File system structure on the disk is corrupt

Topic

New Reply

I recently checked my Event Viewer and found the following errors. This is repeated 14 times about 2 seconds apart about an hour after bootup. The error sounds serious but there does not seem to be any ill effects on performance. This is on the same drive that I replaced here http://windowssecrets.com/forums/showthread//136604-Drive-C-failing-How-to-copy-OS-to-a-new-drive

Code:

Log Name:      System
Source:        Ntfs
Date:          3/27/2011 09:19:20
Event ID:      55
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      schuckman-desk
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS.
Event Xml:

  
    
    55
    2
    2
    0x80000000000000
    
    119127
    System
    xxxxxxxx-desk
    
  
  
    
    
    OS
    00000C000200380002000000370004C000000000020100C000000000000000000000000000000000EE0C14002209000000000100
  

OS: WIN7 Ultimate 64 bit
Dell Studio XPS with 12 gig RAM and dual 1 TB drives.

I ran chkdsk /f but the errors persist. Results (errors and warnings) of chkdsk are as follows:

Cleaning up 848 unused index entries from index $SII of file 0x9.
Cleaning up 848 unused index entries from index $SDH of file 0x9.
Cleaning up 848 unused security descriptors.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

Should I be concerned or just ignore these errors?

Reply | Quote

Replies

Try chkdsk /r

/r implies /f, and attempts to recover any data.

I would also make a drive image if the drive is rescusitated, and start saving up for a new drive…

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

…I would also make a drive image if the drive is rescusitated,…

Not a problem making a drive image as the computer seems to be running fine, (not running slow or hanging up). If I wouldn’t have reviewed the event log, I wouldn’t have known I had a problem.

On your advice from my last problem, I had already purchased a new drive, made an image and verified it booted OK. That new drive is not installed but is available for installation. I am in the process of running chkdsk /r but it will most likely take in excess of an hour to complete.

Reply | Quote

Sounds like you have the situation well in hand.

I have had chkdsk /r take a number of hours to complete on occaission. Just don’t stop it; let it run to completion.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

It took 3 hours to complete. No errors were found. Sure enough, 1 hour and twenty minutes after bootup, I got the same 14 errors. It does seem odd that the errors are not reported immediately. I wonder what runs 1 to 1 1/2 hours after boot to cause these errors?

Reply | Quote

It took 3 hours to complete. No errors were found. Sure enough, 1 hour and twenty minutes after bootup, I got the same 14 errors. It does seem odd that the errors are not reported immediately. I wonder what runs 1 to 1 1/2 hours after boot to cause these errors?

Windows 7 by default has a number of tasks scheduled through the Task Scheduler; defrag is one of those. You might run though that list to see if anything is coming up within that time frame.

I have deleted the defrag from Task Scheduler on my machine, since I prefer MyDefrag.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

It just occurred to me that you might give MyDefrag a run at your drive. One of the things MyDefrag does is relocate ordinary files out of the MFT. The NTFS file system can and will put ordinary data files in the MFT along with the metadata files that are normally filed there.

MyDefrag removes these ordinary files and places them elsewhere on the disk, defrags the MFT and leaves only MFT-relevent files within the MFT.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

It wasn’t the defrag program. It runs 1 time per week and last executed 2 days ago.

I plan to let the computer run for a couple of days (without rebooting) to see if the errors repeat. I’ll check out MyDefrag.

If all else fails, I can revert to the last image to the new drive. The only changes since the image have been the Microsoft patches.

Reply | Quote

I pulled out the current OS drive and installed the new drive that I had imaged last week and so far the system has been up for 7 hours with no ntfs errors. It was either the drive was physically bad or something was corrupted. I still get the CAPI2 errors, but those have been there for a few months.

SFC /VERIFYONLY reports inconsistencies but I don’t plan to execute the /SCANNOW option until I get another image completed. (The old drive also reported errors).

Reply | Quote

The ntfs errors are back. Fourteen in a row, just as before. This is with a different disk drive so it can’t be the drive.

Are there any “hidden” options that will tell me what program was executing when these errors are generated?

Reply | Quote

Hi Steve,

You might consider running the SFC /SCANNOW option now to hopefully find and replace whatever system files that may be corrupt. I take it the image on your new disk was taken from the older disk Windows 7 installation, thus transferring the problem from the old disk to the new. If SFC does not correct the problem it may require a repair installation to fix the OS.

In thinking of Windows 7 operations that run occasionally besides the defrag routine, I wonder about the Search Indexing Service. If Windows detects something wrong in the indexing, it may be starting up in an attempt to perform a fix. If you want to look at that possibility, go to Control Panel>Indexing Options, click the Advanced button and then the Rebuild button, which will delete and rebuild the index. There is also an option below Rebuild to relocate the index. Just a thought.

Other possibilities could be corruption in the paging file or in the creation of restore points.

Reply | Quote

You might want to download and install HD tune, I used it to look at the health status of my drives. http://www.hdtune.com/

Reply | Quote

I would boot to the installation DVD, choose repair and open the command prompt. I would first run chkdsk /r to completion, and then I would run sfc /scannow to completion, both from the DVD repair option rather than from your hard drive.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

I would boot to the installation DVD, choose repair and open the command prompt. I would first run chkdsk /r to completion, and then I would run sfc /scannow to completion, both from the DVD repair option rather than from your hard drive.

I’m curious as to why you are suggesting running from the installation DVD rather from the hard drive. I may give that a try.

I have already performed a SFC /SCANNOW (executed from the hard drive). Here are the results:

Code:

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of them.
Details are included in the CBS.Log windirLogsCBSCBS.log. For example
C:WindowsLogsCBSCBS.log

I looked at the CBS.log file, but I’m not sure how to interpret the data.

Also previously I performed a chkdsk /r and found no errors.

I have also deleted and rebuilt the indexing file.

I just finished implementing Microsoft KB2498472 but that did not fix the problem on the original drive. I’ll need to wait for up to 12 hours before I can verify if this fixed the problem.

[/FONT]

Reply | Quote

I’m curious as to why you are suggesting running from the installation DVD rather from the hard drive. I may give that a try.

When you boot from the DVD and select the Command Prompt, you are loading a complement of tools from the DVD into a RAM drive, bypassing any posssibly corrupted tools from the hard drive.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

Just a thought-
On occasion, I’ve found that running CHKDSK /r in safe mode is more complete, especially for errors on the System partition.

Zig

Reply | Quote

Just a thought-
On occasion, I’ve found that running CHKDSK /r in safe mode is more complete, especially for errors on the System partition.

Zig

Running chkdsk /r on the system partition requires a reboot. Chkdsk runs at a lower level than Safe mode; there is no logon until after chkdsk completes. Where chkdsk /r for the system partition is started from doesn’t matter, since there’s going to be a reboot in order for it to run on the system partition.

Running chkdsk /r on the system partition by booting from the DVD is as low a level as can be achieved with chkdsk.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

I have some additional information on this problem. I noticed that the series of 14 errors occur at exactly midnight each day and the only thing that runs at exactly midnight is the SR (System Restore) task. As a test, I turned off System Protection for all drives and now the Ntfs error is no longer observed so it seems that it is related to System Protection. When I turned off System Protection all previous System Restore files were deleted and at that exact time I observed 9 consecutive Ntfs errors.

In my opinion, turning off System Protection is not a good long term solution, but this may give me a place to look. After a couple more days of observing no errors, I plan to turn System Protection back on to see if the errors return.

Reply | Quote

It seems deleting the old System Restore points solved the problem. Two days ago I turned system protection back on and have verified no Ntfs errors. I have verified I can manually create a system restore point and also that a system restore point is created by the system when an update is applied.

Possibly one or more of the system restore points was corrupt and deleting all of the system restore points fixed the problem.

Reply | Quote

Hi Steve,

Glad you successfully found the right solution for the problem. Thanks for posting back with the fix.

Reply | Quote

Both Process Monitor and Process Explorer allow you to capture a vast amount of data about what is happening on your system.

Joe

--Joe

Reply | Quote