I recently upgraded a secondary hard disk in a Windows machine from a Seagate Barracuda 7200.11 1 TB drive to a Western Digital Caviar Green WD15EADS 1.5 TB drive. Mirror imaging the data off the old drive to the new drive using the Linux dd utility from an Ubuntu live CD went very smoothly and completed in a little over three hours, but I subsequently hit a snag when I tried to resize the partition on the larger drive.

The image copy of the 1 TB NTFS partition resulted in a 1 TB partition followed by 500 GB of unallocated space, which I wanted to add to the free space of the NTFS partition. That should be no problem for Linux gparted, but only if the partition to be resized is internally consistent. If it is not, one will have to use CHKDSK /F under Windows to fix it first.

C:\>chkdsk m: /f
CHKDSK is verifying files (stage 1 of 3)...
0 percent complete. (0 of 21942736 file records processed)
Deleted corrupt attribute list entry
with type code 144 in file 2300.
Deleted corrupt attribute list entry
with type code 176 in file 2300.
Deleting corrupt attribute record (144, $I30)
from file record segment 2300.
Deleting corrupt attribute record (176, $I30)
from file record segment 2300.
Deleted corrupt attribute list entry
with type code 144 in file 2332.
Deleted corrupt attribute list entry
with type code 176 in file 2332.
Deleting corrupt attribute record (144, $I30)
from file record segment 2332.
Deleting corrupt attribute record (176, $I30)
from file record segment 2332.
Deleted corrupt attribute list entry
with type code 144 in file 2342.
Deleted corrupt attribute list entry
with type code 176 in file 2342.
Deleting corrupt attribute record (144, $I30)
from file record segment 2342.
Deleting corrupt attribute record (176, $I30)
from file record segment 2342.
21942736 file records processed.
File verification completed.
41475 large file records processed.
0 bad file records processed.
1552 EA records processed.
0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
10 percent complete. (4118 of 81648013 index entries processed)
Correcting error in index $I30 for file 2300.
10 percent complete. (5149 of 81648013 index entries processed)
Correcting error in index $I30 for file 2332.
Correcting error in index $I30 for file 2342.
34 percent complete. (23316097 of 81648013 index entries processed)
Correcting a minor error in file 2300.
Correcting a minor error in file 2332.
Correcting a minor error in file 2342.
81648013 index entries processed.
Index verification completed.
CHKDSK is recovering lost files.
997 unindexed files processed.
997 unindexed files processed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
21942736 security descriptors processed.
Security descriptor verification completed.
Inserting data attribute into file 2300.
99 percent complete. (1 of 939015 data files processed)
Inserting data attribute into file 2332.
Inserting data attribute into file 2342.
939015 data files processed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

1465135996 KB total disk space.
871385828 KB in 18183533 files.
7651336 KB in 939018 indexes.
0 KB in bad sectors.
22057856 KB in use by the system.
65536 KB occupied by the log file.
564040976 KB available on disk.

4096 bytes in each allocation unit.
366283999 total allocation units on disk.
141010244 allocation units available on disk.


Googling for these error messages, I found a Knowledgebase article by Microsoft about disk corruption on Windows NT that could occur with frequent file creates and deletes (for which they had a fix) and a posting by a Windows XP user who also frequently creates and deletes files.

The three files reported by CHKDSK were three folders on my hard disk. CHKDSK converted them into zero length files. After recognizing this, I deleted these files and recreated the original directories. Since then my application has been working again.

As it so happens, these three directories are three places on my computer where the largest number of files is created and deleted in rapid and random succession (there’s one process each creating them and one process each asynchronously consuming them), just like in the articles that I googled.

If anyone else comes across a similar problem with NTFS with similar symptoms, I would be glad to hear from them.

Update 2009-11-20:
The three corrupted folders that were turned into zero length files by ChkDsk did not actually disappear completely. Instead their contents was moved to a hidden folder tree. Note the above lines:

CHKDSK is recovering lost files.
997 unindexed files processed.

I looked on the hard disk for hidden files or folder from the command prompt:

M:\> dir /ah m:\found.*
 Volume in drive M is wd15
 Volume Serial Number is E861-DD52

 Directory of m:\

2009-11-18  17:39    <DIR>          found.000
               0 File(s)              0 bytes
               1 Dir(s)  576,809,738,240 bytes free

This hidden folder contains the three lost directories:

M:\>dir m:\found.000
 Volume in drive M is wd15
 Volume Serial Number is E861-DD52

 Directory of m:\found.000

2009-11-20  12:06    <DIR>          dir0000.chk
2009-11-18  17:39    <DIR>          dir0001.chk
2009-11-18  17:39    <DIR>          dir0002.chk
               0 File(s)              0 bytes
               3 Dir(s)  576,804,810,752 bytes free

Looking at the contents of each of these folders I could soon tell which was which and move those files back to the original path.