Chkdsk vs. Chkntfs?

[Yousuf Khan]

I've been occasionally getting an error message on my Event Viewer,
Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume Hit 1000 winboot."

I'm absolutely certain that these are mostly fake messages, caused by
transient power losses. But still, I can't take a chance, If I were to
follow the advice given in the message and run chkdsk, since it's a boot
disk, it will require a reboot of the system and the chkdsk will run
just prior to system restart. I'd have no problems with that except
chkdsk is woefully slow, it takes over an hour to run it on my system.
I'd rather not run it, if all it's going to find is that there is
nothing wrong with the file system.

I found a technote from Microsoft, which is for a previous version of
Windows:

http://www.microsoft.com/technet/su...=5.2.3790.1830&EvtID=55&EvtSrc=ntfs&LCID=1033

It suggested running the "chkntfs" utility on the drive letter first and
it returns a simple "is dirty" or an "is not dirty" message. Runs in a
few seconds even while online. It usually sends back an "is not dirty"
message. Can this utility be trusted, compared to "chkdsk"? That is, are
there situations which Chkntfs is not aware of that Chkdsk is more
thorough about?

Yousuf Khan

 

[DevilsPGD]

In message <[email protected]> someone claiming to be Yousuf

It suggested running the "chkntfs" utility on the drive letter first and
it returns a simple "is dirty" or an "is not dirty" message. Runs in a
few seconds even while online. It usually sends back an "is not dirty"
message. Can this utility be trusted, compared to "chkdsk"? That is, are
there situations which Chkntfs is not aware of that Chkdsk is more
thorough about?

chkntfs doesn't actually check anything on the drive except whether the
drive is scheduled for an automatic chkdsk on startup.

If a drive is shut down with potential for data loss in the NTFS
filesystem itself, a chkdsk will be scheduled and run automatically on
the next startup.

That being said, it's very rare that you'll have NTFS corruption these
days unless you have failing hardware, NTFS is reasonably good at
detecting and correcting possible corruption in real time (or the next
time the volume is mounted, in the case of a sudden shutdown)

 

[Rod Speed]

I've been occasionally getting an error message on my Event Viewer, Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Hit 1000 winboot."

I'm absolutely certain that these are mostly fake messages, caused by transient power losses.

They arent necessarily 'fake' if its caused by a transient power loss.

But still, I can't take a chance, If I were to follow the advice given in the message and run chkdsk, since it's a
boot disk, it will require a reboot of the system and the chkdsk will run just prior to system restart. I'd have no
problems with that except chkdsk is woefully slow, it takes over an hour to run it on my system. I'd rather not run
it, if all it's going to find is that there is nothing wrong with the file system.

Trouble is that since the problem is caused by a transient power loss,
the only way to be sure if it really has been corrupted is to run chkdsk.

I found a technote from Microsoft, which is for a previous version of Windows:

It suggested running the "chkntfs" utility on the drive letter first
and it returns a simple "is dirty" or an "is not dirty" message. Runs
in a few seconds even while online. It usually sends back an "is not
dirty" message. Can this utility be trusted, compared to "chkdsk"?
That is, are there situations which Chkntfs is not aware of that
Chkdsk is more thorough about?

Its telling you what you already know, if the drive is flagged as dirty,
that you need to run chkdsk. It also allows you to reset that flag if
you want to postpone doing the chkdsk and dont just want to cancel
that manually at reboot time.

One obvious approach is to use a UPS so you dont get transient power losses.

 

[Philip Herlihy]

I've been occasionally getting an error message on my Event Viewer,
Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume Hit 1000 winboot."

I'm absolutely certain that these are mostly fake messages, caused by
transient power losses. But still, I can't take a chance, If I were to
follow the advice given in the message and run chkdsk, since it's a boot
disk, it will require a reboot of the system and the chkdsk will run
just prior to system restart. I'd have no problems with that except
chkdsk is woefully slow, it takes over an hour to run it on my system.
I'd rather not run it, if all it's going to find is that there is
nothing wrong with the file system.

I found a technote from Microsoft, which is for a previous version of
Windows:

http://www.microsoft.com/technet/su...=5.2.3790.1830&EvtID=55&EvtSrc=ntfs&LCID=1033

It suggested running the "chkntfs" utility on the drive letter first and
it returns a simple "is dirty" or an "is not dirty" message. Runs in a
few seconds even while online. It usually sends back an "is not dirty"
message. Can this utility be trusted, compared to "chkdsk"? That is, are
there situations which Chkntfs is not aware of that Chkdsk is more
thorough about?

Yousuf Khan

This is like continuing to drive a car after the oil light comes on.
Yes, it *might* be a false alarm, but...

It's perfectly possible that your disk is on its last legs, and you're
days or even hours away from total, unrecoverable loss. Yes, that's the
worst case, but I see it regularly.

What I'd do is this:

Back up all data on the disk to separate physical storage

Image the disk (e.g. Acronis True Image, or Windows Complete backup)
again to separate physical storage. (This preserves Windows, and the
effort that might otherwise go into installing it, and all you
applications and settings.

If you have anything installed which can monitor the disk's SMART data
(e.g. HDTune) run that and see if any of the parameters, particularly
"Reallocated Sectors" is showing an alert.

I use a paid-for utility called Spinrite to audit and manage the state
of sectors on the disk (this also reports SMART status). It can take 48
hours to run for a large disk, especially if it's struggling to recover
data from failing sectors.

Then I'd run the fullest version of chkdsk, which only takes a couple of
hours, typically.

If you can't spare an hour or so to run chkdsk when the system seems to
be asking you to, then you have to accept you could lose everything.

Once you're confident your syste is ok, install HDTune or Acronis Disk
Monitor (configure it not to monitor backups, if you don't want these
alerts).

Disks don't last for ever!

 

[Yousuf Khan]

chkntfs doesn't actually check anything on the drive except whether the
drive is scheduled for an automatic chkdsk on startup.

If a drive is shut down with potential for data loss in the NTFS
filesystem itself, a chkdsk will be scheduled and run automatically on
the next startup.

That being said, it's very rare that you'll have NTFS corruption these
days unless you have failing hardware, NTFS is reasonably good at
detecting and correcting possible corruption in real time (or the next
time the volume is mounted, in the case of a sudden shutdown)

I have a task attached to the NTFS error event in the event viewer. The
task immediately notifies me when this error occurs with a pop-up
message. The message pops up in the middle of normal operations most of
the time, not during power failures or improper shutdowns most of the
time. That's not to say that message occurs often, it's only happened 4
times in the last two months, so far, and three of those occurred three
times in a row on one particular day in November, for what reason I
don't know; so I'd consider that only one incident really. Even during
the November incident when running chkdsk during the next reboot, it
found nothing wrong.

Yousuf Khan

 

[Yousuf Khan]

Its telling you what you already know, if the drive is flagged as dirty,
that you need to run chkdsk. It also allows you to reset that flag if
you want to postpone doing the chkdsk and dont just want to cancel
that manually at reboot time.

Well, then it's strange because even though I see the message in the
event viewer, chkntfs says that there is nothing wrong. You'd think if
it appears in Event Viewer, then the flag would've been set by the
operating system on that file system?

Yousuf Khan

 

[Yousuf Khan]

This is like continuing to drive a car after the oil light comes on.
Yes, it *might* be a false alarm, but...

It's perfectly possible that your disk is on its last legs, and you're
days or even hours away from total, unrecoverable loss. Yes, that's the
worst case, but I see it regularly.

What I'd do is this:

Back up all data on the disk to separate physical storage

The disk is already imaged weekly. However, there are no additional
errors listed in the drive's own SMART logs. There are several
indicators saying that nothing is wrong, but one that is saying that
something may be wrong.

Yousuf Khan

 

[Gene E. Bloch]

This is like continuing to drive a car after the oil light comes on.
Yes, it *might* be a false alarm, but...

And to reinforce that, I never have forgotten this anecdote:

My friend's fiance was temporarily a few hundred miles away, so she
couldn't look over his shoulder to prevent this. The oil light in his
car was on, so he decided he needed to get the *light* fixed fairly
soon.

He procrastinated longer than the engine lasted...

He was a rather non-technical person, so he hadn't realized what was
going on. Which is pretty much stating the obvious.

 

[Rod Speed]

Yousuf Khan wrote

Rod Speed wrote

Well, then it's strange because even though I see the message in the event viewer, chkntfs says that there is nothing
wrong.

chkntfs doesnt check for problems, it JUST shows the dirty flag and allows you to cancel it.

You'd think if it appears in Event Viewer, then the flag would've been set by the operating system on that file
system?

Nope, the DIRTY flag gets set for other reasons.

 

[Philip Herlihy]

The disk is already imaged weekly. However, there are no additional
errors listed in the drive's own SMART logs. There are several
indicators saying that nothing is wrong, but one that is saying that
something may be wrong.

Yousuf Khan

The most valuable part of your system is invariably the data on that
disk, so you may get some peace of mind by installing the free Acronis
Disk Monitor. It has a facility to monitor backups run by the (also
excellent) Acronis True Image but if you don't need those alerts you can
disable them. It's saved several customers from data loss (and there's
one on their way for a disk swap as I write).

 

[Yousuf Khan]

The most valuable part of your system is invariably the data on that
disk, so you may get some peace of mind by installing the free Acronis
Disk Monitor. It has a facility to monitor backups run by the (also
excellent) Acronis True Image but if you don't need those alerts you can
disable them. It's saved several customers from data loss (and there's
one on their way for a disk swap as I write).

I'm using the licensed Macrium Reflect as my backup and imaging app. I
found it good enough to upgrade from its free version.

Yousuf Khan

 

[Yousuf Khan]

And to reinforce that, I never have forgotten this anecdote:

My friend's fiance was temporarily a few hundred miles away, so she
couldn't look over his shoulder to prevent this. The oil light in his
car was on, so he decided he needed to get the *light* fixed fairly soon.

He procrastinated longer than the engine lasted...

He was a rather non-technical person, so he hadn't realized what was
going on. Which is pretty much stating the obvious.

Some people just shouldn't be using modern appliances like cars. One
lady I know, bought an expensive car, but never could even be bothered
to learn how to operate the rear window defroster on it. One day she
showed up at the airport after a severe ice storm and had a full layer
of ice caked on the back window with no way to see out of it. I asked
her why she didn't just hit the rear window defroster, even if she
couldn't be bothered to scrape it off by hand. She said she didn't know
where the button was, nor that she had such a button!

Another lady, who I didn't know, but she was stuck after snowstorm, and
she was in a Jeep. We were helping her try to get out, and then I asked
her if the four-wheel drive system on her Jeep wasn't working? She asked
what's four-wheel drive!?

Yousuf Khan

 

[Philip Herlihy]

I'm using the licensed Macrium Reflect as my backup and imaging app. I
found it good enough to upgrade from its free version.

Yousuf Khan

Sure, but does this tool monitor the health of your disk and flag up
alerts when appropriate?

 

[Rod Speed]

Yousuf Khan wrote

Gene E. Bloch wrote

Some people just shouldn't be using modern appliances like cars.

Now we can design them so that even those
can use them with better warning messages.

One lady I know, bought an expensive car, but never could even be bothered to learn how to operate the rear window
defroster on it. One day she showed up at the airport after a severe ice storm and had a full layer of ice caked on
the back window with no way to see out of it. I asked her why she didn't just hit the rear window defroster, even if
she couldn't be bothered to scrape it off by hand. She said she didn't
know where the button was, nor that she had such a button!

And its now possible to design a car so she doesnt need to know.

Another lady, who I didn't know, but she was stuck after snowstorm,
and she was in a Jeep. We were helping her try to get out, and then I
asked her if the four-wheel drive system on her Jeep wasn't working?
She asked what's four-wheel drive!?

And its now possible to design a car so she doesnt need to know that either.

 

[Yousuf Khan]

Sure, but does this tool monitor the health of your disk and flag up
alerts when appropriate?

Not really something that I'm looking for in a backup/imaging utility,
as I have Hard Disk Sentinel to do that for me.

Yousuf Khan