doing a chkdsk from the command prompt,
but do not show if I run tests on the hard drive using the manufacturers
check disking software. In other words, the 44KB in bad sectors reflects
only on the restored image, not on the hard disk itself.

I didn't say that TI maps out bad sectors. It "found one".

chkdsk /r found and fixed it.

Send the logs into support ? I had a nice discussion with Acronis
support (via email). It took a few days to respond to the initial
message but fater that it was next-day response.
 
I sent the log into Acronis, but tech support is virtually non-existent.
With Acronis you're basically on your own (of course that's probably true
with other vendors as well). I've been advised that Ghost will map out the
bad sectors and give an accurate chkdsk -- is this true? This is a minor
annoyance but one which one would think could be addressed by some creative
programming.

Al Dykes said:
Interesting, especially so in that my issue concerns Acronis TrueImage 7.0,
which you say maps out the bad sectors. I did a chkdsk /r prior to creating
an image using Acronis and yet TrueImage copied the same 44 KB in bad
sectors to the cloned new drive which I verified as having no bad sectors.
The bad sectors are reported after doing a chkdsk from the command prompt,
but do not show if I run tests on the hard drive using the manufacturers
check disking software. In other words, the 44KB in bad sectors reflects
only on the restored image, not on the hard disk itself.

I didn't say that TI maps out bad sectors. It "found one".

chkdsk /r found and fixed it.

Send the logs into support ? I had a nice discussion with Acronis
support (via email). It took a few days to respond to the initial
message but fater that it was next-day response.

 
Back
Top