Corrupt NTFS Filesystem

[Bob]

I suspect you would reach the most knowledgeable group with
a post to a general purpose win2k or Winxp group, rather
than either you've posted to. It may indirectly be a
filesystem problem, pinpointed by a general windows
assessment.

Please recommend groups I should post to.

Hopefully not, but if you really want to get to the bottom
of this it might not hurt to simply remove that additional
interface for the time being.

I would like to exhaust everything possible before I do that. I have
5.25 to 3.5 mounts so I would not have to change the cabling.

 

[pgx]

(e-mail address removed) (Bob) wrote:

|
|The installation is pretty conventional. The only thing I can think of
|that is new is the installation of the Computer Associate anti-virus
|package called E-Trust EZ AntiVirus (free to RoadRunner subscribers).

Bob,

I only post this as a general possibly-related occurrence.

About 2 years ago, I had a drive clobbered -1st cluster of the Windows
directory was over-written with garbage. I wrote it off as a chance
occurrence, recovered, and kept on going. A few months later it
happened again! As best I can tell, it was a software interaction
between a new version of ZoneAlarm and a new version of Norton AV. I
reverted to an older version of ZA and dumped Norton for AVG, and
never had the problem again.

A lot of software, particularly AV's, get pretty deep into the system.
Most anything can happen.

Phil

 

[Bob]

I only post this as a general possibly-related occurrence.

About 2 years ago, I had a drive clobbered -1st cluster of the Windows
directory was over-written with garbage. I wrote it off as a chance
occurrence, recovered, and kept on going. A few months later it
happened again! As best I can tell, it was a software interaction
between a new version of ZoneAlarm and a new version of Norton AV. I
reverted to an older version of ZA and dumped Norton for AVG, and
never had the problem again.

A lot of software, particularly AV's, get pretty deep into the system.
Most anything can happen.

I remember the problems with ZA.

I will remove CA EZ AV and see what happens.

 

[kony]

If there was a problem with the hardware, would I not see more
problems than just this one?

Reread the following sentence written previously:



That is, opposed to causing loss in general, their loss, is
at shutdown, like, what you described?

I realize the importance of sound hardware. But I have no reason to
suspect the hardware separate from this problem.

Just about any hardware that is failing but not stone cold
dead, is going to fail under a particular situation. Maybe
the temp, the power, mechanical stress, it all depends on
the failure mode. It is not at all unusual to have a
problem like this caused by hardware. I'm not trying to be
rude but you are very uncooperative. It is a bit of a waste
to have us drift down tangents when we don't even have the
full picture because you're withholding information.

If there was no chance this was hardware, I would not have
asked.

As I have mentioned, I am using Kingwin KF-23 removable bays for my
hard drives. I am using ATA-133 80-wire ribbon cable. I have no reason
to suspect this to be causing a problem because I run Acronis True
Image all the time and it has never created an corrupt clone.

All the time "now", or all the time up until the point where
the (failure, for example the removable bay contacts became
intermittently connected) problem started? Any system
starts out ok, presumably, and eventually they all fail too
if not merely abandoned before this inevitable fate.

I am getting tired of this hassle all the time. I need to fix it.
Maybe I should just do a new install of Win2K. But that would take
days to reconfigure so I prefer not having to do it.

If (since) you have a spare drive, you can simply install
windows onto it. No need to wipe out the current
installation. You might even dupe one to another and then
this spare you can retest for same problem and experiment
with.

It would be good to try and backtrack to what might've
happened just prior to the onset of this problem.

Since I have three identical drives, and I am able to repair a corrupt
one by running CHKDSK from a second drive, I may dedicate one drive to
a new install with minimal apps to see what happens. If I need all the
machinery I have on my main disk, I can always swap it back in easily.

On a separate matter, can I make a floopy-based or CD-based boot disk
that will run the Win2k version of CHKDSK? I am using NTFS. Or maybe I
need to create a small extra partition on the boot disk with Win2K so
I can boot to it and not have to swap drives around if I lock up with
a BSOD.

Sure, put CHKDSK wherever you want it, though it'll have to
be an environment that supports NTFS. You might check out
Bart's PE, it's handy for accessing NTFS volumes and can
boot from a USB thingamajig (thumbdrive, flashcard reader,
etc, if your motherboard supports that.

 

[Bob]

Reread the following sentence written previously:

Reread what I have said.

It is a bit of a waste
to have us drift down tangents when we don't even have the
full picture because you're withholding information.

I have given all the information I can that I consider relevant.

If you suspect something I have missed, then by all means alert me to
it specifically.

If (since) you have a spare drive, you can simply install
windows onto it. No need to wipe out the current
installation. You might even dupe one to another and then
this spare you can retest for same problem and experiment
with.

As I mentioned I have three identical WD 80GB HDs that are all cloned.
Each of them suffers from this problem.

It would be good to try and backtrack to what might've
happened just prior to the onset of this problem.

The problem is complicated by the fact that when I first noticed this
problem I was evaluating that Enermax DynaBacker RAID/Backup unit. I
blamed the problem on it, and returned it for a full refund. The
manufacturer has since withdrawn it from the market, as I understand
it.

But when I went over to the removable bays the problem persisted.

Sure, put CHKDSK wherever you want it, though it'll have to
be an environment that supports NTFS. You might check out
Bart's PE, it's handy for accessing NTFS volumes and can
boot from a USB thingamajig (thumbdrive, flashcard reader,
etc, if your motherboard supports that.

I tried that (with NTFS4DOS) but it gave a "not correct system" error.

I have a way now to do it - I mount the bad drive as D: and CHKDSK it.
I can recover not only from a corrupt volume but from a BSOD crash. I
posted the results of fixing a BSOD crash.

I now suspect the AV program and have turned it off. One thing I
suspect is that the corruption only happens after a relatively long
period of time. I had the AV set up for auto updates. Maybe that is
what is corrupting the disk.

 

[kony]

As I mentioned I have three identical WD 80GB HDs that are all cloned.
Each of them suffers from this problem.

That is ideal.

Now you can begin experimenting.

The problem is complicated by the fact that when I first noticed this
problem I was evaluating that Enermax DynaBacker RAID/Backup unit. I
blamed the problem on it, and returned it for a full refund. The
manufacturer has since withdrawn it from the market, as I understand
it.

I hope it wasn't for a problem related to this? Is there
any change it installed software or driver that wasn't
removed?

How easily is the problem reproduced? Is it guaranteed to
happen every time? If so, do you ever just boot up, reboot
without doing anything just to see if it still happens, and
if so, does it?

But when I went over to the removable bays the problem persisted.


I tried that (with NTFS4DOS) but it gave a "not correct system" error.

OK, but that wasn't what I had suggested. Did you ever
check on a bios update for your board?

I have a way now to do it - I mount the bad drive as D: and CHKDSK it.
I can recover not only from a corrupt volume but from a BSOD crash. I
posted the results of fixing a BSOD crash.

I now suspect the AV program and have turned it off. One thing I
suspect is that the corruption only happens after a relatively long
period of time. I had the AV set up for auto updates. Maybe that is
what is corrupting the disk.

You could research that angle but i think someone would've
been spreading the word about such a serious problem as
that.

 

[Bob]

That is ideal.
Now you can begin experimenting.

As mentioned earlier, I disabled CA AV as best I could short of
uninstalling it. It no longer scans nor updates.

Also as mentioned, I run an NTBACKUP each morning - a differential
backup. After each clone, I run an ATTRIB command which clears the
archive bits. Then when a file is used Win2K sets the archive bit and
NTBACKUP backs it up. Using differential mode keeps only one backup
file and makes it a lot easier to restore.

The point is that NTBACKUP won't run if the ntfs volume is corrupt.
Therefore I have an easy way to detect if it is corrupt without having
to reboot.

The backup file from this morning is present which means the boot disk
is not corrupt. I will verify that by rebooting. Usually the volume is
corrupted overnight so this is a good sign.

I hope it wasn't for a problem related to this?

It was for not only this but several other issues. The company in
Taiwan was unwilling to support the unit - I could not even get them
to sell me an extra tray for the 3rd drive. The OEM who actually made
the unit went out of business leaving Enermax Taiwan holding the ball.
My supplier, Directron, called Enermax USA and was advised that the
unit was being removed from the market and I should return mine for a
full refund or risk having a unit that is unsupported. There were
other issues that caused the unit not to be worth it so I returned it.
I like the system I have now because it is closer to the operating
system.

Is there
any change it installed software or driver that wasn't
removed?

I cleaned it out to the best of my abilities. But I can't be certain
that it did not step on some DLL somewhere.

There is a Win2K system command that restores an archived image of all
the DLLs. I forgot the name - maybe you or someone else know it. I
believe it is three alpha characters beginning with 's'.

How easily is the problem reproduced? Is it guaranteed to
happen every time? If so, do you ever just boot up, reboot
without doing anything just to see if it still happens, and
if so, does it?

It seems to happen at random, except it happens most often if there
has been an overnight interval.

Did you ever check on a bios update for your board?

No, and I do not care to go there except as a last resort.

You could research that angle but i think someone would've
been spreading the word about such a serious problem as
that.

You would think so, but then Zone Alarm never alerted users that their
s/w was screwing up peoples' systems.

The good news is that I managed to make it thru the night without the
volume being corrupted. 9 out of 10 times it would be corrupted, with
1 out of 10 resulting in a BSOD.

===

I just rebooted and the disk was not corrupted. This is very good
news. In a couple more days I should know if it is the AV s/w that is
causing the problem. If it is, then I will test whether it is the
automatic update or the scan engine itself - or both.

 

[Bob]

Regarding the matter of low-level formatting using WD diagnostics,
here is the reply I got from WD tech support:

+++
Please run our Data Lifeguard Diagnostics for DOS. There is a program
included called "Write Zeros to Drive" to erase all the data from the
drive (low-level format).

Title: How to write zeros to an internal hard drive using a Data
Lifeguard Tools 11 diagnostic disk.

http://wdc.custhelp.com/cgi-bin/wdc.cfg/php/enduser/std_adp.php?p_faqid=1084&p_created=1064520905
+++

 

[CBFalconer]

Regarding the matter of low-level formatting using WD diagnostics,
here is the reply I got from WD tech support:

+++
Please run our Data Lifeguard Diagnostics for DOS. There is a program
included called "Write Zeros to Drive" to erase all the data from the
drive (low-level format).

They should not be corrupting the term by calling this a "low-level
format". Writing zeroes more than adequately descrbes it.

--
"If you want to post a followup via groups.google.com, don't use
the broken "Reply" link at the bottom of the article. Click on
"show options" at the top of the article, then click on the
"Reply" at the bottom of the article headers." - Keith Thompson
More details at: <http://cfaj.freeshell.org/google/>
Also see <http://www.safalra.com/special/googlegroupsreply/>

 

[don]

Sounds like hardware to me, may not be the controller card on the drive but
could possibly be the IDE interface on the board. You might try an IDE
adapter card like a Promise (some model). But in any case you should not
defragment your drive while you are having trouble; doing so runs the risk
of losing all chances of data recovery if you have a failure.