MFT Curruption

[cknipe]

Hmmm...

For the first time in a very long time, I'm stumped.

I have a 320GB SATA. I checked' with Seagate's Diagnostics software, I checked with SpinRite - both gives the drive a green light, no problems.

In my XP Pro however, I copy like 30 files to the drive, run a chkdsk, and the MFT is currupt!

Format the drive, copy files, chkdsk - corrupt

copy files, chkdsk - corrupt (Can you see the pattern here?)

No errors logged in the event logs, I've even disabled the cache on the drive... It makes no sense to me what so ever...

Does anyone have some idea? Unless there is something wrong with the drive (which Seagate's Diagnostics / SpinRite will show), I doubt I'll have much success taking the drive back to where I baught it, claiming that it is faulty...

Could a partition misalignment actually currupt data? All my readings about this merely mentioned a performance hit, nothing about currupt data. I'm planning to use diskpart in a couple of hours to try and get the partition alignment sorted out, but something tells me it's not really going to help much...

Thanks,
Chris.

 

[evongugg]

It could be your SATA controller that is causing this.
Try changing SATA port to see if it improves the situation.
Do you have a 680i motherboard?
There was a problem with the SATA, which has been corrected with a Bios update.
Please list the specs of your computer.

http://www.nvidia.com/object/680i_hotfix.html

 

[cknipe]

Hmmm...

I highly doubt that. The 320GB is supposed to be part of a RAID5 Array...

I had the entire array on two different RAID Controllers, as well as my Asus M2N32 WS Professional... All 3 times, exactly the same thing...

 

[atp777]

Well, since it's a Seagate it's still under warranty so might as well spend the few bucks on shipping and get a new one (RMA) just in case.

I can't think of anything else it would be and I've been through plenty of HDD issues.

 

[pscowboy]

Try a debug routine on it before you send it (bring it) back.

Change to IDE mode temporarily in the BIOS - re-enable the cache.

Produce a bootable cd with debug:
Create a "New" folder on your "C" drive, and name it drdos.

Go to this site:

http://www.devedia.com/dosghost/dos/downl_2.asp#drdos

Scroll down until you find v703drdos Beta - click on that. You will find yourself at an ftp download site of all the drdos utilities.

You can download them all to the new drdos folder, but you only need debug.exe; fdisk.com; & format.com.

Download by right-clicking each one - choose "Save Target As" - and direct the download to the drdos folder.

You need Nero 6.
Next, go to Program Files\Ahead\Nero and locate Dosbootimage.ima and copy and paste it to the drdos folder.

Fire up Nero - choose Nero Burning Rom. Should get New Compilation. On the left side, scroll down to CD-ROM (Boot) and highlight it.

Over on the right side, click the radio button for Image File & browse to the drdos folder to locate it so that it shows in the address space.

On the bottom half, under Enable Expert Settings, make sure the four categories are: Floppy Emulation 1.44; Nero Boot Loader v6.0; 07c0; 1.

Go up to the Burn tab and make sure that Write and Finalize cd are checked. Change the Write Speed to half of what your burner is capable of, then click New at the upper right corner.

On the right side, third pane over, locate the drdos folder and click it so that all of its' files show up in the fourth pane. Drag and drop them all to the second pane. Locate the grayish cd disc with the flame on it near the top under the word Window. Click this to return to the Burn page; insert a blank cd-r disc into your burner; change Copies to two; then click burn. Quickly check off Verify Written Data at the bottom left.

OK the Data Verify success (second copy should start) - click Done (bottom left) - Exit out whereupon Nero will ask you to save this. I would, and call it drdos; for you to have in the future. Then back to your desktop.

You now have a bootable cd with which you can invoke debug. You will find it on the "D" drive after the cd boots up. Follow the routine below.
Print out this one and the debug routine to work efficiently.

If the hard drive IS okay, XP will install fresh & clean.

In case you have a floppy drive, you can also do this:

You will need a W98 (or ME) boot floppy diskette. Delete drivespace on this disc & add debug.exe. If you are near a 98 machine, copy debug onto the floppy from C:\Windows\Command. If not, you can download it from the net. Be sure to get the right version - Dos7 (or Dos8 for ME).

Pop in the cd (or floppy) at start up. At the "D" (or "A") prompt, type debug. You will get a minus sign prompt ( - ) . Type in the following lines; hitting Enter after each one. There are no letter O's except in the word mov.

f 200 L200 0
a 100
mov ax,301
mov bx,200
mov cx,1
mov dx,0080
int 13
int 3
(hit enter again)
g=100
q

Remove the cd (floppy); pop in the XP cd; Ctrl-Alt-Delete; and install.

 

[bberson]

SATA, or E-SATA? Instead of just reformatting, try removing and re-doing the partition?

 

[cknipe]

SATA / E-SATA ??

Uhm, the drives still had their jumpers (1.5GB/s), I did remove them now to operate at 3GB/s...

The partitions has also been done various times unfortunately. Again, no change. I also cannot seem to specify the alignment with diskpart on Windows XP The partition is created at 32k (the default), but the RAID Controller states the first sector is 64k - so it is creating the partition inside the MBR. No way yet that I found to change it. I'll have to see perhaps about a 3rd party util (Partition Magic?) to create the partition with.

I'm currently doing a low level format (which has never been done yet), to see if that sorts it out. Low level formating 1.2TB in RAID5... Eish, it's going to take a while...

--
Chris

 

[zjohnr]

f 200 L200 0
a 100
mov ax,301
mov bx,200
mov cx,1
mov dx,0080
int 13
int 3
(hit enter again)
g=100
q

Uh-huh. :? :roll: Could you translate for benefit of those of us who are not fluent in x86 assembler? All I could figure out was that the program looked like it would attempt to write 0's to a single disk sector and then stop at a breakpoint. Am I close?

Where on the disk it would be written I couldn't figure out. Also have no idea at all about which drive would be written to. (If he has a multi-drive setup, how could you be sure you wouldn't blow away his OS drive?)

-john, the ostensibly clueless redundant legacy dinosaur

 

[zjohnr]

SATA / E-SATA ??

I think this was just asking if the drive is internal (SATA) or External SATA (eSATA). I assume from your response that it is just a regular internal SATA connected drive.

-john

 

[zjohnr]

I'm currently doing a low level format (which has never been done yet), to see if that sorts it out. Low level formating 1.2TB in RAID5... Eish, it's going to take a while...

The term "low level format" is a bit ambiguous so I'm never positive about what it refers to. But in this case I'm assuming you're just doing a standard windows non-quick format. If that's the case then FWIW my gut feeling is that it's a big waste of time. It sounds like there is nothing physically wrong with your disk drives, it's just something goes wrong at the file system level after you do the file copy. (Did you do a CHKDSK after the format but before the file copy?)

Have you tried rebuilding the RAID array. Actually, even before you try that ... have you tested the individual drives with the BIOS set to access them in vanilla IDE (non-RAID) mode? If you have the patience for it and your manufacturer's diagnostic disk provides a utility to do it, you could also write 0's to the first and last 1,000,000 (or whatever) sectors on the drives. That would ensure that when the RAID is rebuilt it would be completely rebuilt from scratch ... no structural data would be left over from the previous RAID.

-john, the ostensibly clueless redundant legacy dinosaur

 

[cknipe]

Ok...

I'm REALLY not being funny now... :?

john, as per your post... Yes, it was a non-quick format (unconditional format I believe if we have to use the terms?)... And yes, waiste of time, I too agree with you, nothing wrong with the drives... This is a OS thing (re-installing the OS is just about the only thing left?)

I disabled the RAID completely, I have 4 320GB Seagate drives in my system now:

DISKPART> list disk

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 37 GB 0 B
Disk 1 Online 149 GB 321 KB *
Disk 2 Online 298 GB 0 B
Disk 3 Online 298 GB 0 B
Disk 4 Online 298 GB 0 B
Disk 5 Online 298 GB 0 B

DISKPART>

Assigned Disk 2, 3, 4, & 5 as H:, I:. J:. & K: I copied not even 50MB of data... And this is what I found... Coping the SAME data from Disk 1 to Disk 2, 3, 4 & 5 - there are MASSIVE differences in transfer speed. Total Commander indicated some disks transferring as quickly as 60MB/s, whilst others was as low as 5MB/s 8O

All 4 disks, returned MFT errors after the copy:

Disk 1:
C:\Documents and Settings\cknipe>chkdsk h: /v
The type of the file system is NTFS.
Volume label is New Volume.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.
Cleaning up 1 unused security descriptors.
Security descriptor verification completed.

312568640 KB total disk space.
0 KB in 3 files.
8 KB in 11 indexes.
0 KB in bad sectors.
75604 KB in use by the system.
65536 KB occupied by the log file.
312493028 KB available on disk.

4096 bytes in each allocation unit.
78142160 total allocation units on disk.
78123257 allocation units available on disk.

C:\Documents and Settings\cknipe>

Disk 2:
C:\Documents and Settings\cknipe>chkdsk i: /v
The type of the file system is NTFS.
Volume label is New Volume.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
Detected minor inconsistencies on the drive. This is not a corruption.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.
Cleaning up 1 unused security descriptors.
Security descriptor verification completed.

312568640 KB total disk space.
0 KB in 3 files.
8 KB in 11 indexes.
0 KB in bad sectors.
75540 KB in use by the system.
65536 KB occupied by the log file.
312493092 KB available on disk.

4096 bytes in each allocation unit.
78142160 total allocation units on disk.
78123273 allocation units available on disk.

C:\Documents and Settings\cknipe>

Disk 3:
C:\Documents and Settings\cknipe>chkdsk j: /v
The type of the file system is NTFS.
Volume label is New Volume.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.
Cleaning up 1 unused security descriptors.
Security descriptor verification completed.

312568640 KB total disk space.
0 KB in 3 files.
8 KB in 11 indexes.
0 KB in bad sectors.
75604 KB in use by the system.
65536 KB occupied by the log file.
312493028 KB available on disk.

4096 bytes in each allocation unit.
78142160 total allocation units on disk.
78123257 allocation units available on disk.

C:\Documents and Settings\cknipe>

Disk 4:
C:\Documents and Settings\cknipe>chkdsk k: /v
The type of the file system is NTFS.
Volume label is New Volume.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.
Cleaning up 1 unused security descriptors.
Security descriptor verification completed.

312568640 KB total disk space.
0 KB in 3 files.
8 KB in 11 indexes.
0 KB in bad sectors.
75588 KB in use by the system.
65536 KB occupied by the log file.
312493044 KB available on disk.

4096 bytes in each allocation unit.
78142160 total allocation units on disk.
78123261 allocation units available on disk.

I am *really* at a loss here... All 4 drives can't be faulty... 3 different RAID Controllers plus my onboard SATA Ports, can't be faulty... WHY is this happening?!?!?!?!? grrrrrrrrrrrrrrrr

 

[bberson]

Time to start looking at the rest of the system. Boot up a MEMTEST CD for a while. Reset the motherboard's interrupt mapping. Try removing peripherals and disabling peripherals that can't be removed.

This sounds like a classic problem with poor interrupt arbitration or actual conflict.

-Brad

 

[pscowboy]

That Debug routine writes zeroes to the first sector, cylinder 0; blanking the boot sector & mbr.

An extremely quick way to effectively start over on a hard drive which has corruption there. The several programs that zero-fill take way too long because they do the whole drive.

It's the ONLY thing that will kill a boot sector virus (other than a "factory" low-level) - high formatting won't get it, nor will deleting the partition with fdisk.

The OP discussed a problem on a single hd. Standard IDE mode (or non-raid) takes the array out of the issue. One should be working on problematic drives on their own - any other hd's disabled or underneath in the boot priority.

 

[cknipe]

And after being a silly tosser and realising I am coping a file with a bad security description, I ran chkdsk on my source data, and fixed the error

Disk 1 and 2 are working properly now. Transfer speeds between 50Mb/s and 60MB/s, no errors reported by chkdsk -yay-

Disk 3 however, is EXTREMELY slow (sub 5MB/s) and slowing down how longer the transfer is continuing....

Disk 4 still gives MFT errors running chkdsk:

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

312568640 KB total disk space.
1525396 KB in 119 files.
40 KB in 13 indexes.
0 KB in bad sectors.
75652 KB in use by the system.
65536 KB occupied by the log file.
310967552 KB available on disk.

4096 bytes in each allocation unit.
78142160 total allocation units on disk.
77741888 allocation units available on disk.

 

[zjohnr]

Disk 1 and 2 are working properly now. Transfer speeds between 50Mb/s and 60MB/s, no errors reported by chkdsk -yay-

-yay- indeed!

Disk 3 however, is EXTREMELY slow (sub 5MB/s) and slowing down how longer the transfer is continuing....
Disk 4 still gives MFT errors running chkdsk:

OK, I'm a bit confused on what has been tried and to what extent. So I'd suggest booting and running the manufacturer diagnostics once more on the drives that still fail. And definitely try wiping out the boot sector by whatever means is handy. (Note: the drive diagnostic utility ... if provided ... to zero out the first/last million or so sectors on a drive only takes a minute or so to run).

BUT before retrying the above ...
Have you looked in the Windows XP system event log? There might be some error events from timeouts or other disk write problems which might explain the slow drive performance or MFT corruption. (To bring up the event manager window just run the command "eventvwr.msc").

Have you double checked that your SATA cables are securely connected? I'd also consider swapping the current SATA cable for a known good cable from one of the drives that is working correctly. Possibly also swap the motherboard SATA port the drive is connected to?

Realize this is not a lot of help, but it's all I've got at the moment. Good luck!

-john, the ostensibly clueless redundant legacy dinosaur (with emphasis on clueless, I guess )

 

[zjohnr]

you can rebuild the boot sector and mft but that could void any warranty left on the drive and ruin the drive.

:? Uh, no offense, but this is just not true. From drive manufacturer's point of view, the boot sector of a drive is just a sector like any other sector on the drive. They expect data to be written to it as part of just using the drive.

The MFT is at an even higher level of abstraction from the drive itself since it is part of the file system (Microsoft's NTFS) used on the drive. The drive doesn't even have an MFT until after you format it.

-john