On Thu, 29 Jan 2004 01:15:45 -0000, "Gerry Cornell"
An Explanation of the New /C and /I Switches That Are Available to Use with Chkdsk.exe
http://support.microsoft.com/default.aspx?scid=kb;en-us;314835&Product=winxp
Nice article, and - as is often the case once you get beyond the
knee-jerk posturing and into more detailled documentation - it's
refreshingly frank about NTFS's "robustness". Quotes:
"Metadata is 'data about data' that keeps track of information
about all of the files that are stored on the volume. The data
that the file contains is termed 'user data'. NTFS protects its
metadata through the use of a transaction log. User data is
not protected in this way."
....so much for "transaction rollback" as data saviour...
"If CHKDSK finds directory listings for file record segments
that are no longer in use, or for file record segments that
are in use but that do not correspond to the file that is listed
in the directory, CHKDSK simply removes the directory entry
for the file record segment."
....bye-bye data! Not clear as how ChkDsk determines that "file record
segments do not correspond to the file that is listed in the
directory", but the gist of it is; what ChkDsk destructively "fixes"
will become unrecoverable, as cues to recovery are lost.
"When CHKDSK finds an unreadable sector, NTFS adds the
cluster that contains that sector to its list of bad clusters. If
the bad cluster is in use, CHKDSK allocates a new cluster to
do the job of the bad cluster. If you are using a fault-tolerant
disk, NTFS recovers the bad cluster's data and writes the data
to the newly allocated cluster. Otherwise, the new cluster is
filled with a pattern of 0xFF bytes."
For most of us, that is going to be "Otherwise...". It gets worse...
"If NTFS encounters unreadable sectors during the course of
normal operation, NTFS remaps the sectors in the same way
that it does when CHKDSK runs."
....i.e. NTFS does pretty much what the HD's internal defect management
does; silently "fixes" bad sectors, even if the contents are trashed.
No alerts means fewer support calls and within-warranty swaps; it also
means more inexplicable bit-rot and data loss, and longer periods of
data corruption before someone finally figures out what is happening.
Finally, the summary accurately states:
"Note also that NTFS does not guarantee the integrity of user
data after an instance of disk corruption, even if you immediately
run a full CHKDSK operation. There might be files that CHKDSK
cannot recover, and files that CHKDSK does recover might still
be internally corrupted. It remains vitally important that you
protect mission-critical data by performing periodic backups
or by using some other robust method of data recovery."
From the way "just use NTFS!" advocates around here go on, you'd think
NTFS *was* the "...other robust method of data recovery" that
consumers who lack periodic backups or fault-tolerant RAID need.
--------------- ----- ---- --- -- - - -
Dreams are stack dumps of the soul
