Maintaining Hard Disk Drives

---

Many command-line utilities are available to help you maintain hard disk drives. Some of these utilities include FSUtil, ChkDsk, and Defrag.

Obtaining Disk Information and Managing File Systems with FSUtil

One tool we haven’t examined until now is the File System Utility (FSUtil).

FSUtil: An Overview

FSUtil has a fairly complex command structure, but it all basically boils down to the fact that you need to type a command string containing a command and a subcommand to get FSUtil to do what you want it to do. The available FSUtil commands are summarized in Table 8-3.

Table 8-3: FSUtil Commands and Their Usage

BEHAVIOR	Use the related subcommands to view and control how short (MS-DOS) file names are generated, whether the last access timestamp on NTFS volumes is updated, how frequently quota events are written to the system log, the internal cache levels of NTFS paged pool and NTFS non-paged pool memory, and the amount of disk space reserved for the Master File Table (MFT).
DIRTY	Use the related subcommands to query or set a volume’s dirty bit. If a volume is dirty, that means it is suspected to have errors and the next time the computer is restarted, a program called AUTOCHK will check the disk and run Check Disk if necessary to repair any errors.
FILE	Use the related subcommands to find a file by user name (only if disk quotas are enabled), check a file for sparse regions, sets a file’s valid data length, and zero out portions of sparse files.
FSINFO	Use the related subcommands to list a computer’s drives, to query drive type, and to obtain volume information.
HARDLINK	Use the related subcommands to create hard links so a single file can appear in multiple directories (or even in the same directory with multiple names). Programs can open any of the links to modify the file and the file is deleted from the file system only after all links to it have been deleted.
OBJECTID	Use the related subcommands to manage object identifiers for files and directories.
QUOTA	Use the related subcommands to manage disk quotas on NTFS volumes.
REPARSEPOINT	Use the related subcommands to view or delete reparse points. Primarily, reparse points are used for directory junction points and volume mount points.
SPARSE	Use the related subcommands to manage sparse files. A sparse file is a file with one or more regions of unallocated data in it.
USN	Use the related subcommands to manage the update sequence number (USN) change journal. The USN change journal provides a persistent log of all changes made to files on the volume.
VOLUME	Use the related subcommands to dismount a volume or query to see how much free space is available.

Using FSUtil

Although FSUtil has many very advanced applications, such as allowing you to remove reparse points on disks, manage disk quotas, and designate sparse files, it also has some basic applications that you’ll find useful if you want to obtain disk information.

Obtaining Drive Lists for a Computer To obtain a list of drives on a computer by drive letter, type

fsutil fsinfo drives

The output shows you the drives available in alphabetical order, as follows:

Drives: A:\ C:\ D:\ F:\ G:\ T:\ U:\

Obtaining Drive Type Once you know about the drives, you can obtain the drive type for a particular drive by typing fsutil fsinfo drivetype followed by the drive designator, such as

C:\>fsutil fsinfo drivetype g:
g: - CD-ROM Drive

Here, the G: drive is a CD-ROM drive. Of course, you could obtain similar information for all disks on the computer using DiskPart’s list volume command. Still, this is another way to obtain information that you might find useful.

Obtaining Detailed Drive Information To obtain detailed information about a drive, type fsutil fsinfo volumeinfo followed by the drive designator. You have to specify the drive in different ways based on whether you are using Windows Server 2003 or Windows XP. In Windows Server 2003, provide the drive letter followed by a colon, such as

C:\>fsutil fsinfo volumeinfo c:

For Windows XP, provide the drive letter followed by a colon and a backslash, such as

C:\>fsutil fsinfo volumeinfo c:\ 

FSUtil then lists the volume name, serial number, file system type, and the features supported, such as

Volume Name : Primary
Volume Serial Number : 0x23b36g45
Max Component Length : 255
File System Name : NTFS
Supports Case-sensitive filenames
Preserves Case of filenames
Supports Unicode in filenames
Preserves & Enforces ACL's
Supports file-based Compression
Supports Disk Quotas
Supports Sparse files
Supports Reparse Points
Supports Object Identifiers
Supports Encrypted File System
Supports Named Streams

Obtaining Sector and Cluster Information for Drives If you want to determine an NTFS disk’s sector or cluster information, type fsutil fsinfo ntfsinfo followed by the drive designator, such as

C:\>fsutil fsinfo ntfsinfo c:

FSUtil then lists detailed information on the number of sectors and clusters, including the total clusters used, free clusters and reserved clusters, such as

NTFS Volume Serial Number :               0x23b36g45
Version :     3.1
Number Sectors :      0x0000000008fcf7c3
Total Clusters :      0x0000000000eb9f38
Free Clusters  :      0x0000000000d12400
Total Reserved :      0x0000000000000000
Bytes Per Sector  :   512
Bytes Per Cluster :   4096
Bytes Per FileRecord Segment              :    1024
Clusters Per FileRecord Segment           :    0

Obtaining Free Space Information for a Drive You can also use FSUtil to determine the amount of free space on a disk. Type fsutil volume diskfree followed by the drive designator, such as

C:\>fsutil volume diskfree c:

FSUtil will then report the total bytes on the disk as well as the total number of bytes free and available, such as

Total # of free bytes       :     52231667712
Total # of bytes            :     60028059648
Total # of avail free bytes :     52231667712 

Checking Disks for Errors and Bad Sectors

When you want to check disks for errors and bad sectors, you can use the Check Disk (Chkdsk.exe) command-line utility. This utility checks the integrity of both basic and dynamic disks. You can use it to check for and optionally repair problems found on FAT, FAT32, and NTFS volumes.

Check Disk can check for and correct many kinds of errors. The utility primarily looks for inconsistencies in the file system and its related metadata. One of the ways Check Disk locates errors is by comparing the volume bitmap to the disk sectors assigned to files in the file system. Check Disk can’t repair corrupted data within files that appear to be structurally intact, however.

Analyzing a Disk Without Repairing It

You can test the integrity of a drive by typing the command name followed by the drive letter and a colon. For instance, to check the integrity of the C drive, type

 chkdsk c: 

Check Disk reports its progress during each phase, as follows:

The type of the file system is NTFS.
Volume label is Primary.
 
WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.
 
CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is recovering lost files.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.
 
  58621153 KB total disk space.
   7484424 KB in 42596 files.
     13188 KB in 2115 indexes.
        20 KB in bad sectors.
    113933 KB in use by the system.
     65536 KB occupied by the log file.
  51009588 KB available on disk.
 
      4096 bytes in each allocation unit.
  14655288 total allocation units on disk.
  12752397 allocation units available on disk. 

As you can see, the Check Disk operation is performed in three stages. During the first stage, Check Disk verifies file structures:

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.

During the second stage, Check Disk verifies disk index entries:

CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is recovering lost files.

If there are lost files as a result of verifying the disk index entries, Check Disk will recover the lost files as it states. Typically, the recovered files are stored as .chk files in the root folder of the associated disk drive.

During the third stage, Check Disk verifies security descriptors:

CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.

Finally, Check Disk completes the process by reporting whether there was any free space incorrectly marked as allocated and, if so, it recommends that you correct this by running Check Disk with the /F switch:

CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

Fixing Disk Errors

When you analyze a disk, you are checking it but aren’t really fixing anything. To check the disk and repair any problems found, you’ll use the /F switch, which tells Check Disk to check for and fix errors:

chkdsk /f C:

Check Disk can’t repair volumes that are in use. If the volume is in use, Check Disk displays a prompt that asks if you want to schedule the volume to be checked the next time you restart the system. The /F switch implies the /R and /X switches (note that the /X switch applies only to NTFS volumes). The /R switch is used to locate bad disk sectors and recover readable information, and the /X switch is used to force the NTFS volume to dismount if necessary.

You can tell Check Disk to display more information about what it is doing using the verbose switch (/V). On NTFS, you can tell Check Disk to perform limited checks of disk index entries using the /I switch and to skip checking of cycles within folder structures using /C.

To see how Check Disk can be used, consider the following examples:

Find and repair errors that are found on the C drive:

chkdsk /f C:

Note

Remember that when you use /F, both /R and /X are implied.

Locate bad sectors and repair them on the C drive:

chkdsk /r C:

Perform minimum checks on the C drive, an NTFS volume:

chkdsk /i /c C:

Controlling Auto Check On Startup

By default, Windows Server 2003 and Windows XP check all disks on startup and if necessary start Check Disk to repair any errors. Two different programs control automatic disk checking on startup: AUTOCHK and CHKNTFS. Auto Check is used by the operating system to initiate automatic checking of drives on startup. You can’t invoke Auto Check directly, but you can control how it works using Check NTFS. With Check NTFS, you can determine if a disk will be checked next time the computer starts and change options for automatic checking.

Determining Auto Check Status

To determine if a disk will be checked next time the computer starts, type

chkntfs Volume:

where Volume: is the drive letter to check followed by a colon, such as

chkntfs c:

You can specify multiple drive designators as well. Separate each drive designator with a space. In this example, you determine the Check Disk status of drive C, D, and E:

chkntfs c: d: e:

Check NTFS reports the file system type and whether the disk is dirty or not dirty, as shown in this example:

The type of the file system is NTFS.
C: is not dirty.
The type of the file system is NTFS.
D: is dirty. 

Here, the C drive is not dirty and Auto Check won’t trigger Check Disk to run on the drive. The D drive is dirty, on the other hand, which indicates the drive may have errors and Auto Check will trigger Check Disk to run when the computer is started.

Configuring Auto Check Parameters

Using Check NTFS, you can configure Auto Check to work in several key ways. When the computer reboots, the operating system displays a countdown timer that allows the user to cancel the Auto Check operation before it begins. Using the /T parameter, you can set the length of the countdown timer in the form

chkntfs /t:NumSeconds 

where NumSeconds is the number of seconds for the timer, such as

chkntfs /t:15

To exclude a volume or volumes from being checked when the computer starts, even if the volume is marked as requiring Check Disk, you can use the /X parameter. Follow the /X parameter with the drive designators as shown in this example:

chkntfs /x d: e:

Here, the computer will skip checking of the D and E drives even if they were marked as dirty.

To include a volume for checking when the computer starts (which is the normal configuration for Auto Check), use the /C parameter. Follow the /C parameter with the drive designators, as shown in this example:

chkntfs /c c: d:

Here, the computer will Auto Check the C and D drives when it starts to determine their status as dirty or not dirty.

The final parameter you can use is /D, which restores the default Auto Check settings, except for the countdown timer. The default behavior is to Auto Check all drives when the computer starts.

Defragmenting Disks

Whenever you add files, move files, or remove files, the data on a computer’s drives can become fragmented. When a drive is fragmented, large files can’t be written to a single contiguous area on the disk. As a result, large files must be written to several smaller areas of the disk and more time is spent reading the file from the disk whenever it is accessed. To reduce fragmentation, you should periodically analyze and defragment disks using the Defrag command-line utility.

Understanding and Using Defrag

Typically, defragmentation is performed in two steps. First, the disk is analyzed to determine the level of fragmentation and whether the disk should be defragmented. You can perform both steps simply by typing defrag followed by the drive letter and a colon, such as

defrag c:

Defrag will analyze the disk and, if the disk needs to be defragmented, then begin defragmenting it. If the disk doesn’t need to be defragmented, Defrag will stop after the analysis phase and report that the disk doesn’t need to be defragmented.

Defrag requires at least 15 percent free space to defragment a disk completely. Defrag uses this space as a sorting area for file fragments. If a volume has less than 15 percent free space, Defrag will only partially defragment it. Additionally, you cannot defragment disks that the file system has marked as dirty, which indicates that the disk has errors. In this case, you must run Check Disk and repair the errors before you can defragment the disk.

Defrag accepts several parameters, including –a, which tells Defrag to analyze the disk but not to defragment it. Two additional switches you can use with Defrag are –v for verbose output and –f to force defragmentation a disk even if free space is low. Forcing defragmentation on such a disk, however, could mean that defragmentation will take a very long time or won’t be completely finished.

Marking a Disk as Dirty

One way to tell if a disk has been marked as dirty is to use the File System Utility (FSUtil). Type fsutil dirty query followed by the drive letter and a colon, such as

fsutil dirty query c:

If the disk has errors that should be fixed (or has been marked as dirty), FSUtil reports:

Volume - c: is Dirty

If the disk doesn’t have any known errors, FSUtil reports:

Volume - c: is NOT Dirty

Performing Defrag Analysis Only

Sometimes you’ll only want to analyze a disk to determine if you should defragment it later. To analyze a disk without defragmenting it, type the defrag –a command followed by the disk letter and a colon. Defrag will then report whether the disk should be defragmented. The following is an analysis of a disk that doesn’t need to be defragmented:

C:\>defrag -a c: 
Windows Disk Defragmenter
Copyright (c) 2001 Microsoft Corp. and Executive Software 
International, Inc.
 
Analysis Report
    28.62 GB Total,  4.78 GB (16%) Free,  2% Fragmented (5% file  fragmentation)
 
You do not need to defragment this volume. 

As you can see, the disk is only 2 percent fragmented with a 5 percent file fragmentation rate. Because fragmentation is so low, the disk doesn’t need to be defragmented. On the other hand, the following disk analysis shows a disk that is heavily fragmented:

C:\>defrag -a d: 
Windows Disk Defragmenter
Copyright (c) 2001 Microsoft Corp. and Executive Software 
International, Inc.
 
Analysis Report
    55.91 GB Total,  48.65 GB (87%) Free,  27% Fragmented (55% file 
fragmentation)
You should defragment this volume.

Here, Defrag recommends that you defragment the disk and you could schedule this as necessary maintenance.

---