I've been occasionally getting an error message on my Event Viewer,
Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume Hit 1000 winboot."

I'm absolutely certain that these are mostly fake messages, caused by
transient power losses. But still, I can't take a chance, If I were to
follow the advice given in the message and run chkdsk, since it's a boot
disk, it will require a reboot of the system and the chkdsk will run
just prior to system restart. I'd have no problems with that except
chkdsk is woefully slow, it takes over an hour to run it on my system.
I'd rather not run it, if all it's going to find is that there is
nothing wrong with the file system.

I found a technote from Microsoft, which is for a previous version of
Windows:

http://www.microsoft.com/technet/sup...ntfs&LCID=1033

It suggested running the "chkntfs" utility on the drive letter first and
it returns a simple "is dirty" or an "is not dirty" message. Runs in a
few seconds even while online. It usually sends back an "is not dirty"
message. Can this utility be trusted, compared to "chkdsk"? That is, are
there situations which Chkntfs is not aware of that Chkdsk is more
thorough about?

Yousuf Khan

In message <4ee41baa$(E-Mail Removed)> someone claiming to be Yousuf
Khan <(E-Mail Removed)> typed:

>It suggested running the "chkntfs" utility on the drive letter first and
>it returns a simple "is dirty" or an "is not dirty" message. Runs in a
>few seconds even while online. It usually sends back an "is not dirty"
>message. Can this utility be trusted, compared to "chkdsk"? That is, are
>there situations which Chkntfs is not aware of that Chkdsk is more
>thorough about?

chkntfs doesn't actually check anything on the drive except whether the
drive is scheduled for an automatic chkdsk on startup.

If a drive is shut down with potential for data loss in the NTFS
filesystem itself, a chkdsk will be scheduled and run automatically on
the next startup.

That being said, it's very rare that you'll have NTFS corruption these
days unless you have failing hardware, NTFS is reasonably good at
detecting and correcting possible corruption in real time (or the next
time the volume is mounted, in the case of a sudden shutdown)

--
It's always darkest before dawn. So if you're going to
steal your neighbor's newspaper, that's the time to do it.

Yousuf Khan wrote:

> I've been occasionally getting an error message on my Event Viewer, Event ID 55, source Ntfs, message:

> "The file system structure on the disk is corrupt and unusable.
> Please run the chkdsk utility on the volume Hit 1000 winboot."

> I'm absolutely certain that these are mostly fake messages, caused by transient power losses.

They arent necessarily 'fake' if its caused by a transient power loss.

> But still, I can't take a chance, If I were to follow the advice given in the message and run chkdsk, since it's a
> boot disk, it will require a reboot of the system and the chkdsk will run just prior to system restart. I'd have no
> problems with that except chkdsk is woefully slow, it takes over an hour to run it on my system. I'd rather not run
> it, if all it's going to find is that there is nothing wrong with the file system.

Trouble is that since the problem is caused by a transient power loss,
the only way to be sure if it really has been corrupted is to run chkdsk.

> I found a technote from Microsoft, which is for a previous version of Windows:

> http://www.microsoft.com/technet/sup...ntfs&LCID=1033

> It suggested running the "chkntfs" utility on the drive letter first
> and it returns a simple "is dirty" or an "is not dirty" message. Runs
> in a few seconds even while online. It usually sends back an "is not
> dirty" message. Can this utility be trusted, compared to "chkdsk"?
> That is, are there situations which Chkntfs is not aware of that
> Chkdsk is more thorough about?

Its telling you what you already know, if the drive is flagged as dirty,
that you need to run chkdsk. It also allows you to reset that flag if
you want to postpone doing the chkdsk and dont just want to cancel
that manually at reboot time.

One obvious approach is to use a UPS so you dont get transient power losses.

In article <4ee41baa$(E-Mail Removed)>, (E-Mail Removed)
says...
>
> I've been occasionally getting an error message on my Event Viewer,
> Event ID 55, source Ntfs, message:
>
> "The file system structure on the disk is corrupt and unusable. Please
> run the chkdsk utility on the volume Hit 1000 winboot."
>
> I'm absolutely certain that these are mostly fake messages, caused by
> transient power losses. But still, I can't take a chance, If I were to
> follow the advice given in the message and run chkdsk, since it's a boot
> disk, it will require a reboot of the system and the chkdsk will run
> just prior to system restart. I'd have no problems with that except
> chkdsk is woefully slow, it takes over an hour to run it on my system.
> I'd rather not run it, if all it's going to find is that there is
> nothing wrong with the file system.
>
> I found a technote from Microsoft, which is for a previous version of
> Windows:
>
> http://www.microsoft.com/technet/sup...ntfs&LCID=1033
>
> It suggested running the "chkntfs" utility on the drive letter first and
> it returns a simple "is dirty" or an "is not dirty" message. Runs in a
> few seconds even while online. It usually sends back an "is not dirty"
> message. Can this utility be trusted, compared to "chkdsk"? That is, are
> there situations which Chkntfs is not aware of that Chkdsk is more
> thorough about?
>
> Yousuf Khan

This is like continuing to drive a car after the oil light comes on.
Yes, it *might* be a false alarm, but...

It's perfectly possible that your disk is on its last legs, and you're
days or even hours away from total, unrecoverable loss. Yes, that's the
worst case, but I see it regularly.

What I'd do is this:

Back up all data on the disk to separate physical storage

Image the disk (e.g. Acronis True Image, or Windows Complete backup)
again to separate physical storage. (This preserves Windows, and the
effort that might otherwise go into installing it, and all you
applications and settings.

If you have anything installed which can monitor the disk's SMART data
(e.g. HDTune) run that and see if any of the parameters, particularly
"Reallocated Sectors" is showing an alert.

I use a paid-for utility called Spinrite to audit and manage the state
of sectors on the disk (this also reports SMART status). It can take 48
hours to run for a large disk, especially if it's struggling to recover
data from failing sectors.

Then I'd run the fullest version of chkdsk, which only takes a couple of
hours, typically.

If you can't spare an hour or so to run chkdsk when the system seems to
be asking you to, then you have to accept you could lose everything.

Once you're confident your syste is ok, install HDTune or Acronis Disk
Monitor (configure it not to monitor backups, if you don't want these
alerts).

Disks don't last for ever!

--

Phil, London

On 11/12/2011 6:20 AM, DevilsPGD wrote:
> chkntfs doesn't actually check anything on the drive except whether the
> drive is scheduled for an automatic chkdsk on startup.
>
> If a drive is shut down with potential for data loss in the NTFS
> filesystem itself, a chkdsk will be scheduled and run automatically on
> the next startup.
>
> That being said, it's very rare that you'll have NTFS corruption these
> days unless you have failing hardware, NTFS is reasonably good at
> detecting and correcting possible corruption in real time (or the next
> time the volume is mounted, in the case of a sudden shutdown)

I have a task attached to the NTFS error event in the event viewer. The
task immediately notifies me when this error occurs with a pop-up
message. The message pops up in the middle of normal operations most of
the time, not during power failures or improper shutdowns most of the
time. That's not to say that message occurs often, it's only happened 4
times in the last two months, so far, and three of those occurred three
times in a row on one particular day in November, for what reason I
don't know; so I'd consider that only one incident really. Even during
the November incident when running chkdsk during the next reboot, it
found nothing wrong.

Yousuf Khan

On 11/12/2011 2:15 PM, Rod Speed wrote:
>> It suggested running the "chkntfs" utility on the drive letter first
>> and it returns a simple "is dirty" or an "is not dirty" message. Runs
>> in a few seconds even while online. It usually sends back an "is not
>> dirty" message. Can this utility be trusted, compared to "chkdsk"?
>> That is, are there situations which Chkntfs is not aware of that
>> Chkdsk is more thorough about?
>
> Its telling you what you already know, if the drive is flagged as dirty,
> that you need to run chkdsk. It also allows you to reset that flag if
> you want to postpone doing the chkdsk and dont just want to cancel
> that manually at reboot time.

Well, then it's strange because even though I see the message in the
event viewer, chkntfs says that there is nothing wrong. You'd think if
it appears in Event Viewer, then the flag would've been set by the
operating system on that file system?

Yousuf Khan

On 11/12/2011 2:42 PM, Philip Herlihy wrote:
> This is like continuing to drive a car after the oil light comes on.
> Yes, it *might* be a false alarm, but...
>
> It's perfectly possible that your disk is on its last legs, and you're
> days or even hours away from total, unrecoverable loss. Yes, that's the
> worst case, but I see it regularly.
>
> What I'd do is this:
>
> Back up all data on the disk to separate physical storage

The disk is already imaged weekly. However, there are no additional
errors listed in the drive's own SMART logs. There are several
indicators saying that nothing is wrong, but one that is saying that
something may be wrong.

Yousuf Khan

On 12/11/2011, Philip Herlihy posted:
> This is like continuing to drive a car after the oil light comes on.
> Yes, it *might* be a false alarm, but...

And to reinforce that, I never have forgotten this anecdote:

My friend's fiance was temporarily a few hundred miles away, so she
couldn't look over his shoulder to prevent this. The oil light in his
car was on, so he decided he needed to get the *light* fixed fairly
soon.

He procrastinated longer than the engine lasted...

He was a rather non-technical person, so he hadn't realized what was
going on. Which is pretty much stating the obvious.

--
Gene E. Bloch (Stumbling Bloch)

Yousuf Khan wrote
> Rod Speed wrote

>>> It suggested running the "chkntfs" utility on the drive letter first
>>> and it returns a simple "is dirty" or an "is not dirty" message.
>>> Runs in a few seconds even while online. It usually sends back an
>>> "is not dirty" message. Can this utility be trusted, compared to
>>> "chkdsk"? That is, are there situations which Chkntfs is not aware
>>> of that Chkdsk is more thorough about?

>> Its telling you what you already know, if the drive is flagged as
>> dirty, that you need to run chkdsk. It also allows you to reset that
>> flag if you want to postpone doing the chkdsk and dont just want to
>> cancel that manually at reboot time.
>
> Well, then it's strange because even though I see the message in the event viewer, chkntfs says that there is nothing
> wrong.

chkntfs doesnt check for problems, it JUST shows the dirty flag and allows you to cancel it.

> You'd think if it appears in Event Viewer, then the flag would've been set by the operating system on that file
> system?

Nope, the DIRTY flag gets set for other reasons.

In article <4ee5555f$(E-Mail Removed)>, (E-Mail Removed)
says...
>
> On 11/12/2011 2:42 PM, Philip Herlihy wrote:
> > This is like continuing to drive a car after the oil light comes on.
> > Yes, it *might* be a false alarm, but...
> >
> > It's perfectly possible that your disk is on its last legs, and you're
> > days or even hours away from total, unrecoverable loss. Yes, that's the
> > worst case, but I see it regularly.
> >
> > What I'd do is this:
> >
> > Back up all data on the disk to separate physical storage
>
> The disk is already imaged weekly. However, there are no additional
> errors listed in the drive's own SMART logs. There are several
> indicators saying that nothing is wrong, but one that is saying that
> something may be wrong.
>
> Yousuf Khan

The most valuable part of your system is invariably the data on that
disk, so you may get some peace of mind by installing the free Acronis
Disk Monitor. It has a facility to monitor backups run by the (also
excellent) Acronis True Image but if you don't need those alerts you can
disable them. It's saved several customers from data loss (and there's
one on their way for a disk swap as I write).

--

Phil, London