Persistent message: "The file or directory is corrupt and unreadable."

[-DG-]

XP SP2:

I keep getting a popup from the taskbar:
"Windows - Corrupt File The file or directory is corrupt and
unreadable."

EventVwr reports an NTFS error on C: I've run chkdsk every time this
occurs, including surface scan. Also chkdsk'd other drives just to
make sure. No errors reported at any time.

Sometimes the system crashes when this occurs. Sometimes it stays
running.

The current system was running solid until SP2 was installed. Could
be a coincidence, but I suspect that it's software-related.

Any ideas?

 

[Jon]

XP SP2:

I keep getting a popup from the taskbar:
"Windows - Corrupt File The file or directory is corrupt and
unreadable."

EventVwr reports an NTFS error on C: I've run chkdsk every time this
occurs, including surface scan. Also chkdsk'd other drives just to
make sure. No errors reported at any time.

Sometimes the system crashes when this occurs. Sometimes it stays
running.

The current system was running solid until SP2 was installed. Could
be a coincidence, but I suspect that it's software-related.

Any ideas?

Try running chkdsk in verbose mode, from the command line ( -v option)

Start > run > cmd
chkdsk /?

Jon

 

[-DG-]

Try running chkdsk in verbose mode, from the command line ( -v option)

I hadn't tried /V. This is very weird: I ran "Chkdsk /F C:", then
"Chkdsk /R C:" immediately after (surface check). Both queue chkdsk
to run during boot. No errors reported. However, running
"Chkdsk /V C:" immediately after that reports this:

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
Detected minor inconsistencies on the drive. This is not a
corruption.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.
Cleaning up 1 unused security descriptors.
Security descriptor verification completed.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

So there is a problem that Chkdsk is either misdiagnosing or just not
fixing. Another run of Chkdsk /V C: had reported:

Correcting errors in the master file table's (MFT) BITMAP
attribute.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

I had never seen "BITMAP" applied to disk integrity. In any case, the
previous run of chkdsk /F and /R in both cases should have corrected
file and directory structures. It doesn't seem to be doing that. Or
the /V option has a bug.

 

[David Candy]

Bitmap, like a picture bitmap, is a map. In this case of used and unused clusters so unused ones can be found quickly.

Cleaning up 1 unused index entries from index $SII of file 9.
is not an error but non essential house keeping. It's not worth doing in normal operation so chkdsk does it. Doesn't matter if it is never done.

Is your computer shutting down.

 

[Jon]

The chkdsk output looks pretty standard - just slightly more verbose with
the /v option.

Presumably this popup, if you're still getting it, identifies a particular
file / directory that is "corrupt and unreadable", in which case you may
need to consider removing / replacing it.

Jon

 

[-DG-]

Bitmap, like a picture bitmap, is a map. In this case of used and unused clusters so unused ones can be found quickly.

Cleaning up 1 unused index entries from index $SII of file 9.
is not an error but non essential house keeping. It's not worth doing in normal operation so chkdsk does it. Doesn't matter if it is never done.

So the subsequent notice to run "Chkdsk /F" is unrelated to that
report?

Is your computer shutting down.

Not shutting down, but I've had unexplained lockups. Sometimes
shortly after boot, so I can't attribute them to any given software.
Last couple happened right after the system booted after a
'chkdsk /F C:' (which reported no errors). Brought up a command
prompt, typed 'chkdsk /V C:', hit the enter key...locked.

Also occasionally see the popup that I mentioned, showing:
"Windows - Corrupt File The file or directory is corrupt and
unreadable. Please run the chkdsk utility." When this happens,
Event viewer shows "The file system structure on the disk is corrupt
and unusable. Please run the chkdsk utility on the volume C:"

 

[-DG-]

The chkdsk output looks pretty standard - just slightly more verbose with
the /v option.

The Chkdsk /V output includes this:
"Windows found problems with the file system."
"Run CHKDSK with the /F (fix) option to correct these."

That can't be normal.

Presumably this popup, if you're still getting it, identifies a particular
file / directory that is "corrupt and unreadable", in which case you may
need to consider removing / replacing it.

Jon

I'm not sure how to identify while file is causing the problem, Jon.
I've tried "sfc /scannow." It did not report any errors.

 

[David Candy]

Are you looking through your event log? The disk problems may cause blue screen crashes or may be caused by them.

Chkdsk only alters the disk if /f is specified. I presume this applies to the housekeeping task too (a user who has been deleted is having their reference to the file removed).

I presume you have SP2 as the housekeeping part was a frequent message in non SP2 versions. Anyway this is nothing to do with crashes or disk corruption.

Look through event viewer and read the following.

Type verifier in Start Run, follow the wizard but choose All Drivers. This will slow down your computer and cause more blue screen crashes but will pinpoint what is causing the crash (if the original error message didn't). Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue screen. Make sure you are set to record minidumps (Small Memory Dumps) - type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to david @ mvps.org. Don't send me lots of them. Just the one from your last crash after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful for searching, but NTStatus codes are (plus you can look them up here http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).

 

[Jon]

The Chkdsk /V output includes this:
"Windows found problems with the file system."
"Run CHKDSK with the /F (fix) option to correct these."

That can't be normal.


I'm not sure how to identify while file is causing the problem, Jon.
I've tried "sfc /scannow." It did not report any errors.

The first place it should be mentioned is in the original popup
ie Is this the *exact* text of the popup, or was a file or directory
mentioned ??

"Windows - Corrupt File The file or directory is corrupt and
unreadable."

?

Secondly, when you run chkdsk from the command line with the /v option, and
there is genuinely a corrupted / unreadable file, often chkdsk will give you
a problematic file number eg 2345 or something similar, which corresponds to
its entry number in the MFT. This information can also lead to identifying
the problematic file, if given. (entry 9 is not significant in this respect)

Looking at the "Winlogon" chkdsk entries in Event Viewer (Information entry
on Application node) , and /or information gained from running chkdsk, using
the recovery console, can sometimes also provide more information.

Otherwise, another possibility is that it is malware, giving you false popup
messages.


Jon

 

[cquirke (MVP Windows shell/user)]

Nasty. What file or directory?

I hadn't tried /V. This is very weird: I ran "Chkdsk /F C:", then
"Chkdsk /R C:" immediately after (surface check). Both queue chkdsk
to run during boot. No errors reported. However, running
"Chkdsk /V C:" immediately after that reports this:

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
Detected minor inconsistencies on the drive. This is not a
corruption.

I hate over-summarized reporting!

CHKDSK is verifying security descriptors (stage 3 of 3)...
Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.
Cleaning up 1 unused security descriptors.
Security descriptor verification completed.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

ChkDsk still has a half-written feel about it - e.g. the way that
ChkDsk without the /F will report as if it was "fixing" errors and
then disclaim this at the end.

ChkDsk without the /F is known to throw spurious errors on files that
are "in use", which would prompt ChkDsk /F to refuse to run and set
itself to run on next boot instead. Then a recent thread suggests
ChkDsk doesn't test files "in use" and thus doesn't detect errors
there, either false or real ones.

So there is a problem that Chkdsk is either misdiagnosing or just not
fixing. Another run of Chkdsk /V C: had reported:

Correcting errors in the master file table's (MFT) BITMAP
attribute.

That, AFAIK, is the table that flags clusters as free for use or not.

Whereas a FAT would hold addresses several bits in size, pointing to
the next cluster address or 0 for "empty", this bitmap is indexed in
the same way but retuirns only 1 bit (not, say, a 16- or 32-bit
address) that shows whether trhe cluster is free or not.

The cluster's relationship to other clusters is implied differently,
i.e. whether it is in a "run" of contiguous data clusters as pointed
to within a file's data definition elsewhere.

You don't want to have a corrupted bitmap that indicates used data
clusters as free for use, etc.

Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

I had never seen "BITMAP" applied to disk integrity. In any case, the
previous run of chkdsk /F and /R in both cases should have corrected
file and directory structures. It doesn't seem to be doing that. Or
the /V option has a bug.

Or perhaps ChkDsk checks the bitmap and finds spurious errors, while
ChkDsk /F checks it and finds it's OK. Or there really are errors
that ChkDsk /F doesn't detect, because it doesn't check?

One needs proper documentation on this stuff - any magic /kb?

------------ ----- ---- --- -- - - - -

The most accurate diagnostic instrument
in medicine is the Retrospectoscope

 

[cquirke (MVP Windows shell/user)]

Not shutting down, but I've had unexplained lockups. Sometimes
shortly after boot, so I can't attribute them to any given software.

Is the HD LED on when it locks up? If so, suspect bad HD and test
with HD Tune or similar. If not, suspect other bad hardware, unless
the lockups magically stop when you disconnect off all networks; if
that happens, malware activity or bad network hardware becomes more
likely. Bad RAM can corrupt in-progress ChkDsk results, but typically
differently every time. Bad disk would be more consistent.

------------ ----- ---- --- -- - - - -

The most accurate diagnostic instrument
in medicine is the Retrospectoscope

 

[-DG-]

The first place it should be mentioned is in the original popup
ie Is this the *exact* text of the popup, or was a file or directory
mentioned ??

Jon, That was the exact text. Small popup 'status' bubble at lower
right. It would have been nice if it mentioned specifics. I got the
additional location info from Event viewer, but even that didn't
provide any specific files, etc.

Popup: Windows - Corrupt File The file or directory is corrupt
and unreadable. Please run the chkdsk utility.
Event log: The file system structure on the disk is corrupt and
unusable. Please run the chkdsk utility on the volume C:

Secondly, when you run chkdsk from the command line with the /v option, and
there is genuinely a corrupted / unreadable file, often chkdsk will give you
a problematic file number eg 2345 or something similar, which corresponds to
its entry number in the MFT. This information can also lead to identifying
the problematic file, if given. (entry 9 is not significant in this respect)

I was starting to suspect that these message were insignificant, as
they come up every time:
Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.

I've seen the same message with a index number, but was not sure
how to trace back to a file/folder name.

Looking at the "Winlogon" chkdsk entries in Event Viewer (Information entry
on Application node) , and /or information gained from running chkdsk, using
the recovery console, can sometimes also provide more information.

I hadn't run Chkdsk via the Recovery Console. I'll try that if it
resurfaces, but aside from the 'index 9' message above, it seems to
have disappeared. Of course I'd still like to find the cause, as I
don't trust that the file/dir structure is sound at this point.

In searching for data on the repeating error messages, I did turn up a
couple posts recounting similar circumstances--The poster kept running
Chkdsk /F until the problem went away.

 

[David Candy]

Install Perfect Disk (www.raxco.com) - there are trial versions. There is a menu item to look up file name from file id (you have to analyse the disk before you can use that menu item).

 

[-DG-]

Are you looking through your event log? The disk problems may
cause blue screen crashes or may be caused by them.

No literal blue-screens, just freezes. The only useful runtime info
has come from the event log, but that has not be specific. At least
it gives the drive (C.

Chkdsk only alters the disk if /f is specified.

The error popups have disappeared for the past day or two, but
only after repeatedly running chkdsk /F or /R.

I presume this applies to the housekeeping task too (a user who
has been deleted is having their reference to the file removed).
I presume you have SP2 as the housekeeping part was a
frequent message in non SP2 versions.

Not sure I follow the above. And I'm the only user on this system
(laptop). No deleted users.

Look through event viewer and read the following.

Type verifier in Start Run, follow the wizard but choose All Drivers.
This will slow down your computer and cause more blue screen
crashes but will pinpoint what is causing the crash...

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)
Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

That's great info. I hadn't heard of Verifier. I've logged the
procedure you recommended in case the problem resurfaces. I'm
assuming it will, as I've done nothing to correct it aside from
running Chkdsk /F over and over. However I've turned up posts about
similar scenarios...fixed by repeated Chkdsk/F's.

Thanks, David.

 

[Jon]

Ok, well if the problem is not recurring, then hopefully, as you say, chkdsk
has done its mysterious work and resolved it for you.


WinHex is another excellent tool, that can also be used to relate MFT File
Entry numbers to specific filenames. Let me know, if you need instructions,
on how to do that, using the program.

You can download a usable evaluation version, for free, here
http://www.x-ways.net/winhex/index-m.html


Jon