freaky chkdsk..

To anyone who was able to get their data back:

Was the data recovery software, you used, able to retrieve filenames for your data? If so, I'd appreciate the name of the software. Kind of dreading renaming all of my mp3 files.

Also, was everyone who lost data using NTFS? Did anyone encounter this problem when their HD was larger than 120gb but had partitioned their drive to less than 100gb partitions? Does anyone think I'll be safe repartitioning the drive to FAT32?

Thanks in advance.

I was able to collect filenames from my corrupted drive with GetDataBack. I configured GDB to make logfile of all it done to another drive, after it has scanned all files, I done some manual job and collected filelist it did find.
It printed filenames, even it was not able to add those names on the rescue "tree".

... And answer to BrownPaper. No I didn't enabled LargeCache, this problem seems to be 48bit LBA related, even I don't know how.
I don't know all other people configuration but mine is:
OS: Microsoft Windows XP Sp1
MSI K7T Turbo - Bios v3.6
Promise Ultra100TX - BIOS .15
Drivers: Latest from WindowsUpdate


I had that 160GB drive connected to that Ultra100TX IDE card, but I "couldn't" use drivers from Promise, because Microsoft drivers had bigger version number so windows didn't find newer one.
Now I have that drive connected to MOBO and I had installed latest VIA 4in1 drivers. Now I should start "copy testing" to find out if this corruption happens again.

Testing confirmed that problem was Promise drivers provided with Windows (original version 1.43.0603, Microsoft version 5.1.2600.1106). Old drivers are not 48bit LBA compatible.

I just posted message to Microsoft support, that they should apply newest Promise drivers in Windows Update, with "tampered" version number so users could upgrade drivers ASAP.

People with Promise card and big drive, should dump Microsoft drivers as soon as possible, and switch to new promise drivers:
http://www.promise.com/support/download/download2_eng.asp?productId=11&category=driver&os=0
(Ultra TX Series Drivers: http://www.promise.com/support/file/driver/1_Ultra 133_100 tx2 driver_b42.zip )

I made test system with working drivers, partioned that 160GB HD to 120GB+40GB ... Copied full of data. Then I rebooted, restored OLD system (working just fine, but has Original XP drivers). When windows was starting it was asking for chkdsk again (only for that 40GB drive)... I denied, didn't want to see those orphan deleting again.

After system was up. I upgraded drivers (not as easy as one would think, because it was "downgrading"):
1) My computer/Properties/Hardware/Device Manager
2) Select "Update driver..." of "Promise Technology Inc. Ultra IDE Controller" (with right mouse button)
3) "Install from a list or specific location (Advanced)". Next.
4) "Don't search. I will choose the driver to install.". Next.
5) "Have Disk"
6) Enter path of NEW drivers here. Driver version should be AT LEAST 2.0.0.42 (Dated: 28.3.2003)

... If you use "update driver" or something like that. It will use XP Drivers! XP Drivers is: 5.1.2600.1106 (1.7.2001) ... Seems to be Ultra66 drivers, original version is 1.43.0603

Looks like I have the same problems as most of the people in here! Has anyone got a stable working system yet?

I get the "Directory is corrupt please run chkdsk" message and I also get the same orphaned file messages when chkdsk runs at bootup and then find half my files are missing.


My hardware is :-

Asus P5GD2 Premium Motherboard
Intel P4 550 (3.4Ghz)
2x Corsair Value Select 512meg DDR-2 running dual chanel
128meg Gigabyte X600 Pro PCI-express
Seagate Barracuda 7200.7 SATA 160Gb
Western Digital JB2000 SATA 200Gb
Pioneer 108 DVD-RW
450Watt Psu (known good with very stable voltages)
OS : Windows 2000 Pro SP4

Same here

Damnit!@# Got the same problem today.

System specs:
-Windows XP Pro
-Mobo Chipset: Intel i845PE
-Ati RadeOn 9800 Pro
-Seagate 7200RPM 160GB
-Seagate 7200RPM 200GB
-no raid controller installed
-The two error partitions are both NTFS on seperate HD's. One is 105GB, the other is 183GB. Both contain a lot of small files.

Before the problem:
Had I no problems until I reinstalled Windows XP. My previous XP installation was Windows XP SP1 and SP2, with no HD problems.


Just before the first bad partition:
Today I did a reinstall. I installed Win XP Pro (without SP's) with almost no drivers installed other than the default XP drivers. Then I installed the Ati drivers of Intel Chipset drivers. I don't remember which one I installed first and don't remember if I rebooted between or before these drivers. After installing one or both of these drivers, I rebooted and got the first Chkdsk problem during the startup. An error with index $0 or something like that. Because the test was taking a lot of time, I did a cold reset during the test. (I know this is usually a bad idea, but I didn't trusted the test because I couldn't see any cause which might have caused those index problems.)

The first bad partition:
The index errors were on my 200GB HD, on the 183GB NTFS partition, which contained a lot of small files. Some directories on this partition where not accessible, Explorer gave the error:

There wasn't a clear pattern in which one was accessible and which one was not. I also hadn't used this partition yet, in the new XP installation.

Just before the second bad partition:
I backup some files on the bad partition to another large partition the other drive (G. After backing the directories which could be saved, I did a Chkdsk.exe /F J: in the command prompt. I took a lot of times (3 hours?), and thousands of thousands files where "orphaned". After Chkdsk, the directory structure was recovered. Files were assessible and OK, but some files were corrupted!@#&*!@&.

Here some of the last (of the tons of lines):

The second bad partition
After this, I installed some other software and drivers on my new XP installation. Also SP2 and a newer Intel chipset driver. After this, I rebooted and again, a corrupt partition!#@!@& This time it was on the other drive, the other large partition on which I backupped some files of the previous bad partition. This second corrupt partition contained large files (>100MB) instead of small files, but since I backupped files from the previous bad partition to this partition, I did contain a lot of small files. And only the Backupped directory on this second bad partition, is corrupted.

What I think what might be the cause:"
-If it's a hardware problem, than it might be because I moved the PC a bit (only 30cm), while it was running. But I doubt it.
-I think it's a software problem, because my previous XP installation never showed a problem like this before.
-I think it might be a driver (IDE?) problem maybe in combination with large NTFS partitions.
-Maybe I copied the problem (bad MFT atributes?) from the first bad partition to the second partition.

More info about MTF:
http://www.ntfs.com/ntfs_basics.htm
http://www.ntfs.com/quest14.htm

http://www.forensics-intl.com/def11.html
http://www.pcguide.com/ref/hdd/file/ntfs/archMFT-c.html
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q174619
"How NTFS Reserves Space for its Master File Table (MFT)"

still freaky in '05

Like many, I found this board through Google. In my case it's three different computers with varying sizes of hard drives. All have the MFT problem, all running Windows XP, SP2. One has a 40 gig Maxtor, another has an 80 gig WD and another has a 120 gig WD. None of them are repairable with chkdsk /r upon boot or from the Recovery Console. At any rate, I'm working over email with a Microsoft tech. I suspect he's going to tell me to format my hard drive(s) and start over. If I actually solve it without that I'll post all details.

Question: I backup my entire drives to second hard drives with Ghost, but I've never restored any of them. If I restore from a complete Ghost backup, will I just be restoring the same corrupted MTF? Can you restore data files selectively from Ghost? Would I be better off using something like MS Backup to just backup my data files and do clean installs of WinXP? From what I'm reading, within 6 months I'll be doing this again.

Coincidentally, the 2 computers running linux have no file corruption!

Update - Not as freaky

It took a while, but I think I have this figured out. Thinking my drive was trashed, since I couldn't get rid of the chkdsk bitmap errors, I put a new hd in and ran a clean install of Windows XP Home. I put no third party software on the computer, just updated Windows to all the security patches and finally, SP2. I ran chkdsk at that point to make sure I had no problems. Well, I did. The same "MFT is reporting space as used that isn't, bitmap errors, etc." At that point, it had to be BIOS, right? I went to the Asus site and flashed the newest BIOS (09/04) for my A7V8X-X motherboard. Uh, wrong. Then I ran chkdsk /r from the Recovery Console, chkdsk /f from boot, etc., all to no avail. The Windows defrag utility finished with no fragments, but strangely enough, it reported the Master File Table was in 21 pieces! On a brand new install!

Ready to give up and format/reinstall the OS and *not* upgrade to SP2, I tried installing Diskeeper Pro 8.0 on it. (MS escalated support had told me Diskeeper was the source of all my problems). I set Diskeeper to run at boot and to let chkdsk run, optimize the free space and defrag the MFT. Bingo. It ran successfully, reported the MFT in one piece and when I ran chkdsk again, there were no errors!

I installed all my apps and restored my data. I ran chkdsk again and the errors were back. I then ran Diskeeper and it reported a heavily fragmented drive (I just installed about 15 large applications). Set it to run at boot again and correct the MFT. It ran successfully and chkdsk later reported no errors again. The only caveat I can think of here is, if you already have Diskeeper, and you upgrade to SP2, you might have to uninstall/reinstall Diskeeper. And the only versions that will do this are Pro 8.0 and 9.0, which cost around $50.

I'm no engineer, but this is my theory. In Windows XP, the MFT just doesn't clean up after itself very well. When a lot of software is installed (at 90 megs compressed, SP2 is a lot of software) the MFT gets very fragmented. Over time, most people don't notice that their computer is running slower. The only reason I started checking my disk was because the computer crashed and could no longer see my c: drive. I'm not sure this is just an SP2 issue; I think it's adding a lot of software in general. Diskeeper Pro 8 (and most likely 9) can keep the MFT in good shape. I don't know of any other way to fix this problem, and I hope this helps anyone else out there Googling to find an answer. Because at this point, my sole help from Microsoft has been phone support telling me, "you need to take the computer to a repair shop". And escalated MS email support telling me to never run a 3rd party disk application on a Windows OS.

Amazing how this thread started two years ago and we are still having problems with this issue!

I have just read the three pages of this thread and am adding my two cents.

I created a boot floppy for MemTest32 as someone mentioned earlier and ran it from start up. It went through it's 8 levels of tests and then started the 8 test over again. This is probably normal, but I wouldn't know, because I didn't really read the readme.txt file.

My PC Specs:
Win2000 Pro SP4
1x512 DDR-266Mhz
AMD XP1600+
1x30GB (boot disk w/out problem) Seagate
1x60GB (file storage w/out problem) Seagate
1x200GB (file storage WITH problem) Seagate
Albatron KX600 MB

I received the "Deleting Oprhan file record segment" messages for the first time tonight and I almost went insane. After a few seconds, I was able to calm down and think smart enough to turn off the computer.

Tried unsuccessfully several times different ways to ever get the 200GB drive to work. Every time I canceled the file deletion messages it would load windows, but during start up of the desktop it would restart the machine. puke:

I am going to try using Diskeeper here in a minute as it's 3:30am and I'm going to sleep.

What I cant seem to understand is that I monitor my system (home office main computer) very tightly with Norton SystemWorks and allows update Windows as necessary. Now I will admit it's been nearly 4-6 weeks since I last ran SpeedDisk (Norton's Defragger). Also, the 200GB drive is always have data moved to/from and around it all the time, but usually not more than 50GB of data at a time.

Also, I am able to use the computer right now, because I have the 200GB drive unplugged and thus I cannot run DiskKeeper to diagnose that drive...damnit! This makes me mad!

I am so sick of computer problems, but as a web developer there is no other option! ha! I would change careers (still pondering this topic), but I am not sure what I would do instead...

I'll post again if anything new happens. auuuuuuuuggh!

Dammit...again!

I installed this program called, Get Data Back for NTFS, but of course it does not recognize my drive as it is not hooked up to the IDE cable. However, when it's hooked up it tries to delete my files and IF i skip the process the computer reboots itself at startup of windows desktop and loading of programs in the background. *groans*

I went through msconfig and deleted a bunch of unnecessary crap in the start up section...still no luck...

*cries uncontrollably*

I am going to go buy a USB hard drive enclosure for the 200GB drive and try access it that way, since SUB technology allows devices to be added while the computer is running.

This theory should then allow me to be able to run GetDataBack program on it and back up files as well.

I'll keep you informed.

Well, the USB harddrive enclosure theory didn't work...

Going to try something else...be back

No solutions yet, just an update. My partner's son ran chkdsk on his laptop and we now have *4* computers in the house with the identical "bitmap volume errors" messages (except for the one I fixed with a reinstall and adding Diskeeper Pro). They all upgraded to SP2 via "Automatic Updates".

Since one is a Dell, I've been talking to them. They suspect a boot sector virus and I sent a copy of boot.dat to Symantec Labs for testing (NAV says *no* boot sector virus but I'll wait until I hear back from Symantec Labs). On the Dell they want me to run a debugging utility (only available to people with Dells). That will remove all partitions and kill whatever is in the boot sector. Then I have to run FDISK on it. Then they want me to reinstall XP Pro.

I finally heard back from Microsoft escalated support. He has no solutions, but is insisting that Diskeeper Pro is the root of all my problems. Even though I had the same problems with just SP2 and no other apps on my reinstalled hard drive. And the only thing that saved it was installing Diskeeper Pro. Whatever, he is mailing me a new XP Pro cd with SP2 already "enmeshed" on it. Okay, I'll try anything.

It may be that since SP2 is such a big upgrade, that it runs better from a CD with it already part of the install program. IOW, installing it over XP with SP1 might be leaving some strangeness on your hard drive to cause boot sector problems. Just a theory, anyway.

Interesting they would mention a boot-sector virus.
They are very insidious and wreak havoc on the infected machine.
Although they had disappeared for many years i have seen more and more instances lately on client's machines.
One of the reasons they are back is these evil virus writers went back to a primitive yet effective method of spreading their garbage.
A lot of system BIOS's on newer machines are shipped with the BIOS virus scan set to off by default therefore they are just exploiting a known weakness.
Do yourself and all your friends a favor to check their BIOS settings to make sure the protection is turned on. It will stop the boot process and not let you continue until it is eradicated.

Hope it works out for you.

patio.

Update:

Still not resolved, but thought I would paste another issue I ran into. When bottin up in safemode (with or without network capability or even merely the command prompt) I get a blue screen with a bunch of instructions. The most important piece of text on there is this:

Address 80463059 base at 80400000, DateStamp 41773335 - ntoskrnl.exe

Can anyone tell me what this means?

I also downloaded the new bios version for my MB and tried to get the floppy to work as a boot diskette as the instructions read, but even with [Floppy] set as the first boot device, it kept coming up with the error about replacing it with a system disk and or remove it and press any key.

Any feedback on either of these issues would be appreciated.

Thanks,
Hall

It sounds like you didn't create a system disk when you put the BIOS on the floppy a:format /s

Do you have the instructions printed? BIOS flash can be easy, but you have to do it 100% correctly.

I rebooted my machine tonight and entered cmos. I "Enabled" the virus check for bios under advanced settings. Saved and exited.

This time the checkdisk feature prior to windows start up did not run and windows loaded normally. After most of the programs in startup loaded it blue screened on me with this message:

Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group.

Did some searching and found these articles that may prove helpful to some of us:

http://support.microsoft.com/kb/254649/EN-US/
http://support.microsoft.com/default.aspx?scid=kb;en-us;314492
http://whidbey.msdn.microsoft.com/l...ary/en-us/ddtools/hh/ddtools/bcintro_58tv.asp
http://support.microsoft.com/kb/315271

The next test I am going to perform here is opening msconfig.exe from the RUN window and set startup to windows default of the basic necessities. If you are using W2K you may already know that msconfig does not exist in it. Why they removed it from W2K I will never know! However, there is a simple solution. Download it free here: http://www.perfectdrivers.com/howto/msconfig.html Install it anywhere you want; preferably in the WINNT directory folder.

be back...

You'll need this as well when deciding which applications to keep running in msconfig start up list / processes list:

http://www.sysinfo.org/startuplist.php

Well, that even with set startup (in msconfig.exe) to the minimal necessities and rebooting did not change a thing, because after windows rebooted completely I powered on the usb hard drive and 10 seconds later it dumped all the physical memory instantly and gave me the blue screen of death...I gave it "the finger".

Also, I found this while hunting down more information: [Using the Online Crash Analysis Web Site] http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmd_stp_gmug.asp

It's great to finally be able to post a GREAT REPLY to update the status of this problem!!~!

I have been able to recover my data!!!

I took someone's suggestion earlier and checked out GetDataBack software by Runtime Software ( www.runtime.org. It is a FREE DOWNLOAD and is easy to install and run. They have pricing packages to meet your need and yet it's all not more than USD$180.00!

Let me briefly explain why YOU SHOULD use their software! The free download is 100% usuable to scan a hard drive that has gone bad. Listen to how POWERFUL this software is:

The free and completely usable software allows you to scan your drive and create a back up log for the future if necessary. I am running a 200GB 7200RPM IDE and it took about 42:00 hours or so. But now that I was able to save a back up log (which was about 25MB) I will not have to scan my drive again!!

For my particular situation, I purchased the NTFS Bundle, which included: GetDataBack for NTFS and Runtime's DiskExplorer for NTFS at USD$119.00. (This price is current as of February 2005, but subject to change.)

I checked around for DATA RECOVERY Services and the cheapest price I could find was between USD$800-1300.

Currently I am backing everything up to a WORKING hard drive, but when I am completely finished with this entire process, I will post one last reply; which will likely be with in the next few days as I am also in the middle of some other tasks at the moment as well.

Hall
------------------
My PC Specs:
Win2000 Pro SP4
1x512 DDR-266Mhz
AMD XP1600+
1x30GB (boot disk w/out problem) Seagate
1x60GB (file storage w/out problem) Seagate
1x200GB (file storage WITH problem) Seagate
Albatron KX600 MB

Had the mft chkdsk problem, solved it...

In reply to the last poster user HALL :

"It's great to finally be able to post a GREAT REPLY to update the status of this problem!!~!"

Same here...!

Instead of GetDataBack software, I used the exellent program:
Easy Recovery pro 6.4.
Ontrack Data Recovery, Inc.
ontrack easyrecovery website


Bad MFT file from extern Lacie D2 drive (firewire 800). File corruption of all files.

Easy Recovery Pro did this:

Recovered from "RAW format" 238 GB of files.

Recovery included:
1. all folder structures with
2. folder names,
3. settings
4. and tree structure
(GetDataBack software can't do all this.)


Reason for the diskfail was combination of two things (as far as I can figure out.)

1. Low on disk space. This is very important. Always have at least 10% to go on on large drives.
2. Bad memory (f.u....k. Noname memory)

This made the drive MFT file corrupt (The Master File Table (MFT) is a file on an NTFS partition, which contains all file and directory information for the partition. This is the most critical file on an NTFS partition and necessary for recovery).
Easy Recovery: " When you reformat a partition the MFT is deleted and recreated."


Solution:
1. Run Advanced Recovery for all clusters:

"Advanced Options - Partition Information

"For the most difficult recoveries, the AdvancedRecovery tool provides you with advanced recovery options including recovering from mistakenly deleted partitions, virus attacks, and other major file system corruptions. The tool provides a detailed graphical representation of the drives connected to your system including partitions associated with each device."

2. Don't try to defragment while bad drive!!! But, when you defragment (when good), be sure to use Perfect Disk for Defragmenting. (best defragmenter there ever was). Do this often.

3. This product should take care of your problems in the furure (+ Easy Recovery Pro):
PC INSPECTOR WatchIT USB

4. I also use Fix-It Utilities

for a daily based maintainance of disk(s). Works wonders in keeping your harddrive clean and tidy. Works with Easy Recovery as well.

If you have any questions, feel free to ask (add alfa + DOT=.): reafALFAsolDOTdk


Hint for Easy Recovery Pro; try FOSI (don't ask, if you know, you know...).

Hi,

That's definately a great reply. I know of OnTrack Data Recovery and have used their software a couple of years ago, but this time around I forgot their name and for the life of me couldn't remember it.

I will check into the software titles you mentioned. You brought up in conversation one title that I was not aware of: Perfect Disk, for drive defragging. I use Norton's SpeedDisk; however, on this particular drive and it's issue, I was really busy and didn't defrag over the past 4 months! Yeha I know that's wrong. I try to defrag at least twice a month.

There were some files that GetDataBack was not able to reply and I am still waiting to hear back from them as to why. I think those files that were not able to be recovered or even located were because they no longer existed and/or were damaged beyond recognition. What do you think?

I will post again soon.
Hall

Yes, great news near the end... but was anyone able to recover the files that were lost because they had been orphaned? That's what I really want to know how to fix... Did that get data back program find the old MFL and fix the orphaned data? Is this even possible? Well someone please tell me if and how I can get my orphaned files back please... =\