Check Disk (CHKDSK) Detects File System Problem But Doesn't Fix It

You cannot run CHKDSK in a dos window.   Open a dos window.

CMD.EXE

Type CHKDSK /R

It will ask you if you want to run chkdsk at next reboot.

Say Yes and Restart.

The hint is

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

Manually run Chkdsk

If Autochk does not automatically run, you can manually run the Chkdsk disk scanner. To do this, follow these steps:

  1. Click Start, click Run, type chkdsk /f /r, and then click OK.

  2. At the command prompt, type Y to let the disk scanner run when you restart the computer.

  3. Restart the computer.

  4. Chkdsk will run.

Keep in Mind that CHKDSK and Scandisk DO NOT REPAIR physical damage or bad sectors on a drive that is out of spares.

Time to buy a new drive.  You may only have a few days, hours, minutes left.

That's exactly what I did. I scheduled the scan via the Drive's Tool tab and the scan runs on boot. I ran the scan again without the F parameter after booting just to determine if problem is still there and sure enough it still reports the problem.

I don't think it's bad sector or damaged HDD. I did a thorough scan using CHKDSK and HD Tune and it does not report any bad sectors. I always keep a spare back up in another drive though.

SQL Server orphaned files are not a desktop or Dell Hardware Issue.

Those are Firefox related files but that's just one example. Different errors are given everytime a scan is done. So far everything is running fine except for this weird problem.

Okay I ran CHKDSK again, in this sequence: Desktop > Safe Mode > Boot > Desktop

And the results:

1. Desktop - Windows found problems with the file system. (I did not copy down the full log)

2. Safe Mode - No errors or problems whatsoever...

C:\Documents and Settings\User>chkdsk C:
The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

  78124063 KB total disk space.
  38314232 KB in 122197 files.
     48664 KB in 9253 indexes.
         0 KB in bad sectors.
    325415 KB in use by the system.
     65536 KB occupied by the log file.
  39435752 KB available on disk.

      4096 bytes in each allocation unit.
  19531015 total allocation units on disk.
   9858938 allocation units available on disk.

3. Boot - I took a picture before it reached 100% for Stage 5 but the result displayed was CLEAN after it automatically restarted the computer and result is displayed:

Weird thing is Event Viewer seems to say otherwise:

Event Type:    Information
Event Source:    Winlogon
Event Category:    None
Event ID:    1001
Date:        9/7/2011
Time:        2:09:29 PM
User:        N/A
Computer:    User
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         
Cleaning up minor inconsistencies on the drive.
Cleaning up 6 unused index entries from index $SII of file 0x9.
Cleaning up 6 unused index entries from index $SDH of file 0x9.
Cleaning up 6 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

  78124063 KB total disk space.
  38313216 KB in 122199 files.
     48664 KB in 9253 indexes.
         0 KB in bad sectors.
    325415 KB in use by the system.
     65536 KB occupied by the log file.
  39436768 KB available on disk.

      4096 bytes in each allocation unit.
  19531015 total allocation units on disk.
   9859192 allocation units available on disk.

Internal Info:
e0 50 02 00 87 01 02 00 2a 0f 03 00 00 00 00 00  .P......*.......
a1 26 00 00 00 00 00 00 58 04 00 00 00 00 00 00  .&......X.......
96 d4 58 0a 00 00 00 00 76 71 77 78 00 00 00 00  ..X.....vqwx....
0e 43 55 0e 00 00 00 00 90 d9 e2 4a 04 00 00 00  .CU........J....
3c d8 02 1e 02 00 00 00 e4 79 63 0a 07 00 00 00  <........yc.....
60 89 5e b2 00 00 00 00 b0 3a 07 00 57 dd 01 00  `.^......:..W...
00 00 00 00 00 00 74 22 09 00 00 00 25 24 00 00  ......t"....%$..

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

4. Desktop - I ran CHKDSK again without the F parameter once desktop is loaded and got the errors again:

C:\Documents and Settings\User>chkdsk C:
The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

  78124063 KB total disk space.
  40937180 KB in 122207 files.
     48664 KB in 9254 indexes.
         0 KB in bad sectors.
    325415 KB in use by the system.
     65536 KB occupied by the log file.
  36812804 KB available on disk.

      4096 bytes in each allocation unit.
  19531015 total allocation units on disk.
   9203201 allocation units available on disk.

I'm puzzled... What could be the real problem or is CHKDSK falsely reporting as discussed here? : http://www.tomshardware.com/forum/79415-45-hard-disk-problem-chkdsk

CHKDSK checks the database of objects IDs and their integrity set up in the operating system; their average size might be 200MB). And the problem is CHKDSK does not show the scan progress of such big index and appears to hang for a period of time, that is normal. You can get more detailed information about operating principles of CHKDSK and 'freeze' reasons of the scan process in the following article on the Microsoft site: An explanation of the new /C and /I Switches that are available to use with Chkdsk.exe .

Kaspersky Labs antivirus claims to not interfere with chkdsk.

They recommend chkdsk /I /r /f

Thismay explain some of the issues: http://support.kaspersky.com/faq/?qid=208279501

1. click on your start menu and open the run dialog.
2. type "cmd" and return (note: dont enter quotes)
3. Next type "fsutil dirty query C:"
4. If the return message indicates that the volume is dirty go to step 5
5. Next type "chkdsk C: /f /x"
6. After that finshes repeat step 3.
7. If it is no longer dirty then reboot and check again.

Chkdsk.exe is the command-line interface for the CHKDSK program, which verifies the logical integrity of a file system. If CHKDSK encounters logical inconsistencies in file system data, CHKDSK performs actions that repair the file system data (assuming that the data is not in read-only mode).

The /C and /I switches are valid only for a drive that is formatted in the NTFS file system. Each of the new switches directs the CHKDSK routine to bypass certain actions that CHKDSK would otherwise take to validate the integrity of NTFS data structures.

If you run CHKDSK online, the code that actually performs the verification resides in utility DLLs, for example Untfs.dll and Ufat.dll. The verification routines that CHKDSK invokes are the same routines that run when a volume is verified through the Windows Explorer or Disk Management graphical user interface.

However, if CHKDSK is scheduled to run when the computer restarts, the binary module that contains the verification code is Autochk.exe, a native Windows program. Because Autochk.exe runs early in the computer's startup sequence, Autochk.exe does not have the benefit of virtual memory or of other Win32 services.

Autochk.exe generates the same kind of text output that the Chkdsk.exe utility DLLs generate. Autochk.exe displays this text output during the startup process and also logs an event in the application event log. The logged event information includes as much of the text output as can fit into the event log's data buffer.

Because both Autochk.exe and the verification code in the Chkdsk.exe utility DLLs are based on the same source code, the rest of this article uses the term "CHKDSK" to refer generically to either Autochk.exe or Chkdsk.exe. Likewise, because this article concerns only those CHKDSK changes that involve NTFS volumes, any statement that "CHKDSK does such-and-such" means that "CHKDSK does such-and-such when CHKDSK runs on an NTFS volume."

Note that if you use the /C and /I switches, it is possible for a volume to still be corrupted even after CHKDSK runs. Therefore, it is recommended that you use these switches only if downtime must be kept to a minimum. These switches are intended for situations when you must run CHKDSK on exceptionally large volumes and you require flexibility in managing the downtime that occurs.

To understand when it might be appropriate to use the /C and /Iswitches, you need a basic understanding of some of the internal NTFS data structures, the kinds of corruption that can take place, what actions CHKDSK takes when it verifies a volume, and what the potential consequences are if you circumvent CHKDSK's usual verification steps.

Understanding what CHKDSK does

CHKDSK's activity is divided into three major passes, during which CHKDSK examines all the metadata on the volume, and an optional fourth pass.

Metadata is "data about data." Metadata is the file system "overhead," so to speak, that keeps track of information about all of the files that are stored on the volume. Metadata includes information about what allocation units make up the data for a given file, what allocation units are free, what allocation units contain bad sectors, and so on. The data that the file contains, on the other hand, is termed "user data." NTFS protects its metadata through the use of a transaction log. User data is not protected in this way.

Phase 1: Checking files

During its first pass, CHKDSK displays a message that tells you that CHKDSK is verifying files and also displays the percent of verification that is completed, counting from 0 to 100 percent. During this phase, CHKDSK examines each file record segment in the volume's master file table (MFT).

A specific file record segment in the MFT uniquely identifies every file and directory on an NTFS volume. The "percent completed" that CHKDSK displays during this phase is the percentage of the MFT that CHKDSK has verified. During this pass, CHKDSK examines each file record segment for internal consistency and builds two bitmaps, one representing the file record segments that are in use and the other representing the clusters on the volume that are in use.

At the end of this phase, CHKDSK has identified the space that is in use and the space that is available, both within the MFT and on the volume as a whole. NTFS keeps track of this information in bitmaps of its own, which are stored on the disk. CHKDSK compares its results with the bitmaps that NTFS keeps. If there are discrepancies, the discrepancies are noted in the CHKDSK output. For example, if a file record segment that was in use is found to be corrupted, the disk clusters that were associated with that file record segment are marked as "available" in the CHKDSK bitmap but are marked as "in use" in the NTFS bitmap.

Phase 2: Checking indexes

During its second pass, CHKDSK displays a message that tells you that CHKDSK is verifying indexes and again displays the percent completed, counting from 0 to 100 percent. During this phase, CHKDSK examines each of the indexes on the volume.

Indexes are essentially NTFS directories. The "percent completed" that CHKDSK displays during this phase is the percentage of the total number of the volume's directories that have been checked. During this pass, CHKDSK examines each directory that is on the volume, checking for internal consistency and verifying that every file and directory that is represented by a file record segment in the MFT is referenced by at least one directory. CHKDSK confirms that every file or subdirectory that is referenced in a directory actually exists as a valid file record segment in the MFT and also checks for circular directory references. Finally, CHKDSK confirms that the time stamps and file size information for the files are up-to-date in the directory listings for those files.

At the end of this phase, CHKDSK has made sure that there are no "orphaned" files and that all directory listings are for legitimate files. An orphaned file is a file for which there is a legitimate file record segment but for which there is no listing in any directory. An orphaned file often can be restored to its proper directory if that directory still exists. If the proper directory no longer exists, CHKDSK creates a directory in the root directory and places the file there. If CHKDSK finds directory listings for file record segments that are no longer in use, or for file record segments that are in use but that do not correspond to the file that is listed in the directory, CHKDSK simply removes the directory entry for the file record segment.

Phase 3: Checking security descriptors

During its third pass, CHKDSK displays a message that tells you that CHKDSK is verifying security descriptors and, for the third time, displays "percent completed," counting from 0 to 100 percent. During this phase, CHKDSK examines each security descriptor that is associated with files or directories that are on the volume.

Security descriptors contain information about ownership of a file or directory, about NTFS permissions for the file or directory, and about auditing for the file or directory. The "percent completed" that CHKDSK displays during this phase is the percentage of the volume's files and directories that have been checked. CHKDSK verifies that each security descriptor structure is well formed and is internally consistent. CHKDSK does not verify the actual existence of the users or groups that are listed or the appropriateness of the permissions that are granted.

Phase 4: Checking sectors

If the /R switch is in effect, CHKDSK runs a fourth pass to look for bad sectors in the volume's free space. CHKDSK attempts to read every sector on the volume to confirm that the sector is usable. Even without the /R switch, CHKDSK always reads sectors that are associated with metadata. Sectors that are associated with user data are read during earlier phases of CHKDSK if the /R switch is specified.

When CHKDSK finds an unreadable sector, NTFS adds the cluster that contains that sector to its list of bad clusters. If the bad cluster is in use, CHKDSK allocates a new cluster to do the job of the bad cluster. If you are using a fault-tolerant disk, NTFS recovers the bad cluster's data and writes the data to the newly allocated cluster. Otherwise, the new cluster is filled with a pattern of 0xFF bytes.

If NTFS encounters unreadable sectors during the course of normal operation, NTFS remaps the sectors in the same way that it does when CHKDSK runs. Therefore, using the /R switch is usually not essential. However, using the /R switch is a convenient way to scan the entire volume if you suspect that a disk might have bad sectors.

I also found another "Issue"

We recommend that you immediately apply the appropriate service pack or hotfix on any computer that is currently vulnerable to the loss of security descriptors.

We recommend that you inventory servers and workstations in your organization and then install preventive software on any computers that are at risk. We recommend that you apply any preventive fix to new computers before you deploy the new computers for test or production use. We recommend that you inform server administrators, helpdesk administrators, and support professionals that they should install preventive fixes before the following operations are executed:

   * chkdsk /F

   * chkdsk /R

   * autochk

Hotfix Download Available View and request hotfix downloads

When you run the chkdsk command in fix mode, and you use the /F switch or the /R switch with this command, access control lists (ACLs) on some files may revert to their default values. This problem may occur if the volume contains more than 4,194,303 files. For example, this problem occurs in the following Chkdsk output:

Checking file system on J:

The type of the file system is NTFS.

Volume label is MYVOLUME.

Cleaning up minor inconsistencies on the drive.

Cleaning up 1496 unused index entries from index $SII of file 0x9.

Cleaning up 1496 unused index entries from index $SDH of file 0x9.

Cleaning up 1496 unused security descriptors.

CHKDSK discovered free space marked as allocated in the

master file table (MFT) bitmap.

Windows has made corrections to the file system.

1576209407 KB total disk space.

1514676116 KB in 4232266 files.

   1523236 KB in 302192 indexes.

         0 KB in bad sectors.

   4671195 KB in use by the system.

     65536 KB occupied by the log file.

  55338860 KB available on disk.

4096 bytes in each allocation unit.

394052351 total allocation units on disk.

13834715 allocation units available on disk.

Back to the top

CAUSE

This problem occurs because the Chkdsk utility may not find references to all the security IDs

if the master file table is larger than 4 gigabytes (GB) or if there are more than 4,194,303 files on the volume.

Therefore, the undiscovered security descriptors are reset..

I ran 'fsutil dirty query C:' and it says C: is NOT dirty.

In the article above, I read that for XP I should install the latest Service Pack which is SP3. I'm on SP2 now. Should I upgrade?

On another laptop at home, I also encounter such a problem on CHKDSK when running in read-only mode. The laptop is running on XP SP3.

Why doesn't running CHKDSK in Safe Mode with command prompt detect any errors unlike other modes?

The issues you are having are with the OS and Not Dell Hardware.

I have no idea if the "errors" are real or not.

This problem occurs because the Chkdsk utility may not find references to all the security IDs

if the master file table is larger than 4 gigabytes (GB) or if there are more than 4,194,303 files on the volume.

Therefore, the undiscovered security descriptors are reset..

Yes I'm aware it's related to the OS. How do I determine the MFT size or number of files? If it does not exceed those numbers, what else could it be?

This is the Dell Desktop hardware forum.

There will be no further response to this Microsoft Non DELL Hardware issue.

NTFS volumes may have Errors for any or all of the following reasons:

• The cluster size of the NTFS volume is too large for the average-sized files that are being stored.
• File attributes or NTFS permissions prevent files or folders from being either displayed or accessed when you use either Microsoft Windows Explorer or a Windows command prompt.
• The folder path exceed 255 characters.
• Folders or files contain invalid or reserved file names.
• NTFS metafiles (such as the Master File Table [MFT]) have grown and cannot be unallocated.
• Files or folders contain alternate data streams.
• NTFS corruption causes Windows to report free space as being in use.
• Other NTFS features cause file-allocation confusion.

The Cluster Size Is Too Large

Disk space can be consumed only by files and folders that include internal NTFS metafiles, for example the MFT, folder indexes, and so on. Multiples of a cluster consume all file space allocation. A cluster is a collection of contiguous sectors. The cluster size is determined at the time that the volume is formatted and is further determined by the partition size.

To see if the cluster is using the optimal cluster size, determine the amount of wasted space:

1. Double-click My Computer, and then double-click the drive letter (for example, D) of the volume that you want to check.
2. Click any file or folder, and then click Select All on the Edit menu.
3. Right-click any file or folder, and then click Properties.
4. Click the General tab, and then review the "Size" and "Size on disk" file size values, which calculate the total number of files and folders on the entire volume.

If you are not using NTFS compression for any files or folders that are contained on the volume, the difference between the Size value and the Size on disk value is the wasted space that occurs because the cluster size is larger than necessary. Choose an optimal cluster size so that the Size on disk value is as close to the Size value as possible. An excessive discrepancy between the Size on disk value and the Size value is an indication that the default cluster size is too large for the average file size that you are storing on the volume. In this scenario, it is recommended that you decrease the cluster size. To do so, back up the volume, and then use the format command with the /aswitch to specify the appropriate allocation size to reformat the volume. For example, run the following command for a 2-KB cluster size:

Alternatively, you can enable NTFS compression to regain space that is lost because of an incorrect cluster size; however, if you do so, you may experience a slight decrease in performance.

File Attributes or NTFS Permissions

You can use either Windows Explorer or the dir /a /s folder list command to report the file and folder statistics for only those files and folders that you have permissions to access. Hidden files and protected operating system files are always excluded from this report by default. Because some folders are excluded, inaccurate file and folder totals and size statistics may be displayed by Windows Explorer or dircommand outputs. To include these types of files in the overall statistics, change Folder Options:

1. Double-click My Computer, and then double-click the drive letter of the volume that you want to check.
2. Click Folder Options on the Tools menu, and then click the View tab.
3. Click the Show Hidden Files and Folders check box, and then click to clear the Hide protected operating system files check box.
4. After you receive the warning message, click Apply.

After you unhide the files and folders, you can use either Windows Explorer or the dir /a /s command to generate the total of all files and folders that are contained on the volume to which the user has permissions.

To determine the folders and files that cannot be accessed:

1. From a command prompt, send the output of a dir /a /s to a text file.
   
   For example, run the following command:
   dir d: /a /s >c:\d-dir.txt
2. Start Ntbackup.exe, click Options on the Tools menu, click the Backup Log tab, and then click Detailed.
3. Click the Backup tab, back up the entire volume that is affected (in this example, drive D), and then start the backup procedure.
4. After the backup procedure is complete, view the backup report, and then compare the folders in the Ntbackup log output with the folders in the output that you saved in a text file in step 1.

The backup procedure accesses all files; therefore, its report may contain folders and files that are not seen or counted when you use either Windows Explorer or the dir command. If you are looking for large files or folders that you cannot use Windows Explorer to access, you may find it easier to use the Ntbackup graphical user interface (GUI) to navigate the volume. Use the Ntbackup GUI to view the volume without actually backing up the volume.

After you locate files to which you do not have access, open the file or folder's properties in Windows Explorer, click the Security tab, and then add or change permissions so that the folder is in included in the dir /a /s command output. By default, you do not have access to the System Volume Information folder.

NOTE: You may find that some of the folder or file properties do not contain a Security tab, or you may find that you cannot re-assign permissions to the affected folders and files. You may receive the following error message while you try to access these files: D:\folder_name\ is not accessible

Access is denied

 Invalid File Names Folders or files that contain invalid or reserved file names may also be excluded from file and folder statistics. Folders or files that contain leading or trailing spaces are acceptable in NTFS; however, these files are not acceptable in the Win32 subsystem. Therefore, neither Windows Explorer nor a command prompt can reliably handle files that have leading or trailing spaces.

Typically, it is not possible to rename or delete files or folders that have leading or trailing spaces. If you try to rename or delete these folders of files, you may receive one of the following error messages:

Master File Table (MFT) fragmentation
	Total MFT size =        26,203 KB
	MFT record count =      21,444
	Percent MFT in use =    81 %
	Total MFT fragments =   4
					

Thanks this worked!

When Check Disk is run, it gives many error message like MFT bitmap attribute is incorrect, file record segment is unreadable, recovering orphan file, deleting attribute records etc.

MFT (Master file table) bitmap attribute in NTFS’s MFT is where used and unused clusters are specified, the error occurs if bitmap values do not accurately reflect the used clusters.

Orphan files are those files for which FRS (File record segment) exist in MFT but files are not exist in directory. CHKDSK perform orphan file recovery.

 Each file & directory on an NTFS volume/partition is uniquely identified by a File record segment (FRS) in MFT.

CHKDSK can cause data loss. To know about CHKDSK error like CHKDSK deleting invalid filename and how to perform CHKDSK deleted data recovery, visit http://www.windowsfilerecovery.com/chkdsk/deleted-invalid-filename.html