Check Disc problem

[needlove]

Microsoft Windows XP Home Edition Service Pack 2

When I run chkdsk /f I get results like this every time:

A disk check has been scheduled.
Windows will now check the disk.
[only the number of errors varies]
Cleaning up 601 unused index entries from index $SII of file 0x9.
Cleaning up 601 unused index entries from index $SDH of file 0x9.
Cleaning up 601 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

72300500 KB total disk space.
17471684 KB in 93698 files.
28920 KB in 3842 indexes.
0 KB in bad sectors.
181600 KB in use by the system.
65536 KB occupied by the log file.
54618296 KB available on disk.

4096 bytes in each allocation unit.
18075125 total allocation units on disk.
13654574 allocation units available on disk.

When I run chkdsk with no switches (with Windows running) there is no
problem with unused indexs or security descriptors.

According to this KB article, updated, October 26, 2006, I should obtain
the latest sevice pack: http://support.microsoft.com/kb/831374

I assume that would be service pack 2 for Windows XP Home Edition?

If I had Windows 2003 Server Edition (what the big boys use) I could have
a hotfix right now by calling Microsoft toll free or if I was feeling like
a little manual labor I could run Vrfydsk.exe to see if the security
descriptors really are corrupt.

Since I'm just a Windows XP home user I will probably have to wait for
service pack 3 to know if my computer is secure. Maybe not ever...

 

[Guest]

Well in windows explorer,running CHKDSK the utility is in "read only" mode,
no editing or changes are made...Try reading kb831426 Also,go to run,type:
cmd In cmd or in recovery by booting to xp cd,type:CHKDSK C: /R
Also,windows server uses about the same cmds as xp,even with a new
"hotfix" for server,you'd still need to do some adjustments,SP3 will/would
not get you results either.....

 

[Wesley Vogel]

When I run chkdsk with no switches...

No switches means CHKDSK in read-only mode.

Don't even bother running CHKDSK in read-only mode. It is a waste of time
and prone to not accurately reporting information. CHKDSK might report
spurious errors because it cannot lock the drive.

More on running CHKDSK in read-only mode after the Reading a chkdsk log
part.

Reading a chkdsk log

chkdsk log will be similar to this...

Checking file system on C:
The type of the file system is NTFS.
Volume label is Local Disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 10 unused index entries from index $SII of file 0x9.
Cleaning up 10 unused index entries from index $SDH of file 0x9.
Cleaning up 10 unused security descriptors.

4096543 KB total disk space.
2906360 KB in 19901 files.
6344 KB in 1301 indexes.
0 KB in bad sectors.
49379 KB in use by the system.
22544 KB occupied by the log file.
1134460 KB available on disk.

4096 bytes in each allocation unit.
1024135 total allocation units on disk.
283615 allocation units available on disk.

It is housecleaning and housecleaning is going to happen if you run
chkdsk.exe. Think Merry Maids with brooms.

Cleaning up minor inconsistencies on the drive.

[[In the above error message, "minor inconsistencies" refers to a state
where redundant information stored in different places is "out of synch."
This is a natural and expected condition whenever there are open files on
the volume that have undergone modification. The redundant information is
not brought into synchronization until the files are closed. Typically, this
error message occurs when CHKDSK is run against the volume containing
Windows NT system files (including active user profiles and the pagefile).

WORKAROUND
You can usually safely ignore this error message even if the message appears
without there being open files, because it is only the redundant information
that is out of synchronization. The only side effect you may see as a result
of this message is an incorrect reading of free disk space or something
similar. ]]
from...
"CHKDSK detected minor inconsistencies" error message in Windows 2000 and in
Windows NT
http://support.microsoft.com/kb/109524

Cleaning up 10 unused index entries from index $SII of file 0x9.
Cleaning up 10 unused index entries from index $SDH of file 0x9.

[[Chkdsk.exe reports only unused index and security descriptor entries that
were removed. ]]
[[Chkdsk.exe just reclaims the unused security descriptors as a housekeeping
activity, and it does not actually fix any kind of problem. ]]
from...
Windows 2000 Chkdsk Reports Cleaning Unused Security Descriptors
http://support.microsoft.com/kb/255008

Cleaning up 10 unused security descriptors.

[[When you delete a file or folder with permissions that you've set by hand
rather than allowed to be automatically inherited from its parent, the ACL
(Access Control List, the security descriptor) isn't deleted, but cached.
Running CHKDSK against these "dead" items cleans up the ACLs that are no
longer in use and frees up space. ]]
from...
Tip: Don't Panic At CHKDSK "Security Descriptor" Cleanup
http://www.winmag.com/columns/powerw2k/2000/46.htm#tip

[[This problem occurs because if Chkdsk is run against an NTFS volume,
Chkdsk.exe may report that security descriptors are in the database that are
no longer referenced by any file or folder and that it is removing them.
However, Chkdsk.exe just reclaims the unused security descriptors as a
housekeeping activity, and it does not actually fix any kind of problem. ]]
from...
Windows 2000 Chkdsk Reports Cleaning Unused Security Descriptors
http://support.microsoft.com/kb/255008

[[4096543 KB total disk space.
(This value is the total formatted disk capacity.)

2906360 KB in 19901 files.
(This value is the space used by user file data.)

6344 KB in 1301 indexes.
(This value is the space used by NTFS indexes.)

0 KB in bad sectors.
(This value is the space lost to bad sectors.)

49379 KB in use by the system.
(This value is includes MFT and other NTFS metafiles.)

22544 KB occupied by the log file.
(This value is the NTFS Log file; you use the chkdsk /l:size to adjust this
value.)

1134460 KB available on disk.
(This value is the available FREE disk space.)

4096 bytes in each allocation unit.
(This value is the cluster size [4K])

1024135 total allocation units on disk.
(This value is the total clusters on disk.)

283615 allocation units available on disk.
(This value is the available free clusters.) ]]
from...
How to locate and correct disk space problems on NTFS volumes in Windows XP
http://support.microsoft.com/kb/315688

See also...
Understanding what CHKDSK does
here...

An explanation of the new /C and /I Switches that are available to use with
Chkdsk.exe
http://support.microsoft.com/kb/314835

-------------------

[[Chkdsk might not accurately report information in read-only mode.]]
From...
Chkdsk
http://www.microsoft.com/resources/...windows/xp/all/reskit/en-us/prmb_tol_pwfd.asp

[[If you run chkdsk without the /f command-line option on an active
partition, it might report spurious errors because it cannot lock the
drive.]]

[[Using chkdsk with open files
If you specify the /f command-line option, chkdsk sends an error message if
there are open files on the disk. If you do not specify the /f command-line
option and open files exist, chkdsk might report lost allocation units on
the disk. This could happen if open files have not yet been recorded in the
file allocation table. If chkdsk reports the loss of a large number of
allocation units, consider repairing the disk.]]
From...
Chkdsk
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/chkdsk.mspx

[[In read-only mode, CHKDSK quits before it completes all three phases if it
encounters errors in earlier phases, and CHKDSK is prone to falsely
reporting errors. For example, CHKDSK may report disk corruption if NTFS
happens to modify areas of a disk while CHKDSK is examining the disk. For
correct verification, a volume must be static, and the only way to guarantee
a static state is to lock the volume. CHKDSK locks the volume only if you
specify the /F switch (or the /R switch, which implies /F). You may need to
run CHKDSK more than once to get CHKDSK to complete all its passes
in read-only mode. ]]
From...
An Explanation of the New C and I Switches That Are Available to Use with
Chkdsk.exe
http://support.microsoft.com/default.aspx?scid=kb;en-us;314835

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Microsoft Windows XP Home Edition Service Pack 2

When I run chkdsk /f I get results like this every time:

A disk check has been scheduled.
Windows will now check the disk.
[only the number of errors varies]
Cleaning up 601 unused index entries from index $SII of file 0x9.
Cleaning up 601 unused index entries from index $SDH of file 0x9.
Cleaning up 601 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

72300500 KB total disk space.
17471684 KB in 93698 files.
28920 KB in 3842 indexes.
0 KB in bad sectors.
181600 KB in use by the system.
65536 KB occupied by the log file.
54618296 KB available on disk.

4096 bytes in each allocation unit.
18075125 total allocation units on disk.
13654574 allocation units available on disk.

When I run chkdsk with no switches (with Windows running) there is no
problem with unused indexs or security descriptors.

According to this KB article, updated, October 26, 2006, I should obtain
the latest sevice pack: http://support.microsoft.com/kb/831374

I assume that would be service pack 2 for Windows XP Home Edition?

If I had Windows 2003 Server Edition (what the big boys use) I could have
a hotfix right now by calling Microsoft toll free or if I was feeling like
a little manual labor I could run Vrfydsk.exe to see if the security
descriptors really are corrupt.

Since I'm just a Windows XP home user I will probably have to wait for
service pack 3 to know if my computer is secure. Maybe not ever...

 

[needlove]

Thank you for the detailed response. The information you provided eased my
fears about possible problems with security descriptors and disk
corruption. That's a lot of information and will take some time to digest
it all.

While I have your attention I was hoping I could run another chkdsk related
problem by you that I have been unable to find an answer to. About a month
ago Windows scheduled a Disk Check after some file corruption occurred from
overclocking the front side bus. Disk Check reported that it had restored
some files and some could not be restored. Are the files below,
"restoredactivefile00000" files that were restored by chkdsk?


Start> Run> msinfo32.exe

SYSTEM INFORMATION>

SYSTEM SUMMARY>

SOFTWARE ENVIORNMENT>

STARTUP PROGRAMS>


PROGRAM COMMAND
USERNAME/LOCATION

$RestoredActiveFile00097 $restoredactivefile00097 NT AUTHORITY\SYSTEM
Startup
$RestoredActiveFile00097 $restoredactivefile00097 .DEFAULT Startup
$RestoredActiveFile00106 $restoredactivefile00106 NT AUTHORITY\SYSTEM
Startup
$RestoredActiveFile00106 $restoredactivefile00106 .DEFAULT Startup
$RestoredActiveFile00159 $restoredactivefile00159 NT AUTHORITY\SYSTEM
Startup
$RestoredActiveFile00159 $restoredactivefile00159 .DEFAULT Startup
$RestoredActiveFile00171 $restoredactivefile00171 NT AUTHORITY\SYSTEM
Startup
$RestoredActiveFile00171 $restoredactivefile00171 .DEFAULT Startup
$RestoredActiveFile00197 $restoredactivefile00197 NT AUTHORITY\SYSTEM
Startup
$RestoredActiveFile00197 $restoredactivefile00197 .DEFAULT Startup
$RestoredActiveFile00262 $restoredactivefile00262 NT AUTHORITY\SYSTEM
Startup
$RestoredActiveFile00262 $restoredactivefile00262 .DEFAULT Startup
$winnt$ $winnt$.inf NT AUTHORITY\SYSTEM Startup
$winnt$ $winnt$.inf .DEFAULT Startup
12520437 12520437.cpx NT AUTHORITY\SYSTEM Startup
12520437 12520437.cpx .DEFAULT Startup
12520850 12520850.cpx NT AUTHORITY\SYSTEM Startup
12520850 12520850.cpx .DEFAULT Startup
6to4svc 6to4svc.dll NT AUTHORITY\SYSTEM Startup
6to4svc 6to4svc.dll .DEFAULT Startup

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
~ ~ ~ ~ ~ ~ ~ ~ ~ ~


If so, are they ok to leave like that? I run SFC with no problems, All
programs and Windows are running smooth except for an occasional,
repetative Application Management error that it can't find a file. I don't
have a backup from before the corruption occurred. Would it be worth it to
run a repair from the CD?

 

[Wesley Vogel]

I do not believe that the $RestoredActiveFile* files have anything to do
with chkdisk.

I never heard of $RestoredActiveFile* files before. All I can find on
$RestoredActiveFile* is that those files are skipped by default by Backup in
Windows Server 2003. I have no idea what they are for.

Do the $RestoredActiveFile* files have a file extension?

To display file extensions...
Start | Settings | Control Panel | Folder Options | View tab |
UNCheck: Hide extensions for known file types

..exe is the file extension for msinfo32.exe. By the way, you can type
msinfo32 without the .exe into the Run box and system Information should
open.

$winnt$.inf is Setup Information for XP. Tells things like if it was an
unattendedinstall, if it was a win9xupgrade, etc. It gets created when you
install Windows.

12520437.cpx & 12520850.cpx are Translation Code Page for SQL Server ODBC.
I opened both of mine with Notepad and they are just filled with numbers.

The 6to4svc.dll is a Microsoft file: Service that offers IPv6 connectivity
over an IPv4 network

About .DEFAULT Startup....

..DEFAULT is the User Name. This is usually when Windows first starts up and
before anyone logs onto a machine.

Startup refers to this registry key...
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

Your AntiVirus software probably starts from there. Other settings in the
HKEY_USERS\.DEFAULT key set the keyboard language, mouse settings, the Logon
Screen Saver, etc. all of these things are for when no actual human is
logged on.
----

*.chk files and the Found folders...

On Fat formatted volumes.

Chkdsk saves each repaired file in the root folder as a File<nnnn>.chk file,
and each repaired folder in the root folder as a Found.<nnn> folder, where
<n> is a number.

[[Because some repairs on FAT volumes, such as correcting lost clusters
(also known as allocation units) or cross-linked files, change the volume's
file allocation table and can cause data loss, Chkdsk first prompts you with
a confirmation message similar to the following:

10 lost allocation units found in 3 chains.
Convert lost chains to files? (Y/N)

If you press the N key, Windows XP Professional fixes the errors on the
volume but does not save the contents of the lost clusters.

If you press the Y key, Windows XP Professional attempts to identify the
folder to which they belong. If the folder is identified, the lost cluster
chains are saved as files.

If Windows XP Professional cannot identify the folder or if the folder does
not exist, it saves each chain of lost clusters in a folder called
Found.xxx, where xxx is a sequential number starting with 000. If no folder
Found.000 exists, one is created at the root. If one or more sequential
folders called Found.xxx (starting at 000) exist, a folder that uses the
next number in the sequence is created.

Windows XP Professional creates Found.xxx folders as hidden system folders.
To see a list of Found.xxx folders, at the root folder in the command
prompt, type dir /a. For information about viewing hidden system folders in
My Computer or Windows Explorer, see Windows XP Professional Help.

After the storage folder has been identified or created, one or more files
with a name in the format Filennnn.chk are saved. (The first saved file is
named File0000.chk, the second is named File0001.chk, and so on in
sequence.) When Chkdsk finishes, you can examine the contents of these files
with a text editor such as Notepad to see whether they contain any needed
data (if the converted chains came from corrupted binary files, they are of
no value). You can delete the .chk files after you save any useful data.

Caution
Because other programs might create and use files with the .chk extension,
you must be careful to delete only the .chk files that are in the Found.xxx
folders.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In