{"id":548,"date":"2009-11-18T23:31:02","date_gmt":"2009-11-18T14:31:02","guid":{"rendered":"http:\/\/www.joewein.net\/blog\/?p=548"},"modified":"2009-11-20T13:13:20","modified_gmt":"2009-11-20T04:13:20","slug":"ntfs-disk-corruption-on-frequent-file-creates-and-deletes","status":"publish","type":"post","link":"https:\/\/joewein.net\/blog\/2009\/11\/18\/ntfs-disk-corruption-on-frequent-file-creates-and-deletes\/","title":{"rendered":"NTFS disk corruption on frequent file creates and deletes"},"content":{"rendered":"

I recently upgraded a secondary hard disk<\/a> in a Windows machine from a Seagate Barracuda 7200.11 1 TB drive<\/a> to a Western Digital Caviar Green WD15EADS 1.5 TB drive<\/a>. Mirror imaging the data off the old drive to the new drive using the Linux dd<\/code> utility from an Ubuntu live CD went very smoothly and completed in a little over three hours, but I subsequently hit a snag when I tried to resize the partition on the larger drive. <\/p>\n

The image copy of the 1 TB NTFS partition resulted in a 1 TB partition followed by 500 GB of unallocated space, which I wanted to add to the free space of the NTFS partition. That should be no problem for Linux gparted<\/code>, but only if the partition to be resized is internally consistent. If it is not, one will have to use CHKDSK \/F under Windows to fix it first.<\/p>\n

C:\\>chkdsk m: \/f
\nCHKDSK is verifying files (stage 1 of 3)...
\n 0 percent complete. (0 of 21942736 file records processed)
\nDeleted corrupt attribute list entry
\nwith type code 144 in file 2300.
\nDeleted corrupt attribute list entry
\nwith type code 176 in file 2300.
\nDeleting corrupt attribute record (144, $I30)
\nfrom file record segment 2300.
\nDeleting corrupt attribute record (176, $I30)
\nfrom file record segment 2300.
\nDeleted corrupt attribute list entry
\nwith type code 144 in file 2332.
\nDeleted corrupt attribute list entry
\nwith type code 176 in file 2332.
\nDeleting corrupt attribute record (144, $I30)
\nfrom file record segment 2332.
\nDeleting corrupt attribute record (176, $I30)
\nfrom file record segment 2332.
\nDeleted corrupt attribute list entry
\nwith type code 144 in file 2342.
\nDeleted corrupt attribute list entry
\nwith type code 176 in file 2342.
\nDeleting corrupt attribute record (144, $I30)
\nfrom file record segment 2342.
\nDeleting corrupt attribute record (176, $I30)
\nfrom file record segment 2342.
\n21942736 file records processed.
\nFile verification completed.
\n41475 large file records processed.
\n0 bad file records processed.
\n1552 EA records processed.
\n0 reparse records processed.
\nCHKDSK is verifying indexes (stage 2 of 3)...
\n10 percent complete. (4118 of 81648013 index entries processed)
\nCorrecting error in index $I30 for file 2300.
\n10 percent complete. (5149 of 81648013 index entries processed)
\nCorrecting error in index $I30 for file 2332.
\nCorrecting error in index $I30 for file 2342.
\n34 percent complete. (23316097 of 81648013 index entries processed)
\nCorrecting a minor error in file 2300.
\nCorrecting a minor error in file 2332.
\nCorrecting a minor error in file 2342.
\n81648013 index entries processed.
\nIndex verification completed.
\nCHKDSK is recovering lost files.
\n997 unindexed files processed.
\n997 unindexed files processed.
\nCHKDSK is verifying security descriptors (stage 3 of 3)...
\n21942736 security descriptors processed.
\nSecurity descriptor verification completed.
\nInserting data attribute into file 2300.
\n99 percent complete. (1 of 939015 data files processed)
\nInserting data attribute into file 2332.
\nInserting data attribute into file 2342.
\n939015 data files processed.
\nCorrecting errors in the master file table's (MFT) BITMAP attribute.
\nCorrecting errors in the Volume Bitmap.
\nWindows has made corrections to the file system.<\/code><\/p>\n

1465135996 KB total disk space.
\n 871385828 KB in 18183533 files.
\n 7651336 KB in 939018 indexes.
\n 0 KB in bad sectors.
\n 22057856 KB in use by the system.
\n 65536 KB occupied by the log file.
\n 564040976 KB available on disk.<\/code><\/p>\n

4096 bytes in each allocation unit.
\n 366283999 total allocation units on disk.
\n 141010244 allocation units available on disk.
\n<\/code><\/p>\n

Googling for these error messages, I found a Knowledgebase article by Microsoft<\/a> about disk corruption on Windows NT that could occur with frequent file creates and deletes (for which they had a fix) and a posting by a Windows XP user<\/a> who also frequently creates and deletes files.<\/p>\n

The three files reported by CHKDSK were three folders on my hard disk. CHKDSK converted them into zero length files. After recognizing this, I deleted these files and recreated the original directories. Since then my application has been working again. <\/p>\n

As it so happens, these three directories are three places on my computer where the largest number of files is created and deleted in rapid and random succession (there’s one process each creating them and one process each asynchronously consuming them), just like in the articles that I googled.<\/p>\n

If anyone else comes across a similar problem with NTFS with similar symptoms, I would be glad to hear from them.<\/p>\n

Update 2009-11-20:<\/strong>
\nThe three corrupted folders that were turned into zero length files by ChkDsk did not actually disappear completely. Instead their contents was moved to a hidden folder tree. Note the above lines:<\/p>\n

CHKDSK is recovering lost files.
\n997 unindexed files processed.<\/p><\/blockquote>\n

I looked on the hard disk for hidden files or folder from the command prompt:<\/p>\n

M:\\> dir \/ah m:\\found.*\r\n Volume in drive M is wd15\r\n Volume Serial Number is E861-DD52\r\n\r\n Directory of m:\\\r\n\r\n2009-11-18  17:39    <DIR>          found.000\r\n               0 File(s)              0 bytes\r\n               1 Dir(s)  576,809,738,240 bytes free\r\n<\/pre>\n
This hidden folder contains the three lost directories:<\/p>\n
M:\\>dir m:\\found.000\r\n Volume in drive M is wd15\r\n Volume Serial Number is E861-DD52\r\n\r\n Directory of m:\\found.000\r\n\r\n2009-11-20  12:06    <DIR>          dir0000.chk\r\n2009-11-18  17:39    <DIR>          dir0001.chk\r\n2009-11-18  17:39    <DIR>          dir0002.chk\r\n               0 File(s)              0 bytes\r\n               3 Dir(s)  576,804,810,752 bytes free\r\n<\/pre>\n
Looking at the contents of each of these folders I could soon tell which was which and move those files back to the original path.<\/p>\n","protected":false},"excerpt":{"rendered":"
I recently upgraded a secondary hard disk in a Windows machine from a Seagate Barracuda 7200.11 1 TB drive to a Western Digital Caviar Green WD15EADS 1.5 TB drive. Mirror imaging the data off the old drive to the new … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,23],"tags":[],"class_list":["post-548","post","type-post","status-publish","format-standard","hentry","category-computers","category-windows-xp"],"_links":{"self":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/comments?post=548"}],"version-history":[{"count":11,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/548\/revisions"}],"predecessor-version":[{"id":557,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/posts\/548\/revisions\/557"}],"wp:attachment":[{"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/media?parent=548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/categories?post=548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/joewein.net\/blog\/wp-json\/wp\/v2\/tags?post=548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}