Identifying compressed folders

[Tom Del Rosso]

MS just released a patch for one of last week's patches that can corrupt
compressed folders on Win2k. I installed the patch for the patch, but what
if I wanted to check my compressed folders and I couldn't remember which
ones were compressed? Color coding won't help unless you open the parent
folder. How can you search a volume for compressed folders?

 

[Jerold Schulman]

MS just released a patch for one of last week's patches that can corrupt
compressed folders on Win2k. I installed the patch for the patch, but what
if I wanted to check my compressed folders and I couldn't remember which
ones were compressed? Color coding won't help unless you open the parent
folder. How can you search a volume for compressed folders?

See tip 10830 » ls.exe is a freeware console utility that can display exhaustive information on DACLs/SACLs, reparse points, shortcuts, hard links, hidden streams, encryption, compaction, and offline status.
in the 'Tips & Tricks' at http://www.jsifaq.com

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com

 

[Tom Del Rosso]

See tip 10830 » ls.exe is a freeware console utility that can display
exhaustive information on DACLs/SACLs, reparse points, shortcuts,
hard links, hidden streams, encryption, compaction, and offline
status. in the 'Tips & Tricks' at http://www.jsifaq.com

Great solution. Thank you.

 

[Gary Smith]

This isn't a general solution but may help woth the problem at hand:
"scandf -- Scan for files corrupted by KB920958"
http://marc.kupper.googlepages.com/scandf

 

[Tom Del Rosso]

This isn't a general solution but may help woth the problem at hand:
"scandf -- Scan for files corrupted by KB920958"
http://marc.kupper.googlepages.com/scandf

Thanks. That's great, but I wonder how it works? Maybe there's always the
same repeating pattern in the corruption.

 

[KeithMail]

Absolutely correct, the clue is in marcs application name, the corruption is
a repeated hex value of "df" hence -scan df-, I'm trying the utility and so
far seems to produce accurate reports so a big thank you to the author.
Keith

 

[marc.kupper]

Thanks. That's great, but I wonder how it works? Maybe there's always the
same repeating pattern in the corruption.

The NTFS file compression code seems to organize files into 4096 byte
blocks. If the last block of the file has 3641 to 4086 bytes then
there is a chance it may be corrupted. The corruption is that the
contents of the entire last block will get filled with hex value DF.
My scanner first checks the file length and if the last block contains
at least 3600 bytes then it opens the file and checks to see if the
last block is entirely "DF" bytes. If so, scandf reports that file as
possibly corrupted. Thus the scanner is fairly fast as it can skip
about 88% of the files as they contain less then 3600 bytes in the last
4096 byte block and even with the files it's checking it only needs to
read the very end of the file.

Marc

 

[Tom Del Rosso]

The NTFS file compression code seems to organize files into 4096 byte
blocks. If the last block of the file has 3641 to 4086 bytes then
there is a chance it may be corrupted. The corruption is that the
contents of the entire last block will get filled with hex value DF.
My scanner first checks the file length and if the last block contains
at least 3600 bytes then it opens the file and checks to see if the
last block is entirely "DF" bytes. If so, scandf reports that file as
possibly corrupted. Thus the scanner is fairly fast as it can skip
about 88% of the files as they contain less then 3600 bytes in the
last 4096 byte block and even with the files it's checking it only
needs to read the very end of the file.

Much thanks for your effort and for sharing it.

 

[marc.kupper]

MS just released a patch for one of last week's patches that can corrupt
compressed folders on Win2k. I installed the patch for the patch, but what
if I wanted to check my compressed folders and I couldn't remember which
ones were compressed? Color coding won't help unless you open the parent
folder. How can you search a volume for compressed folders?

I'm sorry about back to back messages but just read the first message
in this thread and figured I'd take a shot at it.

1) From Windows Explorer you can do a search for files, click on the
"Type" column header, scroll down to the "File Folder" type,
and look for folders that are color coded blue. It's a manual process
and thus error prone.

2) Jerold Schulman mentioned using ls.exe (tip # 10830 on
www.jsifaq.com). I just tried this - it's close but you can't
use it to scan for compressed folders as the first column of "ls
-l" is a hyphen if it's a normal file, "c" for a compressed
file, and "d" for a directory/folder. There is no character or
color coding to indicate compressed folders. You can use ls.exe to get
a list of compressed files though.

I could not find an obvious utility to just list the compressed folders
and so I took the code I already had for scandf and modified it into a
new utility, ListCompressed, which will list just those files or
folders that are compressed (or are not compressed if you want). The
utility is available at
http://marc.kupper.googlepages.com/listcompressed.

Please note that the issue that started this thread, KB920958 causing
some compressed files to get corrupted, does not seem to affect
compressed folders/directories themselves. I'm not sure if that's
because people have been lucky or if whatever KB920958 broke does not
affect the folders/directories themselves.

I wrote ListCompressed mainly as I've been kicking around some ideas
about directory and file searching/listing and ListCompressed will
evenually morph into something else.

Marc

 

[Tom Del Rosso]

I'm sorry about back to back messages but just read the first message
in this thread and figured I'd take a shot at it.

1) From Windows Explorer you can do a search for files, click on the
"Type" column header, scroll down to the "File Folder" type,
and look for folders that are color coded blue. It's a manual process
and thus error prone.

I thought of using explorer and hitting the asterisk on the root of a drive
to expand the entire tree. Then you can scroll down the left pane and
search for blue folders.

2) Jerold Schulman mentioned using ls.exe (tip # 10830 on
www.jsifaq.com). I just tried this - it's close but you can't
use it to scan for compressed folders as the first column of "ls
-l" is a hyphen if it's a normal file, "c" for a compressed
file, and "d" for a directory/folder. There is no character or
color coding to indicate compressed folders. You can use ls.exe to get
a list of compressed files though.

And it's compressed files that matter, I realize now. Thanks for pointing
that out.

I could not find an obvious utility to just list the compressed
folders and so I took the code I already had for scandf and modified
it into a new utility, ListCompressed, which will list just those
files or folders that are compressed (or are not compressed if you
want). The utility is available at
http://marc.kupper.googlepages.com/listcompressed.
Super!


Please note that the issue that started this thread, KB920958 causing
some compressed files to get corrupted, does not seem to affect
compressed folders/directories themselves. I'm not sure if that's
because people have been lucky or if whatever KB920958 broke does not
affect the folders/directories themselves.

It would be quite a disaster if it happened to the folder itself, but I
suppose the directory structure is not compressed and it must be the
compression that corrupts.

 

[marc.kupper]

I thought of using explorer and hitting the asterisk on the root of a drive
to expand the entire tree. Then you can scroll down the left pane and
search for blue folders.

Cool - I did not know about the asterisk thing though made the mistake
of doing it on the root of C: Evenually Explorer will come back.

Marc

 

[Tom Del Rosso]

Cool - I did not know about the asterisk thing though made the mistake
of doing it on the root of C: Evenually Explorer will come back.

In that case you might not know about this well-hidden little trick. In
details view, hit control-plus using the plus key on the keypad, and it will
size all the columns correctly. (I still think it's lame that Explorer
doesn't size the columns right automatically.)

Also, the asterisk might work better than search because there is a 10,000
file limit to the search window IIRC.

 

[marc.kupper]

In that case you might not know about this well-hidden little trick. In
details view, hit control-plus using the plus key on the keypad, and it will
size all the columns correctly. (I still think it's lame that Explorer
doesn't size the columns right automatically.)

Nice, I did not know about that one and had been double clicking on the
column divider lines in the header to auto-size a column. I agree it
would
be better if Explorer did a better job of auto sizing.

Also, the asterisk might work better than search because there is a 10,000
file limit to the search window IIRC.

In my case I evenually end-tasked Explorer as I had about 40,000
folders on
the drive I tried to view and it was taking forever to do the * expand
all thing.

BTW - I just tried it and the * thing works in regedit too and nicely
enough
the expanding can be aborted with ESC. In Outlook it's similar in that
the first *
expands the upper level, tap * again and it expands one level deeper,
and *
again to drill/view into the third level down, etc. I like this better
than the
explode-all that Explorer and Regedit use.

Does anyone know how to do a "goto" in regedit? Often times someone'll
say
goto "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\..."
and it's always a manual hunt/peck to drill down to the desired key.

Marc