NTFS Volume Corrupt

Bob · External Since: Jun 15, 2005 Posts: 50

I am running Win2K/SP4. I have the boot disk in a removable bay so I
can clone and swap for backup and archive. What I will describe
applies to all three WD 80GB Caviar disks.

Sometimes when I reboot the machine, I get a blue screen which forces
me to mount the corrupt disk in D: and run CHKDSK D: /f. That has
always cleaned up the disk so I can continue to boot from it.

Here is the output of CHKDSK. Please suggest some things I can do to
fix this nuisance problem.

+++
The type of the file system is NTFS.
Volume label is System.

CHKDSK is verifying files (stage 1 of 3)...
0 percent completed.
Deleted corrupt attribute list entry
with type code 128 in file 9.
Deleting corrupt attribute record (128, $SDS)
from file record segment 10251.
1 percent completed.
2 percent completed.
3 percent completed.
[...]
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
File verification completed.
Correcting cross-link for file 6729.
CHKDSK is verifying indexes (stage 2 of 3)...
0 percent completed.
1 percent completed.
2 percent completed.
3 percent completed.
[...]
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Repairing the security file record segment.
Deleting an index entry with Id 256 from index $SII of file 9.
Deleting an index entry with Id 257 from index $SII of file 9.
Deleting an index entry with Id 259 from index $SII of file 9.
[...]
Deleting an index entry with Id 436 from index $SDH of file 9.
Deleting an index entry with Id 406 from index $SDH of file 9.
Deleting an index entry with Id 435 from index $SDH of file 9.
0 percent completed.
Replacing invalid security id with default security id for file 11.
Replacing invalid security id with default security id for file 29.
Replacing invalid security id with default security id for file 43.
0 percent completed.
Security descriptor verification completed.
CHKDSK is verifying Usn Journal...
Repairing Usn Journal file record segment.
Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

78148160 KB total disk space.
42498444 KB in 31285 files.
11004 KB in 2743 indexes.
0 KB in bad sectors.
172730 KB in use by the system.
65536 KB occupied by the log file.
35465981 KB available on disk.

512 bytes in each allocation unit.
156296321 total allocation units on disk.
70931963 allocation units available on disk.
+++

--

"One must realize that the world is a network of real and virtual
combat zones where the stakes are high, struggle is the primary
mode of being and only total victory is acceptable.
-- Sun Tzu, "The Art Of War"

David H. Lipman · External Since: Mar 14, 2004 Posts: 1826

From: "Bob" <spam.RemoveThis@uce.gov>

| I am running Win2K/SP4. I have the boot disk in a removable bay so I
| can clone and swap for backup and archive. What I will describe
| applies to all three WD 80GB Caviar disks.
|
| Sometimes when I reboot the machine, I get a blue screen which forces
| me to mount the corrupt disk in D: and run CHKDSK D: /f. That has
| always cleaned up the disk so I can continue to boot from it.
|
| Here is the output of CHKDSK. Please suggest some things I can do to
| fix this nuisance problem.
|
| +++
| The type of the file system is NTFS.
| Volume label is System.
|
| CHKDSK is verifying files (stage 1 of 3)...
| 0 percent completed.
| Deleted corrupt attribute list entry
| with type code 128 in file 9.
| Deleting corrupt attribute record (128, $SDS)
| from file record segment 10251.
| 1 percent completed.
| 2 percent completed.
| 3 percent completed.
| [...]
| 97 percent completed.
| 98 percent completed.
| 99 percent completed.
| 100 percent completed.
| File verification completed.
| Correcting cross-link for file 6729.
| CHKDSK is verifying indexes (stage 2 of 3)...
| 0 percent completed.
| 1 percent completed.
| 2 percent completed.
| 3 percent completed.
| [...]
| 97 percent completed.
| 98 percent completed.
| 99 percent completed.
| 100 percent completed.
| Index verification completed.
| CHKDSK is verifying security descriptors (stage 3 of 3)...
| Repairing the security file record segment.
| Deleting an index entry with Id 256 from index $SII of file 9.
| Deleting an index entry with Id 257 from index $SII of file 9.
| Deleting an index entry with Id 259 from index $SII of file 9.
| [...]
| Deleting an index entry with Id 436 from index $SDH of file 9.
| Deleting an index entry with Id 406 from index $SDH of file 9.
| Deleting an index entry with Id 435 from index $SDH of file 9.
| 0 percent completed.
| Replacing invalid security id with default security id for file 11.
| Replacing invalid security id with default security id for file 29.
| Replacing invalid security id with default security id for file 43.
| 0 percent completed.
| Security descriptor verification completed.
| CHKDSK is verifying Usn Journal...
| Repairing Usn Journal file record segment.
| Usn Journal verification completed.
| CHKDSK discovered free space marked as allocated in the
| master file table (MFT) bitmap.
| Correcting errors in the Volume Bitmap.
| Windows has made corrections to the file system.
|
| 78148160 KB total disk space.
| 42498444 KB in 31285 files.
| 11004 KB in 2743 indexes.
| 0 KB in bad sectors.
| 172730 KB in use by the system.
| 65536 KB occupied by the log file.
| 35465981 KB available on disk.
|
| 512 bytes in each allocation unit.
| 156296321 total allocation units on disk.
| 70931963 allocation units available on disk.
| +++
|

This is NOT a Registry problem. If you are going to Cross-Post make sure the post is
relevant and On Topic to ALL News Groups it is Cross-Posted to.

Go to the hard disk manufacturer's web site and download their diagnostic software
respective to your hard disk. After the test, you will know if the hard disk is bad or
not..

Quantum/Maxtor - PowerMax
http://www.maxtor.com/en/support/downloads/powermax.htm

Western Digital - Data LifeGuard Tools (DLGDiag)
http://support.wdc.com/download/

Hitachi/IBM - Drive Fitness Test (DFT)
http://www.hgst.com/hdd/support/download.htm

Seagate - SeaTools
http://www.seagate.com/support/seatools/

Fujitsu - Diagnostic Tool
http://www.fcpa.com/download/hard-drives/

Samsung - Disk manager
http://www.samsung.com/Products/HardDiskDrive/utilities/shdiag.htm

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Bob · External Since: Jun 15, 2005 Posts: 50

On Wed, 16 Aug 2006 17:32:21 -0400, "David H. Lipman"
<DLipman~nospam~@Verizon.Net> wrote:

>< PLONK > !

How juvenile.

--

"One must realize that the world is a network of real and virtual
combat zones where the stakes are high, struggle is the primary
mode of being and only total victory is acceptable.
-- Sun Tzu, "The Art Of War"

shura · External Since: Aug 18, 2006 Posts: 2

Bob wrote:
>
> Here is the output of CHKDSK. Please suggest some things I can do to
> fix this nuisance problem.
>
> +++
> The type of the file system is NTFS.
> Volume label is System.
>
> CHKDSK is verifying files (stage 1 of 3)...
> 0 percent completed.
> Deleted corrupt attribute list entry
> with type code 128 in file 9.
> Deleting corrupt attribute record (128, $SDS)

These messages mean that file $Secure (number 9) becames too fragmented.
I don't know why NTFS driver (?) creates invalid attribute list for this
file.
When chkdsk deletes attribute 0x80 $SDS then all securities are deleted
and each reference to these security became invalid too.
Each file has reference to security placed in attribute 0x80 : $SDS.
chkdsk creates a default security and fixes all invalid references.

I think that you should defragment volume to make easy to extend file
$Secure

Bob · External Since: Jun 15, 2005 Posts: 50

On Fri, 18 Aug 2006 17:45:57 +0300, shura <a@a> wrote:

>These messages mean that file $Secure (number 9) becames too fragmented.
>I don't know why NTFS driver (?) creates invalid attribute list for this
>file.
>When chkdsk deletes attribute 0x80 $SDS then all securities are deleted
>and each reference to these security became invalid too.
>Each file has reference to security placed in attribute 0x80 : $SDS.
>chkdsk creates a default security and fixes all invalid references.

>I think that you should defragment volume to make easy to extend file
>$Secure

I have used the Win2K defrag but it doesn't help. Sometimes it
actually corrupts a disk that was not corrupt on startup.

--

"One must realize that the world is a network of real and virtual
combat zones where the stakes are high, struggle is the primary
mode of being and only total victory is acceptable.
-- Sun Tzu, "The Art Of War"

Bob · External Since: Jun 15, 2005 Posts: 50

On Fri, 18 Aug 2006 17:45:57 +0300, shura <a@a> wrote:

>> CHKDSK is verifying files (stage 1 of 3)...
>> 0 percent completed.
>> Deleted corrupt attribute list entry
>> with type code 128 in file 9.
>> Deleting corrupt attribute record (128, $SDS)

>These messages mean that file $Secure (number 9) becames too fragmented.
>I don't know why NTFS driver (?) creates invalid attribute list for this
>file.

>When chkdsk deletes attribute 0x80 $SDS then all securities are deleted
>and each reference to these security became invalid too.
>Each file has reference to security placed in attribute 0x80 : $SDS.
>chkdsk creates a default security and fixes all invalid references.

>I think that you should defragment volume to make easy to extend file
>$Secure

Another thing I should mention is that everytime I reboot, I get the
following error message in Event Viewer under Applications:

+++
Event Type: Warning
Event Source: SysmonLog
Event Category: None
Event ID: 2006
Date: 8/21/2006
Time: 4:54:17 AM
Description:
Unable to read the Log File Folder value of the System Overview log or
alert configuration. The default value will be used. The error code
returned is in the data.
Data:
0000: 02 00 00 00 ....
+++

What is causing this and how do I fix it?

--

Rope, Tree, Journalist - some assembly required.

MicroSoft · External Since: Sep 19, 2006 Posts: 3

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:OKtH1qKwGHA.1224@TK2MSFTNGP03.phx.gbl...
> From: "Bob" <spam.RemoveThis@uce.gov>
>
> | I am running Win2K/SP4. I have the boot disk in a removable bay so I
> | can clone and swap for backup and archive. What I will describe
> | applies to all three WD 80GB Caviar disks.
> |
> | Sometimes when I reboot the machine, I get a blue screen which forces
> | me to mount the corrupt disk in D: and run CHKDSK D: /f. That has
> | always cleaned up the disk so I can continue to boot from it.
> |
> | Here is the output of CHKDSK. Please suggest some things I can do to
> | fix this nuisance problem.
> |
> | +++
> | The type of the file system is NTFS.
> | Volume label is System.
> |
> | CHKDSK is verifying files (stage 1 of 3)...
> | 0 percent completed.
> | Deleted corrupt attribute list entry
> | with type code 128 in file 9.
> | Deleting corrupt attribute record (128, $SDS)
> | from file record segment 10251.
> | 1 percent completed.
> | 2 percent completed.
> | 3 percent completed.
> | [...]
> | 97 percent completed.
> | 98 percent completed.
> | 99 percent completed.
> | 100 percent completed.
> | File verification completed.
> | Correcting cross-link for file 6729.
> | CHKDSK is verifying indexes (stage 2 of 3)...
> | 0 percent completed.
> | 1 percent completed.
> | 2 percent completed.
> | 3 percent completed.
> | [...]
> | 97 percent completed.
> | 98 percent completed.
> | 99 percent completed.
> | 100 percent completed.
> | Index verification completed.
> | CHKDSK is verifying security descriptors (stage 3 of 3)...
> | Repairing the security file record segment.
> | Deleting an index entry with Id 256 from index $SII of file 9.
> | Deleting an index entry with Id 257 from index $SII of file 9.
> | Deleting an index entry with Id 259 from index $SII of file 9.
> | [...]
> | Deleting an index entry with Id 436 from index $SDH of file 9.
> | Deleting an index entry with Id 406 from index $SDH of file 9.
> | Deleting an index entry with Id 435 from index $SDH of file 9.
> | 0 percent completed.
> | Replacing invalid security id with default security id for file 11.
> | Replacing invalid security id with default security id for file 29.
> | Replacing invalid security id with default security id for file 43.
> | 0 percent completed.
> | Security descriptor verification completed.
> | CHKDSK is verifying Usn Journal...
> | Repairing Usn Journal file record segment.
> | Usn Journal verification completed.
> | CHKDSK discovered free space marked as allocated in the
> | master file table (MFT) bitmap.
> | Correcting errors in the Volume Bitmap.
> | Windows has made corrections to the file system.
> |
> | 78148160 KB total disk space.
> | 42498444 KB in 31285 files.
> | 11004 KB in 2743 indexes.
> | 0 KB in bad sectors.
> | 172730 KB in use by the system.
> | 65536 KB occupied by the log file.
> | 35465981 KB available on disk.
> |
> | 512 bytes in each allocation unit.
> | 156296321 total allocation units on disk.
> | 70931963 allocation units available on disk.
> | +++
> |
>
> This is NOT a Registry problem. If you are going to Cross-Post make sure
the post is
> relevant and On Topic to ALL News Groups it is Cross-Posted to.
>
> Go to the hard disk manufacturer's web site and download their diagnostic
software
> respective to your hard disk. After the test, you will know if the hard
disk is bad or
> not..
>
> Quantum/Maxtor - PowerMax
> http://www.maxtor.com/en/support/downloads/powermax.htm
>
> Western Digital - Data LifeGuard Tools (DLGDiag)
> http://support.wdc.com/download/
>
> Hitachi/IBM - Drive Fitness Test (DFT)
> http://www.hgst.com/hdd/support/download.htm
>
> Seagate - SeaTools
> http://www.seagate.com/support/seatools/
>
> Fujitsu - Diagnostic Tool
> http://www.fcpa.com/download/hard-drives/
>
> Samsung - Disk manager
> http://www.samsung.com/Products/HardDiskDrive/utilities/shdiag.htm
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
I'd rather see crossposts than multi posts; relax, have a sip.

imatthews

Did anyone come up with a solution for this?

I am a dealer and a system admin. I have a customer with as many as 4 machines in one office with the exact same problem. All of them are running Windows 2000 SP4 with hot fixes current through July 2006 and a single drive in BASIC mode (i.e. no hardware or software RAID, not a W2K DYNAMIC DISK):

Seagate "SATA II"disks between 200 and 320GB (like ST3320620AS, and ST3250620AS)
GigaByte Motherboards (like GA-K8NF-9 BIOS 11)
Integrated nVidia nForce4 SATA Controllers
AMD Athlon 64 CPU's (like 3200+ and 3500+)
ATI PCI-E Video Cards (like x550 and x1600)

All 3 Seagate drive diags show no problems.

Seagate has sent me a firmware update they do not think it will help. Given that the original post is related to WD 80GB drives, I think Seagate's pessimism is warrented.

The problems started about two months ago. This week two machines blue screened with INACCESSABLE BOOT DEVICE on boot up after installing the latest Windows Update hotfixes. Because the machines were previously patch up to July, the updates were from August and September only. The patches were for both Windows 2000 and Office XP. One of the machines was patched from WINDOWSUPDATE.MICROSOFT.COM and the other took its patches from a corporate WSUS server.

I have spent in excess of 6 hours with MS tech support on this issue and thus far found nothing. I am continuing to work on the problem with MS and will post any resolution in this forum.

Both the original post and my post relate to problems that began in the July / Aug time frame. There is likely a pattern here.

BOB: What is the MBoard manufacturer (i.e. Asus, Dell, GigaByte...) and Hard Drive Controller (i.e. nForce 4, VIA, Intel 950...) Lets try to find a pattern!

jpgirard · Joined: Jul 13, 2008 Posts: 1

I don't know if this will help, but I'm also running Wink2 SP4 and I have this problem everytime I use Limewire. I'm a collector of old songs and Limewire is one of the things I routinely use to search. I've found it easier to live with this problem than to fix it (particularly since nobody seems to have a fix).

My problem has actually been that I get a blue screen that tells me to run CHKDSK, but I can't reboot to do so. I've installed a bootable, barebones copy of Win2K on my second (slave) drive. So when I get the blue screen I reboot, go to setup, make the slave the master, and boot onto the second drive, then reboot from that and use setup to switch master and slave again. Once I do that, Windows comes up and runs CHKDSK, which makes all the changes you describe. That's the longest part of the process. But since it only happens after I've used Limewire, I just consider it part of running that program, and take the extra time into account. It means I don't use Limewire unless I'm willing to go through this process afterward.

I assume the problem is something getting through the firewall and antivirus, but neither one can find anything, and it doesn't appear to cause any other problems. Unless I run Limewire, it never happens.

If your computer is going into CHKDSK immediately, when you reboot the first time, count yourself lucky. If it did that for me, I wouldn't have to switch drives to fix it. But I haven't found any fix for this problem on the web.