a better Chkdsk?

[Frank]

XP Home SP2

Norton's Disk Doctor says I have a "file structure problem", I have
"Fix Errors" checked and schedule a Repair on re-start.
On re-start, Windows runs Chkdsk and reports "no problems"

Is there a better Utility to repair my HD?

As a side issue, this is a FAT32 volume that will not convert to NTFS.
(might be this subtle disk error causing the non-convert ??)

 

[VanguardLH]

XP Home SP2

Norton's Disk Doctor says I have a "file structure problem", I have
"Fix Errors" checked and schedule a Repair on re-start.
On re-start, Windows runs Chkdsk and reports "no problems"

Is there a better Utility to repair my HD?

SpinRite
www.grc.com

Running "chkdsk" does absolutely nothing to fix any problems on the
hard disk. It only does a scan to report any problems. If you want
to attempt to fix them, include either the /f or /r command-line
switches. Run "chkdsk /?" to get help on using chkdsk.

 

[John John]

XP Home SP2

Norton's Disk Doctor says I have a "file structure problem", I have
"Fix Errors" checked and schedule a Repair on re-start.
On re-start, Windows runs Chkdsk and reports "no problems"

Is there a better Utility to repair my HD?

As a side issue, this is a FAT32 volume that will not convert to NTFS.
(might be this subtle disk error causing the non-convert ??)

You've not told us if any errors were recorded in the System Event Log,
Convert failure errors are usually recorded there. Can you look at the
following registry key and tell us what is present there:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

John

 

[Frank]

I do know about the /f switch...
If I go to Run and enter chkdsk c:/f it will schedule a repair.... and
report no problems on re-booting.

 

[VanguardLH]

I do know about the /f switch...
If I go to Run and enter chkdsk c:/f it will schedule a repair....
and report no problems on re-booting.

Then use the /r switch to have chkdsk check the sectors are readable.
Rather than just check the file system is okay, it also ensures the
data is readable from the platters. It is not an infallible check. I
believe the OS will permit up to 5 retries to read a sector before
saying there is a problem reading from it, and hard disks may permit
up to, say, 3 retries before reporting an error, so it could be 15
retries total of which it could take only one, like the last one, to
get the data to pass the test.

SpinRite is a better low-level sector test utility but it isn't free.
What users don't realize is that retentivity of a sector wanes over
time unless its data is read and rewritten. The dipoles to record the
data are under magnetic stress and will alter alignment over time. If
magnetic data, which includes the file system, is not exercised, it
will lose its ability to be read. Microsoft has never provided a
utility to read and rewrite all bits in every sector on the hard disk.
They also provide poor utilities to determine the reliability or
retention of a sector's area on the hard disk, and sectors can lose
retentivity over time either because of non-use (dipolar shift) or due
to manufacturing defect or degradation. However, the time for such
degradation (physical or magnetic) is usually many years and users
often replace their hard drives before those problems show up by
getting a new computer (and new drives versus migrating the old drives
into the new host) or getting bigger drives.

So try "chkdsk /r" first. Also, I gave up on relying on Norton's Disk
Doctor a long time ago, but then I haven't used Norton products for
several years now. When NTFS v5 came out that Disk Doctor would start
reporting non-existing problems was when I gave up on it. They
might've fixed it since then but I never felt it was a reliable repair
tool. You didn't mention WHICH version of Disk Doctor that you are
running or from what version of whatever Norton suite it came bundled.
Maybe what you are trying to use is simply too old and unusable. I'm
not specifically trying to promote SpinRite but instead feel that Disk
Doctor is too lightweight a utility to fix any real [physical]
problems on a hard disk. In fact, I wouldn't be surprised if "chkdsk
/r" was about as much as Disk Doctor could itself perform.

 

[Frank]

Norton System Works 2006
I did not load the "junk" just the basics and Norton Utilities to get NDD.

Anyway, ran chkdsk c: /r on a re-boot
(on a 300gig drive, kind of like watching grass grow)
"no problems" reported.... strange

I do know about the /f switch...
If I go to Run and enter chkdsk c:/f it will schedule a repair.... and
report no problems on re-booting.

Then use the /r switch to have chkdsk check the sectors are readable.
Rather than just check the file system is okay, it also ensures the data
is readable from the platters. It is not an infallible check. I
believe the OS will permit up to 5 retries to read a sector before
saying there is a problem reading from it, and hard disks may permit up
to, say, 3 retries before reporting an error, so it could be 15 retries
total of which it could take only one, like the last one, to get the
data to pass the test.

SpinRite is a better low-level sector test utility but it isn't free.
What users don't realize is that retentivity of a sector wanes over time
unless its data is read and rewritten. The dipoles to record the data
are under magnetic stress and will alter alignment over time. If
magnetic data, which includes the file system, is not exercised, it will
lose its ability to be read. Microsoft has never provided a utility to
read and rewrite all bits in every sector on the hard disk. They also
provide poor utilities to determine the reliability or retention of a
sector's area on the hard disk, and sectors can lose retentivity over
time either because of non-use (dipolar shift) or due to manufacturing
defect or degradation. However, the time for such degradation (physical
or magnetic) is usually many years and users often replace their hard
drives before those problems show up by getting a new computer (and new
drives versus migrating the old drives into the new host) or getting
bigger drives.

So try "chkdsk /r" first. Also, I gave up on relying on Norton's Disk
Doctor a long time ago, but then I haven't used Norton products for
several years now. When NTFS v5 came out that Disk Doctor would start
reporting non-existing problems was when I gave up on it. They might've
fixed it since then but I never felt it was a reliable repair tool. You
didn't mention WHICH version of Disk Doctor that you are running or from
what version of whatever Norton suite it came bundled. Maybe what you
are trying to use is simply too old and unusable. I'm not specifically
trying to promote SpinRite but instead feel that Disk Doctor is too
lightweight a utility to fix any real [physical] problems on a hard
disk. In fact, I wouldn't be surprised if "chkdsk /r" was about as much
as Disk Doctor could itself perform.

 

[Frank]

cleared the event log(s)
cmd window convert c: /fs:ntfs, all the usual messages, re-booted
Convert "ran", Windows re-started, still FAT32.
Event Log had no errors reported

Two other things:
double checked my cluster size... 4k
Heard after doing a Convert you have to rename the drive, did, no help.

The HKLM...... Registry Key does not exist

at a loss,
Frank

 

[John John]

Frank wrote:

The HKLM...... Registry Key does not exist

The BootExecute value at:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager

*must* exist else you could not schedule chkdsk to run on reboot nor
could you have autoconv run on startup! BootExecute is a REG_MULTI_SZ
value in that key.

I'm thinking that maybe something Norton or something to do with AV
activity on reboot prevents the convert from happening?

John

 

[VanguardLH]

From what I Googled, Symantec stopped any development of Disk Doctor
back in 2004, maybe earlier. So it is now an old utility. Also, the
last version of Norton utilities was to add missing programs, not to
update NDD. I would go with the results of "chkdsk /r" and forget
using the antiquated NDD utility.

 

[VanguardLH]

cleared the event log(s)
cmd window convert c: /fs:ntfs, all the usual messages, re-booted
Convert "ran", Windows re-started, still FAT32.
Event Log had no errors reported

Two other things:
double checked my cluster size... 4k
Heard after doing a Convert you have to rename the drive, did, no
help.

The HKLM...... Registry Key does not exist

How much FREE disk space is there in the *partition* (not hard disk)
that you want to convert from FAT32 to NTFS? If there is insufficient
working space, the conversion won't happen.

http://support.microsoft.com/kb/314875/en-us

The article doesn't give specific values for free disk space. My
guess is that you probably need at least 20% free space within the
partition that you are trying to convert.

How LONG does the conversion execute? That is, from when you see the
conversion start to when it quits, how long is that? I haven't
performed a conversion in many years since I always start with an NTFS
partition, but I vaguely recall that a conversion took about as long
as formatting the partition.

 

[Frank]

Probably runs for 30 minutes.
300gig Partition, about 60 used so lots of free space.

 

[Frank]

I have a desktop (clone) and two THinkpads all running XP/Home or Pro
and the key is not there...

How about HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager with 12 Sub-Folders ??

 

[Frank]

Brain Dead..... sorry John

"HKLM" sure now sounds like HKEY_LOCAL_MACHINE
I guess I am getting toooooooo old for this stuff.
(my first computer center had 300 tons of air conditioning to keep it
cool..... plus the CPU was water cooled)

 

[Frank]

BootExecute value is autocheck autochk* sprestrt

 

[John John]

Hmmm. That sprestrt value data looks pretty fishy to me, that should
not be there after the Windows installation is properly completed. Are
you absolutely 100% sure that your installation is completely free of
virus or other pests?

John

 

[VanguardLH]

Probably runs for 30 minutes.
300gig Partition, about 60 used so lots of free space.

Is the hard disk:
- IDE (PATA)?
- SATA?
- USB connected?
- SCSI?
- BusLogic controller if SCSI?
- RAID involved?
- Dynamic disks?

At the end of the conversion (i.e., when the convert quits), do you
see any error or info message? Try adding the /v switch for verbose
mode.

 

[VanguardLH]

in message

Hmmm. That sprestrt value data looks pretty fishy to me, that
should not be there after the Windows installation is properly
completed. Are you absolutely 100% sure that your installation is
completely free of virus or other pests?

The sprestrt value in that registry key will kick off the following
program when Windows starts up:

C:\Windows\system32\sprestrt.exe

According to "How Setup Works"
(http://technet2.microsoft.com/windowsserver/en/library/7b28284e-d1d2-4dc7-88d3-4e75bbf63a971033.mspx),
this program seems involved in the install of Windows (in getting a
usable desktop GUI to continue the install). If you right-click on
the file in WIndows Explorer and look at Properties under the Version
tab, the program's description is "Restores registry to restart
GUI-mode part of setup."

It is also possible that malware figured out to replace this file and
add the value to the registry key to get this malware to run on every
startup of Windows (and because the vast majority of security software
would load). Many utilities to show startup items do not include the
BootExecute key. Even some HIPS (host intrusion protection systems)
don't look for it. AutoRuns from SysInternals (now owned by
Microsoft) does list this key as a startup item. Mine has:

autocheck autochk *
Isdelete

(when you look at its value in its own window rather than the view
pane in regedit, there are 2 values for that key). The autocheck
entry will run:

C:\Windows\system32\autochk.exe

and the Isdelete entry will run:

C:\WIndows\system32\Isdelete.exe

So if any of those 3 files are infected or corrupted, the malware or
bad file runs early in Windows startup. For example, the VirtuMundo
pest alters the BootExecute key (but adds a different entry than
sprestrt.exe); see
http://wiki.castlecops.com/Malware_Removal:_Virtumundo. BootExecute
is right up there with the WinLogon events for programs that run far
before any security software gets loaded.

Frank shows sprestrt on the same line as autocheck but that might be
because he was looking at the view pane on the right in regedit.
Double-click the data item to show its value list in its own window.
sprestrt should be on its own line as another program to run on
Windows startup, not as a parameter to autochk. Some programs add
their own line to this data item. For example, and only from what
I've read, selecting to perform a boot-time scan in Avast anti-virus
will add an "aswBoot.exe ..." entry to this data item. It's a way to
get a program to run early during the startup of Windows.

See:

http://technet2.microsoft.com/windo...d1d2-4dc7-88d3-4e75bbf63a971033.mspx?mfr=true

 

[John John]

in message



The sprestrt value in that registry key will kick off the following
program when Windows starts up:

C:\Windows\system32\sprestrt.exe

Yes, and that file may have been replaced or spoofed by a virus or other
pest. That sprestrt value is not normally there after the Windows
installation is properly completed. That of course doesn't mean that
the value is necessarily virus related but it does raise some suspicion.

Also, autoconv failure or success are normally recorded in the Event Log
but Frank reports no such events in the log. It could be that there
isn't enough free space as you suggest in another post, but that would
be recorded in the Event Log. There is definitely something awry with
his installation, but it's difficult to figure out what is going on!

Also, he formated his FAT32 drive, or with the use of third party tools
he changed the cluster size from the probable 32K standard size to a
non-standard 4K size, maybe that is causing the problem, it could be
that the third party tool that he used did something that Windows
doesn't like too much.

John

 

[Frank]

Wow, and I thought I was kind of smart on this stuff..... compared to
you guys.... I need to go back to "school"

a Plan ?? before my next re-start I will remove the "Isdelete"
(this may be a while as noted below)

My drive was FAT32 with 512k clusters and would not convert to NTFS.
Someone suggested changing to 4k clusters which I did with Acronis Disk
Director. It still would not convert.

While Chkdsk did not find any errors I did run a chkdsk /r and it also
came up clean. So, then I decided to Degrag using Norton SD and it ran
and ran and then stopped.
So, I used XP Disk Defrag... almost immediately it ID'd a corrupted
file. I deleted the file and re-started and it is still running.
Possibly, Convert blew off on this one corrupted file... 900,000 files
and one bad one... go figure.

While I have the attention of two smart guys...
Is there something that can speed up Defrag ?
My 300gig drive has about 50gigs of data, has been running for 16 hours
and is 34% done (Norton showed it was 20% fragmented before I started)

Appreciate all the help.
Just for "Grins"... my first data center had 300 tons of a/c to keep it
cool with a water cooled CPU.... and a whopping 256k of memory.

 

[Frank]

just a new Seagate IDE, nothing exotic.
Though it is on a PCI controller card as my BIOS would not handle
300gigs and I had this RAID card around.... but NOT running RAID, just
using the IDE ports.
A master and slave (cable detect) one one port and another drive on the
other port.
On the motherboard, the first IDE is empty and the second one has my two
CD/DVD drives.

I added some comments to my other thread that you and John have been so
nice to participate in.
Thanks,
Frank