[SOLVED] Boot Problems/Disk Problems/Reimage? Help

[joethejet]

Ok, currently I have a raid (1) disk array and it's having some problems, at least I believe it's a disk problem as when I do a scandisk, it can't repair a system file. I would think that raid (two duplicate hard drives) would repair this, but apparently not. The disks are Western Digital

Currently, I don't dare shutdown my computer and I never know if it will successfully boot up again. The last time I spent two days trying to fix the problem and then, suddenly, it booted after no apparent change was made.

Because I'm having problems, I made an image of my computer and put it on my NAS.

In any case, I'm thinking my best plan is to either break the raid and reinstall my image there, or get a new hard drive and install it there.

I plan to upgrade the computer to Windows 10 in January.

My plan is sort of like this:

1. Get the W7 box stable so it will boot. I assume I'm having a hard drive problem, not memory or MoBo because it will boot sometimes and sometimes not. Also when I do a scandisk, it tells me there is a dll that cannot be repaired.
2. To do this, either break the raid and figure out which disk is bad, or get a new disk and install the image that I made onto it.
3. Upgrade to W10
4. Take an image of W10 and, when I get a new computer, install it there so I don't have to reinstall all my programs and data.

Does this plan make any sense at all?

Oh, btw, when it doesn't boot, I'm getting These error codes

problem signature 01: 6.1.7600.16385
problem signature 02: 6.1.7600.16385
problem signature 03: unknown
problem signature 04: 176
problem signature 05: AutoFailover
problem signature 06: AutoFailover

problem signature 07: NoRootCause
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1033

Any thoughts on which direction I should take above and whether this approach is advisable at all. I suppose my problems could be memory or motherboard related also?

 

[joethejet]

Ah, I see. I didn't think about incremental images. I knew I could do incremental backups, but not images. Yes, that, perhaps would solve my problem, unless it's a hardware problem.

If I break the raid, will I have to reboot?

 

[joethejet]

Tried to run smartctl, but it fails after 10% "Uncorrectable error in Data" "at LBA = 9x3fc93392 = 1070150546"

Complete error log:

SMART Extended Comprehensive Error Log Version: 1 (6 sectors)
Device Error Count: 1
CR = Command Register
FEATR = Features Register
COUNT = Count (was: Sector Count) Register
LBA_48 = Upper bytes of LBA High/Mid/Low Registers ] ATA-8
LH = LBA High (was: Cylinder High) Register ] LBA
LM = LBA Mid (was: Cylinder Low) Register ] Register
LL = LBA Low (was: Sector Number) Register ]
DV = Device (was: Device/Head) Register
DC = Device Control Register
ER = Error register
ST = Status register
Powered_Up_Time is measured from power on, and printed as
DDd+hh🇲🇲SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 1 [0] occurred at disk power-on lifetime: 10825 hours (451 days + 1 hours)
When the command that caused the error occurred, the device was active or idle.

The "short test" says "Interruped (host reset)

 

[joethejet]

I uploaded the log file here: disk file I don't really make heads or tails out of it. 🙁

 

[USAFRet]

Ah, I see. I didn't think about incremental images. I knew I could do incremental backups, but not images. Yes, that, perhaps would solve my problem, unless it's a hardware problem.

If I break the raid, will I have to reboot?

This is the Full and Incremental backup images of my C drive.
We could recover that drive in the state it was on any day between 30 Nov and this morning.

 

[fzabkar]

The log shows 1 read error.

The Power On Hours count attribute has fallen below its threshold value, so that may or may not trigger a SMART warning.

Otherwise the SMART attributes are clean.

You now need to do the same for the second drive.

 

[joethejet]

Ok, so no real problems with the drive? So, one of the weird things when trying to execute these tests. The "extended" test says it's going to take 3+ hours, but it takes only seconds. Doesn't seem like it's actually doing any sector by sector checking to me. The SFC, for exampe, takes much longer (< 1 hour I think) and the log says it only completes 10% of the test and "aborted by host". Here is the second file Second file.

Since I send the link above, now I'm getting a "Cannot run Extended Self-test. Sending command failed" on the second drive. The log file above is from earlier runs. Not sure why it won't test now. Any ideas why that would happen?

There is also this data on the "Attributes" screen which doesn't look good to me. Attributes csv file

 

[fzabkar]

All the SMART attributes look good to me.

 

[joethejet]

All the SMART attributes look good to me.

Thanks so much for your help. So, you don't think there is some sort of problem? Why won't the extended test complete? It always says "manually aborted" even if I don't do anything. Seems to me that something is going on here?

 

[fzabkar]

I suspect that the extended test is being interrupted by other system activity. Maybe the OS is doing something in the background?

 

[joethejet]

Gosh, who knows. I guess I could close all my other programs, but I'm not sure that would stop the OS from whatever it's doing.

So, I'm at a little of a loss at what's going on. I thought, perhaps, I have a disk problem, but maybe not? Not sure what else to check at this point....

 

[joethejet]

Ok, so I found a check disk program freeware with the "check if dirty" option and here are the results it gave me:

-----------
checkDisk will work now with drive: C:
C:\ Volume Label: TheBrain, File System: NTFS
Volume label is TheBrain.
CHKDSK is verifying files (stage 1 of 3)...
585472 file records processed.
File verification completed.
7357 large file records processed.
0 bad file records processed.
2 EA records processed.
142 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
744112 index entries processed.
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
585472 file SDs/SIDs processed.
Index $SII of file 9 contains 58 unused index entries.
Index $SDH of file 9 contains 58 unused index entries.
There are 58 unused security descriptors.
Security descriptor verification completed.
79321 data files processed.
CHKDSK is verifying Usn Journal...
Examining Usn Journal $J data stream
Usn Journal verification completed.
The master file table's (MFT) BITMAP attribute is incorrect.
The Volume Bitmap is incorrect.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.
963379199 KB total disk space.
820971152 KB in 487435 files.
301892 KB in 79322 indexes.
Check Disk Callback: 26
686651 KB in use by the system.
65536 KB occupied by the log file.
141419504 KB available on disk.
4096 bytes in each allocation unit.
240844799 total allocation units on disk.
35354876 allocation units available on disk.
Check Disk: Finished OK
!!! Check Disk Found Problems with: C: or try again
The following drive must be repair: " C:\"
Restart the PC for repair.

Problem found with drive: C


I can't run with "correct errors" as it tells me "Error: Drive in use".

If I run with "thorough". Here is the output:

------------
checkDisk will work now with drive: C:
C:\ Volume Label: TheBrain, File System: NTFS
Volume label is TheBrain.
CHKDSK is verifying files (stage 1 of 5)...
585472 file records processed.
File verification completed.
7357 large file records processed.
0 bad file records processed.
2 EA records processed.
142 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
Index entry 56B25D294917B273502B85FEA767D69F6F312A1D in index $I30 of file 26431 is incorrect.
Index entry 56B25D~1 in index $I30 of file 26431 is incorrect.
Index entry 63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1 in index $I30 of file 26431 is incorrect.
Index entry 63F48F~1 in index $I30 of file 26431 is incorrect.
Index entry F04259EAFA09070704497E78FCA7C3EE796C2C67 in index $I30 of file 26431 is incorrect.
Index entry F04259~1 in index $I30 of file 26431 is incorrect.
Index entry 1451318868ntouromlalnodry--epcr.sqlite-shm in index $I30 of file 57461 is incorrect.
Index entry 1451318868ntouromlalnodry--epcr.sqlite-wal in index $I30 of file 57461 is incorrect.
Index entry 145131~2.SQL in index $I30 of file 57461 is incorrect.
Index entry 145131~3.SQL in index $I30 of file 57461 is incorrect.
Index entry 3870112724rsegmnoittet-es.sqlite-shm in index $I30 of file 57461 is incorrect.
Index entry 3870112724rsegmnoittet-es.sqlite-wal in index $I30 of file 57461 is incorrect.
Index entry 387011~2.SQL in index $I30 of file 57461 is incorrect.
Index entry 387011~3.SQL in index $I30 of file 57461 is incorrect.
Error detected in index $I30 for file 203997.
Error detected in index $I30 for file 203997.
Error detected in index $I30 for file 203997.
Index entry broadcast-listeners.json in index $I30 of file 414187 is incorrect.
Index entry BROADC~1.JSO in index $I30 of file 414187 is incorrect.
Index entry prefs.js in index $I30 of file 414187 is incorrect.
744110 index entries processed.
Index verification completed.
Errors found. CHKDSK cannot continue in read-only mode.
Check Disk Callback: 32
Check Disk: Unable to Finish
!!! Check Disk Found Problems with: C: or try again

Problem found with drive: C

 

[joethejet]

I guess the above didn't help any. 🙁

 

[fzabkar]

I would backup your data to another drive, but be prepared for file corruption.

The $BITMAP is an NTFS metafile which keeps a record of free and in-use clusters. AIUI, if this gets messed up, then there is the potential for cross-linking. That's where two or more files think that they own the same cluster.

The Index errors relate to the $MFT (master file table). This metafile consists of records which store the name and properties of each file.

For example, there is a problem with file #26431. In DMDE you can see the properties of this file by examining its $MFT record. To do this, launch DMDE and select your target disk. Then double-click your NTFS volume, select Editor -> File Record, and key in your file number.

 

[joethejet]

Great, thank you so much for the information. I so appreciate the help you guys have given me.

I have made an image of the disk, and will take another one before attempting anything else. Are you saying that I should try installing on a new disk and maybe this will solve my boot problems? Really that's where I'm trying to get to, a stable system where I'm not afraid to restart my system.

 

[fzabkar]

If you clone your drive, you will be replicating any file system errors. Instead I would copy the files to another drive and then work out which, if any, are corrupt.

I would use DMDE to find the file names which correspond to the flagged file numbers. Then you will know which files are affected, and whether they are important.

BTW, I don't know if your errors are to be expected if the drive is concurrently being accessed by another application.

 

[USAFRet]

Yep.
Cloning problematic or corrupted data just moves that problem to a different drive.
It does not fix anything.

An Image is no different.

 

[joethejet]

Ok, so file 57461 has $file_name of "idb". I don't see where it tells me the directory it's in however.
26431 is "entries"
203997 is "157777~1.JSO if also has a very long, long name that ends in "main.json"
414187 is 9cmemq~1.def

Ok, I get what you're saying about the image. Sounds like I'd have to fix the image if there's a corruption problem and then I wouldn't need to reimage! If, however, it's a hardware problem then it might fix the problem with a new disk?

 

[fzabkar]

I suspect that "idb" and "entries" are directories. The others are 8.3 file names.

"JSON" is a JavaScript file. I don't know about "*.def", though.

 

[joethejet]

Yeah, that would make sense that the two are directories. Wish I could tell where they are.

Yes, I am familiar with json, it's like xml.

The "def" file long name is 9cmemq xi.default-1492141904983

None of these files seem critical to booting the system to me....

Question, is there any value in doing a "full scan" with DMDE?

 

[fzabkar]

If you expand the $FILE_NAME record, there will be a "directory" parameter under "Data offset". This number is the "file number" of the current directory. If you now input this number into Editor -> File Record, you will see the attributes for this directory. Repeat this procedure to traverse up the directory tree until you reach the root.

For each directory, if you expand $INDEX_ROOT, you will see the numbers and names of each file at that directory level.

As for a full scan, I don't see any need for this. It's usually only necessary when the file system is badly broken, or you need to recover deleted files.

 

[joethejet]

Cool.

These files were all under the firefox profile. There's a decent chance that FF was open when I ran the scan so, that's not telling me anything at all then.

I guess I'm wondering if the DMDE full scan is better than the ones I've run in the past. At this point it doesn't seem like I have any corrupted files. Seems like maybe I have hardware (admittedly very old) that needs to be replaced.

Would suspect hardware give me inconsistent results when I restart? Maybe stopping and starting the disks is causing the problem?

Is there a better way to check for corrupted files?

 

[fzabkar]

ISTM that all your errors were probably false positives.

BTW, when the volume is "dirty", it just means that there are outstanding file transactions that have not yet been completed. This is often the result of a power cut during file I/O. When the OS next boots up, it sees the "dirty bit" and initiates a CHKDSK, if configured to do so. In your case it may be that Firefox was doing file I/O while CHKDSK was running.

If you want to see the NTFS dirty bit …

Locating the NTFS "dirty bit":
http://www.hddoracle.com/viewtopic.php?f=117&t=2126

As for checking for corrupted files, CHKDSK will tell you if there is a problem with the file system, but it has no way of testing the file contents. For that you would need specific tools.

For example, 7-Zip can test the integrity of compressed archives. A tool such as JpegDigger can test JPEGs. In fact this question often comes up at HDD Guru, and everyone has their own way of dealing with it.

 

[joethejet]

Thanks again for all of the help you guys are giving me!👍😀

So, I guess I'm still left wondering whether I have a hardware or corruption problem. I may have a disk lying around that I can put into my computer and then restore the image to. Maybe that will tell me. Doesn't sound like there is a good way of knowing without actually just trying it out.

Outside of buying a new computer (which seems likely at this point) do you guys have anything else to suggest?

 

[fzabkar]

ISTM that you are no closer to a solution for your intermittent boot problem. I really don't know what else to suggest except to replace your storage and see how it goes. At least you have a backup.

Best of luck for 2020.

 

[joethejet]

ISTM that you are no closer to a solution for your intermittent boot problem. I really don't know what else to suggest except to replace your storage and see how it goes. At least you have a backup.

Best of luck for 2020.

Thanks again. So, would it make any sense to break the Raid and try each disk in turn? If one disk is broken (no corrupt files assumed) but the other isn't, wouldn't this work?

Happy New Year to you guys!