This is leading me to suspect that CHKDSK may be erroneously reporting
errors that do not really exist.
Running chkdsk in read-only mode will do that.
Don't even bother running CHKDSK in read-only mode. It is a waste of time
and prone to not accurately reporting information. CHKDSK might report
spurious errors because it cannot lock the drive.
"Chkdsk might not accurately report information in read-only mode."
From...
Chkdsk
http://www.microsoft.com/resources/...windows/xp/all/reskit/en-us/prmb_tol_pwfd.asp
<quote>
If you run chkdsk without the /f command-line option on an active
partition, it might report spurious errors because it cannot lock the
drive.
<quote>
<quote>
Using chkdsk with open files
If you specify the /f command-line option, chkdsk sends an error message if
there are open files on the disk. If you do not specify the /f command-line
option and open files exist, chkdsk might report lost allocation units on
the disk. This could happen if open files have not yet been recorded in the
file allocation table. If chkdsk reports the loss of a large number of
allocation units, consider repairing the disk.
<quote>
From...
Chkdsk
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/chkdsk.mspx
<quote>
In read-only mode, CHKDSK quits before it completes all three phases if it
encounters errors in earlier phases, and CHKDSK is prone to falsely
reporting errors. For example, CHKDSK may report disk corruption if NTFS
happens to modify areas of a disk while CHKDSK is examining the disk. For
correct verification, a volume must be static, and the only way to guarantee
a static state is to lock the volume. CHKDSK locks the volume only if you
specify the /F switch (or the /R switch, which implies /F). You may need to
run CHKDSK more than once to get CHKDSK to complete all its passes
in read-only mode.
<quote>
From...
An Explanation of the New C and I Switches That Are Available to Use with
Chkdsk.exe
http://support.microsoft.com/kb/314835
------------------
For a look at the chkdsk log.
Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Look in Application | Listed as Information |
Event ID: 1001
Source: Winlogon
[[Description: This includes file system type; drive letter or GUID, and
volume name or serial number to help determine what volume Chkdsk ran
against. Also included is whether Chkdsk ran because a user scheduled it or
because the dirty bit was set.]]
[[When Autochk runs against a volume at boot time it records its output to a
file called Bootex.log in the root of the volume being checked. The Winlogon
service then moves the contents of each Bootex.log file to the Application
Event log.]]
[[This file states whether Chkdsk encountered any errors and, if so,
whether they were fixed.]]
------------
Reading a chkdsk log
chkdsk log will be similar to this...
Checking file system on C:
The type of the file system is NTFS.
Volume label is Local Disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 10 unused index entries from index $SII of file 0x9.
Cleaning up 10 unused index entries from index $SDH of file 0x9.
Cleaning up 10 unused security descriptors.
4096543 KB total disk space.
2906360 KB in 19901 files.
6344 KB in 1301 indexes.
0 KB in bad sectors.
49379 KB in use by the system.
22544 KB occupied by the log file.
1134460 KB available on disk.
4096 bytes in each allocation unit.
1024135 total allocation units on disk.
283615 allocation units available on disk.
It is housecleaning and housecleaning is going to happen if you run
chkdsk.exe. Think Merry Maids with brooms.
Cleaning up minor inconsistencies on the drive.
[[In the above error message, "minor inconsistencies" refers to a state
where redundant information stored in different places is "out of synch."
This is a natural and expected condition whenever there are open files on
the volume that have undergone modification. The redundant information is
not brought into synchronization until the files are closed. Typically, this
error message occurs when CHKDSK is run against the volume containing
Windows NT system files (including active user profiles and the pagefile).
WORKAROUND
You can usually safely ignore this error message even if the message appears
without there being open files, because it is only the redundant information
that is out of synchronization. The only side effect you may see as a result
of this message is an incorrect reading of free disk space or something
similar. ]]
from...
"CHKDSK detected minor inconsistencies" error message in Windows 2000 and in
Windows NT
http://support.microsoft.com/kb/109524
Cleaning up 10 unused index entries from index $SII of file 0x9.
Cleaning up 10 unused index entries from index $SDH of file 0x9.
[[Chkdsk.exe reports only unused index and security descriptor entries that
were removed. ]]
[[Chkdsk.exe just reclaims the unused security descriptors as a housekeeping
activity, and it does not actually fix any kind of problem. ]]
from...
Windows 2000 Chkdsk Reports Cleaning Unused Security Descriptors
http://support.microsoft.com/kb/255008
Cleaning up 10 unused security descriptors.
[[When you delete a file or folder with permissions that you've set by hand
rather than allowed to be automatically inherited from its parent, the ACL
(Access Control List, the security descriptor) isn't deleted, but cached.
Running CHKDSK against these "dead" items cleans up the ACLs that are no
longer in use and frees up space. ]]
from...
Tip: Don't Panic At CHKDSK "Security Descriptor" Cleanup
http://www.winmag.com/columns/powerw2k/2000/46.htm#tip
[[This problem occurs because if Chkdsk is run against an NTFS volume,
Chkdsk.exe may report that security descriptors are in the database that are
no longer referenced by any file or folder and that it is removing them.
However, Chkdsk.exe just reclaims the unused security descriptors as a
housekeeping activity, and it does not actually fix any kind of problem. ]]
from...
Windows 2000 Chkdsk Reports Cleaning Unused Security Descriptors
http://support.microsoft.com/kb/255008
[[4096543 KB total disk space.
(This value is the total formatted disk capacity.)
2906360 KB in 19901 files.
(This value is the space used by user file data.)
6344 KB in 1301 indexes.
(This value is the space used by NTFS indexes.)
0 KB in bad sectors.
(This value is the space lost to bad sectors.)
49379 KB in use by the system.
(This value is includes MFT and other NTFS metafiles.)
22544 KB occupied by the log file.
(This value is the NTFS Log file; you use the chkdsk /l:size to adjust this
value.)
1134460 KB available on disk.
(This value is the available FREE disk space.)
4096 bytes in each allocation unit.
(This value is the cluster size [4K])
1024135 total allocation units on disk.
(This value is the total clusters on disk.)
283615 allocation units available on disk.
(This value is the available free clusters.) ]]
from...
How to locate and correct disk space problems on NTFS volumes in Windows XP
http://support.microsoft.com/kb/315688
See also...
Understanding what CHKDSK does
here...
An explanation of the new /C and /I Switches that are available to use with
Chkdsk.exe
http://support.microsoft.com/kb/314835
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In
M and D said:
A follow-up to my original post:
According to the MSKB article I cited in my original post: "This problem
occurs because the Chkdsk utility may not find references to all the
security IDs if the master file table is larger than 4 gigabytes (GB) or
if there are more than 4,194,303 files on the volume."
I just finished running Windows Defragmenter on my C:\ drive, because I
remembered that the report it provides at the conclusion of a defrag
includes the size of the master file table and total number of files on
the volume. The results are as follows:
Total MFT size: 65MB -- nowhere near 4GB! [76% of the MFT is in use]
Total number of files: 47,120 -- nowhere near 4 million!
This is leading me to suspect that CHKDSK may be erroneously reporting
errors that do not really exist.
In any case, as I said at the outset, " I am way out of my league on this
one" so I really hope someone can help me out here. And thanks for
reading thus far.
M and D
Folks, I am way out of my league on this one so I really hope someone can
help.
My C:\ drive has the problem described in "The CHKDSK utility incorrectly
identifies and deletes in-use security descriptors" [MSKB 831374]:
http://support.microsoft.com/kb/831374
I believe this to be true since my symptoms are identical to the symptoms
described in the article.
A bit of background:
I ran CHKDSK on my C:\ drive at reboot. The second stage ("CHKDSK is
verifying indexes") took several minutes to complete, so I figured
something was wrong. When Windows re-started I ran CHKDSK in read-only to
see if my C:\ drive was now free of errors. No, said CHKDSK, your drive
still has errors, run CHKDSK again at reboot. So I ran CHKDSK again at
reboot, and again the second stage took several minutes to complete, and
when Windows re-started I again ran CHKDSK in read only, and again CHKDSK
said 'you still have errors, run CHKDSK at restart'....
This went on and on. After the fifth time of running CHKDSK at bootup I
decided to look at Event Viewer, and that's where I saw exactly the
symptoms reported in the above MSKB article.
According to the article: "This problem occurs because the Chkdsk utility
may not find references to all the security IDs if the master file table
is larger than 4 gigabytes (GB) or if there are more than 4,194,303 files
on the volume. Therefore, the undiscovered security descriptors are
reset."
I don't understand most of that, but I'm very sure that I have /way/ less
than 4 million files on my C:\ drive. I don't know how to check if my
master file table is really larger than 4 gigabytes.
The recommended resolution is to "obtain the latest service pack for
Windows XP", but I am completely up to date at Microsoft Update.
I'm really at a loss. What do I do about this?
M and D