Corrupt NTFS Filesystem

  • Thread starter Thread starter Bob
  • Start date Start date
B

Bob

Almost every time I reboot my Win2K/SP4 system, CHKDSK runs because
Win2K detected a "corrupt ntfs filesystem" on the boot disk. Every
once in a while I get a BSOD instead, in which case I have to move the
bad disk to D: and run CHKDSK manually from inside Win2K.

In both instances CHKDSK fixes the problem(s) and my disk is good to
go. What I would like to know is what is causing this. The entries in
Event Viewer do not help any.

When I have to run CHKDSK on a disk that resulted in a BSOD, the
repair entails fixing multitudinous "file descriptors" - what looks
like literally hundreds of them.

When I run the Defrag utility that comes with Win2K, there are two
entries for the boot disk

System Disk
System Disk (C:)

The parameters are identical and Defrag will operate on either of
them. There is also a pair for the Backup disk D: I have never seen
any double drive configurations before like this.

What is wrong and how do I fix it?
 
The drive may have failed. I'd download and run a disk diagnostic utility
from the drive manufacturer's web site.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Bob"wrote:
| Almost every time I reboot my Win2K/SP4 system, CHKDSK runs because
| Win2K detected a "corrupt ntfs filesystem" on the boot disk. Every
| once in a while I get a BSOD instead, in which case I have to move the
| bad disk to D: and run CHKDSK manually from inside Win2K.
|
| In both instances CHKDSK fixes the problem(s) and my disk is good to
| go. What I would like to know is what is causing this. The entries in
| Event Viewer do not help any.
|
| When I have to run CHKDSK on a disk that resulted in a BSOD, the
| repair entails fixing multitudinous "file descriptors" - what looks
| like literally hundreds of them.
|
| When I run the Defrag utility that comes with Win2K, there are two
| entries for the boot disk
|
| System Disk
| System Disk (C:)
|
| The parameters are identical and Defrag will operate on either of
| them. There is also a pair for the Backup disk D: I have never seen
| any double drive configurations before like this.
|
| What is wrong and how do I fix it?
|
|
|
| --
|
| "It has been said that politics is the second oldest profession.
| I have learned that it bears a striking resemblance to the first."
| --Ronald Reagan
 
Almost every time I reboot my Win2K/SP4 system,
Click to expand...


You should describe this system, concise list of all major
components including the HDD(s).
CHKDSK runs because
Win2K detected a "corrupt ntfs filesystem" on the boot disk. Every
once in a while I get a BSOD instead, in which case I have to move the
bad disk to D: and run CHKDSK manually from inside Win2K.
Click to expand...

Have you ran the HDD manufacturer's utilities?
In both instances CHKDSK fixes the problem(s) and my disk is good to
go. What I would like to know is what is causing this. The entries in
Event Viewer do not help any.

When I have to run CHKDSK on a disk that resulted in a BSOD, the
repair entails fixing multitudinous "file descriptors" - what looks
like literally hundreds of them.

When I run the Defrag utility that comes with Win2K, there are two
entries for the boot disk

System Disk
System Disk (C:)

The parameters are identical and Defrag will operate on either of
them. There is also a pair for the Backup disk D: I have never seen
any double drive configurations before like this.

What is wrong and how do I fix it?
Click to expand...

See what's showing up in Disk Management.
 
Bob said:
Almost every time I reboot my Win2K/SP4 system, CHKDSK runs because
Win2K detected a "corrupt ntfs filesystem" on the boot disk. Every
once in a while I get a BSOD instead, in which case I have to move the
bad disk to D: and run CHKDSK manually from inside Win2K.

In both instances CHKDSK fixes the problem(s) and my disk is good to
go. What I would like to know is what is causing this. The entries in
Event Viewer do not help any.

When I have to run CHKDSK on a disk that resulted in a BSOD, the
repair entails fixing multitudinous "file descriptors" - what looks
like literally hundreds of them.

When I run the Defrag utility that comes with Win2K, there are two
entries for the boot disk

System Disk
System Disk (C:)

The parameters are identical and Defrag will operate on either of
them. There is also a pair for the Backup disk D: I have never seen
any double drive configurations before like this.

What is wrong and how do I fix it?
Click to expand...

This is certainly not conclusive, but I have seen this exact behavior
from an underpowered system. Use a power supply calculator, like the
one linked below, to compare your component load to your supply's
rating. Even if that suggests that you have enough juice, it's possible
that your power supply is not living up to its rating. Someone here can
probably comment on the quality of your supply, based upon its brand name.

http://www.jscustompcs.com/power_supply/
 
Bob said:
The parameters are identical and Defrag will operate on either of
them. There is also a pair for the Backup disk D: I have never seen
any double drive configurations before like this.
Click to expand...

I think you have to have a close look at your partitioning. Looks to me
like your partition table has some serious errors. I don't think chkdsk
is able to fix those kinds of errors either, you should probably look
into something like fix-it utilities or partition magic. In any case:
BACK UP YOUR DATA OFTEN until you've fixed this problem.

Mark.
 
Bob said:
Almost every time I reboot my Win2K/SP4 system, CHKDSK runs because
Win2K detected a "corrupt ntfs filesystem" on the boot disk. Every
once in a while I get a BSOD instead, in which case I have to move the
bad disk to D: and run CHKDSK manually from inside Win2K.

In both instances CHKDSK fixes the problem(s) and my disk is good to
go. What I would like to know is what is causing this. The entries in
Event Viewer do not help any.

When I have to run CHKDSK on a disk that resulted in a BSOD, the
repair entails fixing multitudinous "file descriptors" - what looks
like literally hundreds of them.

When I run the Defrag utility that comes with Win2K, there are two
entries for the boot disk

System Disk
System Disk (C:)

The parameters are identical and Defrag will operate on either of
them. There is also a pair for the Backup disk D: I have never seen
any double drive configurations before like this.

What is wrong and how do I fix it?



--

"It has been said that politics is the second oldest profession.
I have learned that it bears a striking resemblance to the first."
--Ronald Reagan
Click to expand...
could be memory errors - run memtest
 
Have you ran the HDD manufacturer's utilities?
Click to expand...

Not all of them. I have both the DLG Tools and Diags. I will run the
diags next.

I periodically swap three identical disks (80GB WD) into the boot disk
tray, and each of them shows the same behavior.
See what's showing up in Disk Management.
Click to expand...

I see only one disk. The same for Device Manager - Disk Drives.
 
This is certainly not conclusive, but I have seen this exact behavior
from an underpowered system. Use a power supply calculator, like the
one linked below, to compare your component load to your supply's
rating. Even if that suggests that you have enough juice, it's possible
that your power supply is not living up to its rating. Someone here can
probably comment on the quality of your supply, based upon its brand name.
Click to expand...
http://www.jscustompcs.com/power_supply/
Click to expand...

198 watts.

The PSU I have is rated at 350 watts.

This is not an exotic machine: Celeron D, 2 sticks of DDR RAM, onboard
(MCI Mainboard) video, sound, NIC, two WD 80 GB HDs and an NEC 3540
DVD burner.

I used to get a lot of errors with the USR Journal but that has
quieted down.

Event Viewer shows that the detection of this corruption occurs at
shutdown. IOW, the entry I find when I fix the disk and reboot is
timed exactly with when I shut down.
 
Bob said:
198 watts.

The PSU I have is rated at 350 watts.

This is not an exotic machine: Celeron D, 2 sticks of DDR RAM,
onboard (MCI Mainboard) video, sound, NIC, two WD 80 GB HDs and
an NEC 3540 DVD burner.

I used to get a lot of errors with the USR Journal but that has
quieted down.

Event Viewer shows that the detection of this corruption occurs
at shutdown. IOW, the entry I find when I fix the disk and
reboot is timed exactly with when I shut down.
Click to expand...

Given that you have a NTFS system you are probably using an
ever-suspect Windoze system. My guess would be that the system
isn't smart enough to wait for pending file system writes to
complete before shutting down. Maybe simply waiting a minute or so
with a totally inactive system before powering down would do it.

Alternatively, unless you are using ECC memory, you may have the
odd bad memory bit. This is much less likely than sloppy OS
programming.

--
"If you want to post a followup via groups.google.com, don't use
the broken "Reply" link at the bottom of the article. Click on
"show options" at the top of the article, then click on the
"Reply" at the bottom of the article headers." - Keith Thompson
More details at: <http://cfaj.freeshell.org/google/>
Also see <http://www.safalra.com/special/googlegroupsreply/>
 
Given that you have a NTFS system you are probably using an
ever-suspect Windoze system.
Click to expand...

Actually Win2K is the best of the lot.
My guess would be that the system
isn't smart enough to wait for pending file system writes to
complete before shutting down. Maybe simply waiting a minute or so
with a totally inactive system before powering down would do it.
Click to expand...

I already tried disabling the write cache - it did not help.
Alternatively, unless you are using ECC memory, you may have the
odd bad memory bit. This is much less likely than sloppy OS
programming.
Click to expand...

Would I not see the system crash, at least once in a while? I run full
POST memory check with no problems. I will run Memtest 386 next.
 
I think you have to have a close look at your partitioning. Looks to me
like your partition table has some serious errors. I don't think chkdsk
is able to fix those kinds of errors either, you should probably look
into something like fix-it utilities or partition magic.
Click to expand...

I repartitioned one of the disks with WD DLG Tools and then cloned it
with Acronis True Image. It did not help any.
In any case:
BACK UP YOUR DATA OFTEN until you've fixed this problem.
Click to expand...

I have two removable drive bays (Kingwin KF-23) that I use to make
clones and swap them around. I have 3 identical WD 80GB HDs that I
rotate thru the boot disk position.

The second bay is used for a second disk with Win2K. I lay off an
NTBACK of C onto D:, including the Registry, for added safety.

I use the best ATA-133 80-wire ribbon cable for the IDE connections to
the removable bays. I have never experienced any problems with the
bays like crashing during operation.
 
Maybe simply waiting a minute or so
with a totally inactive system before powering down would do it.
Click to expand...

I usually do exactly that.

If I make a clone and use it as the boot disk, the problem does not
show up the first day. I can reboot all I want and see no problem.

If I wait a day or longer then most but not all of the time I will
experience this problem with CHKDSK running on startup. But there is
nothing in the Event Viewer to indicate that something went wrong
before I restart. It's only after I repair the disk and get Win2K
started that I see the "corrupt ntfs" error in Event Viewer. In fact
it occurs twice with the same exact words.
 
Not all of them. I have both the DLG Tools and Diags. I will run the
diags next.
Click to expand...


You snipped out the most important part, ie-
You should describe this system, concise list of all major
components including the HDD(s). It's a hardware group, no?

Why are we left guessing about these things, we don't even
know if your drives are ATA or SATA or the board chipset,
etc? Since we don't know, it may or may not be reasonable
to suggest looking for a motherboard bios update. Does the
chipset use a driver or windows native driver? It's not a
question for you to answer, it's a question that should have
been evident when you postd what this hardware is.

If you're not going to tell us about the hardware then it's
a windows issue, not a hardware issue.
 
Alternatively, unless you are using ECC memory, you may have the
odd bad memory bit. This is much less likely than sloppy OS
programming.
Click to expand...

I ran the WD DLG DIAG and it passed. I ram Memtest 86 and it passed.

I got another BSOD and so I put the bad disk in as D: and booted from
an earlier clone. I ran CHKDSK D: /F which has succeeded in repairing
the bad disk in the past.

But this time I redirected stdout to a file so I would preserve the
record of what CHKDSK did. The contents are below - sorry for the
length, but I wanted you to see everything.

+++
The type of the file system is NTFS.
Volume label is System Disk.

CHKDSK is verifying files (stage 1 of 3)...
0 percent completed.
Deleted corrupt attribute list entry
with type code 128 in file 9.
Deleting corrupt attribute record (128, $SDS)
from file record segment 9.
1 percent completed.
[etc.]
100 percent completed.
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
0 percent completed.
[etc.]
100 percent completed.
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Repairing the security file record segment.
Deleting an index entry with Id 256 from index $SII of file 9.
Deleting an index entry with Id 257 from index $SII of file 9.
Deleting an index entry with Id 258 from index $SII of file 9.
Deleting an index entry with Id 259 from index $SII of file 9.
Deleting an index entry with Id 256 from index $SDH of file 9.
Deleting an index entry with Id 258 from index $SDH of file 9.
Deleting an index entry with Id 259 from index $SDH of file 9.
Deleting an index entry with Id 257 from index $SDH of file 9.
0 percent completed.
Replacing invalid security id with default security id for file 11.
Replacing invalid security id with default security id for file 29.
Replacing invalid security id with default security id for file 189.
Replacing invalid security id with default security id for file 566.
1 percent completed.
Replacing invalid security id with default security id for file 1401.
Replacing invalid security id with default security id for file 1544.
2 percent completed.
Replacing invalid security id with default security id for file 1860.
3 percent completed.
Replacing invalid security id with default security id for file 2692.
4 percent completed.
Replacing invalid security id with default security id for file 3243.
5 percent completed.
6 percent completed.
7 percent completed.
Replacing invalid security id with default security id for file 6162.
8 percent completed.
9 percent completed.
10 percent completed.
11 percent completed.
Replacing invalid security id with default security id for file 8969.
Replacing invalid security id with default security id for file 9246.
12 percent completed.
[etc.]
100 percent completed.
Security descriptor verification completed.
CHKDSK is verifying Usn Journal...
Repairing Usn Journal file record segment.
Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

78148160 KB total disk space.
25884131 KB in 29884 files.
10458 KB in 2837 indexes.
0 KB in bad sectors.
164249 KB in use by the system.
65536 KB occupied by the log file.
52089322 KB available on disk.

512 bytes in each allocation unit.
156296321 total allocation units on disk.
104178644 allocation units available on disk.
+++
 
If you're not going to tell us about the hardware then it's
a windows issue, not a hardware issue.
Click to expand...

There is nothing special about the hardware. I am having no problems
with anything other than this one thing. I have no reason to suspect
the hardware - other than the disk drive.

It's because of the possibility of the disk being the cause that I
posted it to this forum.

The only other thing that I need to mention is that the hard disks are
mounted in removable drive bays - Kingwin KF-23. I have seen no
problems with them when I run windows - no corrupted files other than
when I shut down. I do not believe the removable bays are the problem.
 
Here's more about the reason the nifs filesystem is corrupt. These
entries comes from Event Viewer - Security.

+++
The description for Event ID ( 49 ) in Source ( Ftdisk ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event:
\Device\HarddiskVolume1.
+++

+++
The description for Event ID ( 55 ) in Source ( Ntfs ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event: , C:.
+++
 
There is nothing special about the hardware. I am having no problems
with anything other than this one thing. I have no reason to suspect
the hardware - other than the disk drive.
Click to expand...

I suspect you would reach the most knowledgeable group with
a post to a general purpose win2k or Winxp group, rather
than either you've posted to. It may indirectly be a
filesystem problem, pinpointed by a general windows
assessment.

It's because of the possibility of the disk being the cause that I
posted it to this forum.

The only other thing that I need to mention is that the hard disks are
mounted in removable drive bays - Kingwin KF-23. I have seen no
problems with them when I run windows - no corrupted files other than
when I shut down. I do not believe the removable bays are the problem.
Click to expand...

Hopefully not, but if you really want to get to the bottom
of this it might not hurt to simply remove that additional
interface for the time being.
 
Here's more about the reason the nifs filesystem is corrupt. These
entries comes from Event Viewer - Security.

+++
The description for Event ID ( 49 ) in Source ( Ftdisk ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event:
\Device\HarddiskVolume1.
+++

+++
The description for Event ID ( 55 ) in Source ( Ntfs ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event: , C:.
+++
Click to expand...


Have you done anything to deviate from a standard Win2k SP4
installation? Well, of course you must have, but anything
that might be relevant? Any startup switches in your
boot.ini file? Any so-called memory tweaks? Any manual
settings of the pagefile?

Did you ever consider that if you knew what the problem
was, THEN you would be able to make such sweeping
conclusiosn such as "Not the hardware"? Maybe it's not, but
there have been drive controllers that cause loss at
shutdown. I didn't ask for the fun of it.

You should take the event viewer info and put it into MS'
website search or post it to a general purpose Win2k group.
 
Have you done anything to deviate from a standard Win2k SP4
installation? Well, of course you must have, but anything
that might be relevant? Any startup switches in your
boot.ini file? Any so-called memory tweaks? Any manual
settings of the pagefile?
Click to expand...

The installation is pretty conventional. The only thing I can think of
that is new is the installation of the Computer Associate anti-virus
package called E-Trust EZ AntiVirus (free to RoadRunner subscribers).

The thing that puzzles me is that the corruption only shows up after I
reboot. I just began to run NTBACKUP every morning and once it failed
to run because the volume was corrupt - so it manages to detect the
problem early.
Did you ever consider that if you knew what the problem
was, THEN you would be able to make such sweeping
conclusiosn such as "Not the hardware"?
Click to expand...

If there was a problem with the hardware, would I not see more
problems than just this one?
Maybe it's not, but
there have been drive controllers that cause loss at
shutdown. I didn't ask for the fun of it.
Click to expand...

I realize the importance of sound hardware. But I have no reason to
suspect the hardware separate from this problem.

As I have mentioned, I am using Kingwin KF-23 removable bays for my
hard drives. I am using ATA-133 80-wire ribbon cable. I have no reason
to suspect this to be causing a problem because I run Acronis True
Image all the time and it has never created an corrupt clone.
You should take the event viewer info and put it into MS'
website search or post it to a general purpose Win2k group.
Click to expand...

Please recommend which groups would be best.

I am getting tired of this hassle all the time. I need to fix it.
Maybe I should just do a new install of Win2K. But that would take
days to reconfigure so I prefer not having to do it.

Since I have three identical drives, and I am able to repair a corrupt
one by running CHKDSK from a second drive, I may dedicate one drive to
a new install with minimal apps to see what happens. If I need all the
machinery I have on my main disk, I can always swap it back in easily.

On a separate matter, can I make a floopy-based or CD-based boot disk
that will run the Win2k version of CHKDSK? I am using NTFS. Or maybe I
need to create a small extra partition on the boot disk with Win2K so
I can boot to it and not have to swap drives around if I lock up with
a BSOD.
 
Back
Top