Chkdsk vs. Chkntfs?

[Yousuf Khan]

I've been occasionally getting an error message on my Event Viewer,
Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume Hit 1000 winboot."

I'm absolutely certain that these are mostly fake messages, caused by
transient power losses. But still, I can't take a chance, If I were to
follow the advice given in the message and run chkdsk, since it's a boot
disk, it will require a reboot of the system and the chkdsk will run
just prior to system restart. I'd have no problems with that except
chkdsk is woefully slow, it takes over an hour to run it on my system.
I'd rather not run it, if all it's going to find is that there is
nothing wrong with the file system.

I found a technote from Microsoft, which is for a previous version of
Windows:

http://www.microsoft.com/technet/su...=5.2.3790.1830&EvtID=55&EvtSrc=ntfs&LCID=1033

It suggested running the "chkntfs" utility on the drive letter first and
it returns a simple "is dirty" or an "is not dirty" message. Runs in a
few seconds even while online. It usually sends back an "is not dirty"
message. Can this utility be trusted, compared to "chkdsk"? That is, are
there situations which Chkntfs is not aware of that Chkdsk is more
thorough about?

Yousuf Khan

 

[Carroll Robbins]

I've been occasionally getting an error message on my Event Viewer,
Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume Hit 1000 winboot."

Run chkdsk with no options so it runs in read only mode with no surface
scan. This is fast and only takes a few minutes for most disks and checks
the NTFS.

 

[J. P. Gilliver (John)]

Run chkdsk with no options so it runs in read only mode with no surface
scan. This is fast and only takes a few minutes for most disks and checks
the NTFS.

Will doing that clear the flag that is causing Yousuf to get the warning
messages he is getting?

Yousuf, when you say you think these "are mostly fake messages, caused
by transient power losses" - what is causing these? If the mains supply
where you are often has these, a UPS (assuming this isn't a
laptop/netbook) is probably a good idea.

 

[DevilsPGD]

In message <[email protected]> someone claiming to be Yousuf

It suggested running the "chkntfs" utility on the drive letter first and
it returns a simple "is dirty" or an "is not dirty" message. Runs in a
few seconds even while online. It usually sends back an "is not dirty"
message. Can this utility be trusted, compared to "chkdsk"? That is, are
there situations which Chkntfs is not aware of that Chkdsk is more
thorough about?

chkntfs doesn't actually check anything on the drive except whether the
drive is scheduled for an automatic chkdsk on startup.

If a drive is shut down with potential for data loss in the NTFS
filesystem itself, a chkdsk will be scheduled and run automatically on
the next startup.

That being said, it's very rare that you'll have NTFS corruption these
days unless you have failing hardware, NTFS is reasonably good at
detecting and correcting possible corruption in real time (or the next
time the volume is mounted, in the case of a sudden shutdown)

 

[Wolf K]

Will doing that clear the flag that is causing Yousuf to get the warning
messages he is getting?

No, because it doesn't repair anything. Run with /f to repair, and that
can indeed take a long time I'd do it during lunchtime, or overnight.

HTH
Wolf K.

 

[Carroll Robbins]

Will doing that clear the flag that is causing Yousuf to get the warning
messages he is getting?

The error messages are not caused by a flag. chkdsk will check the volume
to determine if it is corrupt. If it checks out good then the message is
bogus or transient. If the volume is corrupt then you will need to use the
/f option to fix it. This is also quick but the time depends on the
corruption and you will most likely lose some data. The /r option to do a
surface scan is the slow option that takes a long time and is only
necessary if the hardware is failing.

 

[Rod Speed]

I've been occasionally getting an error message on my Event Viewer, Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Hit 1000 winboot."

I'm absolutely certain that these are mostly fake messages, caused by transient power losses.

They arent necessarily 'fake' if its caused by a transient power loss.

But still, I can't take a chance, If I were to follow the advice given in the message and run chkdsk, since it's a
boot disk, it will require a reboot of the system and the chkdsk will run just prior to system restart. I'd have no
problems with that except chkdsk is woefully slow, it takes over an hour to run it on my system. I'd rather not run
it, if all it's going to find is that there is nothing wrong with the file system.

Trouble is that since the problem is caused by a transient power loss,
the only way to be sure if it really has been corrupted is to run chkdsk.

I found a technote from Microsoft, which is for a previous version of Windows:

It suggested running the "chkntfs" utility on the drive letter first
and it returns a simple "is dirty" or an "is not dirty" message. Runs
in a few seconds even while online. It usually sends back an "is not
dirty" message. Can this utility be trusted, compared to "chkdsk"?
That is, are there situations which Chkntfs is not aware of that
Chkdsk is more thorough about?

Its telling you what you already know, if the drive is flagged as dirty,
that you need to run chkdsk. It also allows you to reset that flag if
you want to postpone doing the chkdsk and dont just want to cancel
that manually at reboot time.

One obvious approach is to use a UPS so you dont get transient power losses.

 

[Philip Herlihy]

I've been occasionally getting an error message on my Event Viewer,
Event ID 55, source Ntfs, message:

"The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume Hit 1000 winboot."

I'm absolutely certain that these are mostly fake messages, caused by
transient power losses. But still, I can't take a chance, If I were to
follow the advice given in the message and run chkdsk, since it's a boot
disk, it will require a reboot of the system and the chkdsk will run
just prior to system restart. I'd have no problems with that except
chkdsk is woefully slow, it takes over an hour to run it on my system.
I'd rather not run it, if all it's going to find is that there is
nothing wrong with the file system.

I found a technote from Microsoft, which is for a previous version of
Windows:

http://www.microsoft.com/technet/su...=5.2.3790.1830&EvtID=55&EvtSrc=ntfs&LCID=1033

It suggested running the "chkntfs" utility on the drive letter first and
it returns a simple "is dirty" or an "is not dirty" message. Runs in a
few seconds even while online. It usually sends back an "is not dirty"
message. Can this utility be trusted, compared to "chkdsk"? That is, are
there situations which Chkntfs is not aware of that Chkdsk is more
thorough about?

Yousuf Khan

This is like continuing to drive a car after the oil light comes on.
Yes, it *might* be a false alarm, but...

It's perfectly possible that your disk is on its last legs, and you're
days or even hours away from total, unrecoverable loss. Yes, that's the
worst case, but I see it regularly.

What I'd do is this:

Back up all data on the disk to separate physical storage

Image the disk (e.g. Acronis True Image, or Windows Complete backup)
again to separate physical storage. (This preserves Windows, and the
effort that might otherwise go into installing it, and all you
applications and settings.

If you have anything installed which can monitor the disk's SMART data
(e.g. HDTune) run that and see if any of the parameters, particularly
"Reallocated Sectors" is showing an alert.

I use a paid-for utility called Spinrite to audit and manage the state
of sectors on the disk (this also reports SMART status). It can take 48
hours to run for a large disk, especially if it's struggling to recover
data from failing sectors.

Then I'd run the fullest version of chkdsk, which only takes a couple of
hours, typically.

If you can't spare an hour or so to run chkdsk when the system seems to
be asking you to, then you have to accept you could lose everything.

Once you're confident your syste is ok, install HDTune or Acronis Disk
Monitor (configure it not to monitor backups, if you don't want these
alerts).

Disks don't last for ever!

 

[Yousuf Khan]

Will doing that clear the flag that is causing Yousuf to get the warning
messages he is getting?

Yousuf, when you say you think these "are mostly fake messages, caused
by transient power losses" - what is causing these? If the mains supply
where you are often has these, a UPS (assuming this isn't a
laptop/netbook) is probably a good idea.

UPS might help, but I've had somewhat bad experiences with UPSes in the
past, so I'm not really ready to go down that road again. My system is a
somewhat unusually power-hungry system, there's a 650W PS inside it, but
it may just be barely enough to power all of the stuff inside it.
Besides the mainboard and processor, there is six internal hard drives,
a video card, and a couple of optical drives. Plus there are various USB
hard drives and other peripherals that get attached and detached from it
from time to time. It's more of a server really than a standard desktop.

Yousuf Khan

 

[Yousuf Khan]

chkntfs doesn't actually check anything on the drive except whether the
drive is scheduled for an automatic chkdsk on startup.

If a drive is shut down with potential for data loss in the NTFS
filesystem itself, a chkdsk will be scheduled and run automatically on
the next startup.

That being said, it's very rare that you'll have NTFS corruption these
days unless you have failing hardware, NTFS is reasonably good at
detecting and correcting possible corruption in real time (or the next
time the volume is mounted, in the case of a sudden shutdown)

I have a task attached to the NTFS error event in the event viewer. The
task immediately notifies me when this error occurs with a pop-up
message. The message pops up in the middle of normal operations most of
the time, not during power failures or improper shutdowns most of the
time. That's not to say that message occurs often, it's only happened 4
times in the last two months, so far, and three of those occurred three
times in a row on one particular day in November, for what reason I
don't know; so I'd consider that only one incident really. Even during
the November incident when running chkdsk during the next reboot, it
found nothing wrong.

Yousuf Khan

 

[Yousuf Khan]

Its telling you what you already know, if the drive is flagged as dirty,
that you need to run chkdsk. It also allows you to reset that flag if
you want to postpone doing the chkdsk and dont just want to cancel
that manually at reboot time.

Well, then it's strange because even though I see the message in the
event viewer, chkntfs says that there is nothing wrong. You'd think if
it appears in Event Viewer, then the flag would've been set by the
operating system on that file system?

Yousuf Khan

 

[Yousuf Khan]

This is like continuing to drive a car after the oil light comes on.
Yes, it *might* be a false alarm, but...

It's perfectly possible that your disk is on its last legs, and you're
days or even hours away from total, unrecoverable loss. Yes, that's the
worst case, but I see it regularly.

What I'd do is this:

Back up all data on the disk to separate physical storage

The disk is already imaged weekly. However, there are no additional
errors listed in the drive's own SMART logs. There are several
indicators saying that nothing is wrong, but one that is saying that
something may be wrong.

Yousuf Khan

 

[Gene E. Bloch]

This is like continuing to drive a car after the oil light comes on.
Yes, it *might* be a false alarm, but...

And to reinforce that, I never have forgotten this anecdote:

My friend's fiance was temporarily a few hundred miles away, so she
couldn't look over his shoulder to prevent this. The oil light in his
car was on, so he decided he needed to get the *light* fixed fairly
soon.

He procrastinated longer than the engine lasted...

He was a rather non-technical person, so he hadn't realized what was
going on. Which is pretty much stating the obvious.

 

[Rod Speed]

Yousuf Khan wrote

Rod Speed wrote

Well, then it's strange because even though I see the message in the event viewer, chkntfs says that there is nothing
wrong.

chkntfs doesnt check for problems, it JUST shows the dirty flag and allows you to cancel it.

You'd think if it appears in Event Viewer, then the flag would've been set by the operating system on that file
system?

Nope, the DIRTY flag gets set for other reasons.

 

[J. P. Gilliver (John)]

UPS might help, but I've had somewhat bad experiences with UPSes in the
past, so I'm not really ready to go down that road again. My system is
a somewhat unusually power-hungry system, there's a 650W PS inside it,
but it may just be barely enough to power all of the stuff inside it.

[]
So maybe that is the source of the transient losses - is that what
you're saying? (In which case you need a bigger one, assuming such exist
- or, some _big_ capacitors on all the power rails, which may not be
practical).

If not, and you're genuinely somewhere that gets brief interruptions in
the mains, then you do need a UPS: not to give you backup power for
long, just to bridge the gaps (and _possibly_ give you time to shutdown
in the event of a real power cut). Yes, they do deteriorate: you need to
check (and possibly change) the batteries not that infrequently.

 

[Philip Herlihy]

The disk is already imaged weekly. However, there are no additional
errors listed in the drive's own SMART logs. There are several
indicators saying that nothing is wrong, but one that is saying that
something may be wrong.

Yousuf Khan

The most valuable part of your system is invariably the data on that
disk, so you may get some peace of mind by installing the free Acronis
Disk Monitor. It has a facility to monitor backups run by the (also
excellent) Acronis True Image but if you don't need those alerts you can
disable them. It's saved several customers from data loss (and there's
one on their way for a disk swap as I write).

 

[Paul]

UPS might help, but I've had somewhat bad experiences with UPSes in
the past, so I'm not really ready to go down that road again. My
system is a somewhat unusually power-hungry system, there's a 650W PS
inside it, but it may just be barely enough to power all of the stuff
inside it.

[]
So maybe that is the source of the transient losses - is that what
you're saying? (In which case you need a bigger one, assuming such exist
- or, some _big_ capacitors on all the power rails, which may not be
practical).

<<snip>>

Generally, slapping capacitors on DC power conversion devices, is not recommended.

On passive designs (transformer-rectifier-cap), larger caps cause
inrush current to blow out the rectifier. The size of the cap is
necessarily a compromise in that case (larger cap reduces ripple,
smaller cap avoids rectifier blowout). You can increase the
complexity of the design, to fix that.

On active devices (ATX supply/switching converter), larger caps on
the output side, may degrade the "phase margin".

http://www.formfactors.org/developer/specs/ATX12V PSDG2.01.pdf

Table 12. Output Capacitive Loads

Output Capacitive load (µF)
+12V1 5,000
+12V2 3,000
+5V 6,000
+3.3V 6,000
-12V 350
+5VSB 350

These are puny values, and won't be enough to tide you over
for very long. If you use larger values than that (I have 250,000uF
in my parts bin in the house here), that could cause the supply to
oscillate. Phase margin is to ensure stability.

Storing up power some other place (inside a UPS), will fix that.
They're designed to store power.

The input side of the ATX supply, is actually storing power for
you, and is a bit more effective than slapping on output capacitors.
The primary capacitor in the ATX supply, holds up the power for
at least 16 milliseconds or so (under full load), and with
the typical light load on a computer now, the primary capacitor
can "ride out" a longer outage than that. That is how an ATX
supply won't glitch the output, when you combine it with a
cheap UPS. A cheap UPS needs some number of milliseconds, to
switch over to battery, and during that time, the primary
side capacitor in the ATX supply, takes up the slack.

The ATX supply has an "inrush limiter" on the primary side, to
avoid blowing out front end components. But there are limits
to how much such a simple scheme can be scaled. As it is,
if you read the label on the supply, you may find it has a huge
inrush, even with the limiter. And this is why you'll notice
the lights dim momentarily, when you flip on the switch on
the back of the ATX supply. My cheap Sparkle supply, has
enough of an inrush, it triggers the alarm on my UPS. My other,
slightly more expensive supplies, don't do that (they still
dim the lights, but don't trip the alarm beeper on the UPS).

*******

To adequately engineer the setup, a Kill-O-Watt meter can be
used to determine whether the ATX supply is big enough, and
what size of UPS might be good. This is for determining the load,
as observed on the AC side of things. The meter can be
relatively cheap, and still do a good job.

http://www.amazon.com/P3-Internatio...MDBU/ref=sr_1_2?ie=UTF8&qid=1323689789&sr=8-2

For checking the DC rails, I use one of these. A DC clamp-on ammeter.
Some of these, measure AC current only, and would be useless
for the job of checking the output of an ATX supply. Others,
have both AC and DC ranges, and are based on a Hall probe
inside the meter. For example, to check +5V loading, you
grab all the +5V wires in the main 20 or 24 wire harness, and
put them within the jaws of the meter. And then the meter detects
current flow, based on the magnetic field caused by the current.
It automatically sums the current in the wires (magnetic fields add).

http://www.amazon.com/Extech-MA120-...ZV5O/ref=sr_1_4?ie=UTF8&qid=1323690057&sr=8-4

The nice thing about such ammeters, is there is no "fuse" inside them
A hardware store multimeter, may have a 10 amp fuse inside the
meter. Which tells you there isn't much room for heavy current
measurement. With my clamp-on DC ammeter, and the magnetic field
measurement method, I can even measure things like the
current drawn by the starter motor in my car (150 amps).
And all without any danger from wires burning or
fuses popping.

Paul

 

[Yousuf Khan]

So maybe that is the source of the transient losses - is that what
you're saying? (In which case you need a bigger one, assuming such exist
- or, some _big_ capacitors on all the power rails, which may not be
practical).

Yeah, the shear number of electrical devices hanging off of same wall
outlet is high, and there aren't enough other wall outlets nearby, so a
lot of powerbars coming out of the same outlet. The machine acts much
better when fewer USB peripherals are connected to it.

If not, and you're genuinely somewhere that gets brief interruptions in
the mains, then you do need a UPS: not to give you backup power for
long, just to bridge the gaps (and _possibly_ give you time to shutdown
in the event of a real power cut). Yes, they do deteriorate: you need to
check (and possibly change) the batteries not that infrequently.

It may not be the power itself is browned-out from the electrical
utility, but the power draws are large in that particular area of my
house. I've rarely experienced a power outage here, last one was maybe 5
years ago, so the UPS's battery tends to die out well in advance of the
next power outage.

Yousuf Khan

 

[Yousuf Khan]

The most valuable part of your system is invariably the data on that
disk, so you may get some peace of mind by installing the free Acronis
Disk Monitor. It has a facility to monitor backups run by the (also
excellent) Acronis True Image but if you don't need those alerts you can
disable them. It's saved several customers from data loss (and there's
one on their way for a disk swap as I write).

I'm using the licensed Macrium Reflect as my backup and imaging app. I
found it good enough to upgrade from its free version.

Yousuf Khan

 

[Yousuf Khan]

And to reinforce that, I never have forgotten this anecdote:

My friend's fiance was temporarily a few hundred miles away, so she
couldn't look over his shoulder to prevent this. The oil light in his
car was on, so he decided he needed to get the *light* fixed fairly soon.

He procrastinated longer than the engine lasted...

He was a rather non-technical person, so he hadn't realized what was
going on. Which is pretty much stating the obvious.

Some people just shouldn't be using modern appliances like cars. One
lady I know, bought an expensive car, but never could even be bothered
to learn how to operate the rear window defroster on it. One day she
showed up at the airport after a severe ice storm and had a full layer
of ice caked on the back window with no way to see out of it. I asked
her why she didn't just hit the rear window defroster, even if she
couldn't be bothered to scrape it off by hand. She said she didn't know
where the button was, nor that she had such a button!

Another lady, who I didn't know, but she was stuck after snowstorm, and
she was in a Jeep. We were helping her try to get out, and then I asked
her if the four-wheel drive system on her Jeep wasn't working? She asked
what's four-wheel drive!?

Yousuf Khan