File System Utilities


The CHKDSK , RECOVER , and SCANDISK commands are the core of the Windows damaged-disk recovery team. These commands are somewhat crude, and their actions sometimes are drastic, but at times they are all that is available or necessary. RECOVER is best known for its function as a data recovery program, and CHKDSK typically is used for inspection of the file structure. Many users are unaware that CHKDSK can implement repairs to a damaged file structure. DEBUG , a crude, manually controlled program, can also help in the case of a disk disasterbut only if you know exactly what you are doing.

SCANDISK is a safer, more automated, more powerful replacement for CHKDSK and RECOVER in Windows 9x/Me. Windows 2000 and XP do not include SCANDISK and instead have beefed up CHKDSK designed to handle NTFS.

CHKDSK Operation

CHKDSK reports problems found in a disk volume's file system with one of several descriptive messages that vary to fit the specific error. Sometimes the messages are cryptic or misleading. CHKDSK does not specify how an error should be handled. It does not tell you whether CHKDSK can repair the problem, whether you must use some other utility, or what the consequences of the error and the repair will be. Neither does CHKDSK tell you what caused the problem nor how to avoid repeating the problem.

The primary function of CHKDSK is to compare the folder and FAT or NTFS MFT (Master File Table) to determine whether they agree with each otherthat is, whether all the data in the folder entries for the files (such as the starting cluster and size information) corresponds to what is in the FAT (such as chains of clusters with end-of-chain indicators). CHKDSK also checks subfolder file entries, as well as the special "dot" (.) and "double dot" (..) entries that tie the subfolder system together.

The second function of CHKDSK is to implement repairs to the disk structure. CHKDSK patches the disk so that the folder and FAT or MFT are in alignment and agreement. From a repair standpoint, understanding CHKDSK is relatively easy. On FAT volumes , CHKDSK almost always modifies the folders on a disk to correspond to what it finds in the FAT. There are only a few special cases in which CHKDSK modifies the FAT. When it does, the FAT modifications are always the same type of simple change.

Think of CHKDSK 's repair capability as a folder patcher. Because CHKDSK cannot repair most types of FAT damage effectively, it simply modifies the disk folders to match whatever problems it finds in the FAT. On NTFS volumes, CHKDSK is very effective at correcting problems with the MFT.

Caution

You should never run CHKDSK with the /F parameter without first running it in read-only mode (without the /F parameter) to determine whether and to what extent damage exists.


Only after carefully examining the disk damage and determining how CHKDSK would fix the problems should you run CHKDSK with the /F parameter. If you do not specify the /F parameter when you run CHKDSK , the program does not make corrections to the disk. Rather, it performs repairs in a mock fashion. This limitation is a safety feature because you do not want CHKDSK to take action until you have examined the problem. After deciding whether CHKDSK will make the correct assumptions about the damage, you might want to run it with the /F parameter.

Problems reported by CHKDSK are usually problems with the software and not the hardware. You rarely see a case in which lost clusters, allocation errors, or cross-linked files reported by CHKDSK were caused directly by a hardware fault, although it is certainly possible. The cause is usually a defective program or a program that was stopped before it could close files or purge buffers. A hardware fault certainly can stop a program before it can close files, but many people think that these error messages signify fault with the disk hardware, which is almost never the case.

The RECOVER Command

The RECOVER command is designed to mark clusters as bad when the clusters contain unreadable sectors, and rewrite the entries for the file in the FAT or MFT in order to be able to read the remainder of the file past the unreadable sector. When the system can't read a file because of a problem with a sector on the disk going bad, the RECOVER command can essentially jump the pointers to the file data in the FAT or MFT so that the rest of the file can be read, as well as to mark the file system so another file does not use those clusters. When used improperly, this program can be dangerous. The RECOVER utility that was included in DOS 5.x and earlier was not supplied in Windows 9x/Me because its functionality has been replaced by SCANDISK . It was, however, re-introduced in Windows NT/2000/XP and later because SCANDISK had been replaced by an improved version of CHKDSK .

Caution

Be very careful when you use older versions of RECOVER . Used improperly, it can do severe damage to your files. If you enter the old DOS version of RECOVER command without a filename for it to work on, the program assumes you want every file on the disk recovered and operates on every file and subfolder on the disk. It converts all subfolders to files, places all filenames in the root folder, and gives them new names ( FILE0000.REC, FILE0001.REC , and so on). This process essentially wipes out the file system on the entire disk.

Fortunately the newer version of RECOVER included with Windows NT/2000/XP and later will not accept wildcards, and will only work on the single specific filename you enter with the command.


An improved version of RECOVER that recovers data from a specified file is only one of the command-line programs provided with Windows NT, 2000, and XP. To use this version of RECOVER , which works with both FAT and NTFS file systems, open a command prompt and enter the command as shown here:

 RECOVER (drive\folder\filename) 

For example, to recover all readable sectors from a file called Mynovel.txt stored in C:\My Documents\Writings , you would enter the following command:

 RECOVER C:\My Documents\Writings\Mynovel.txt 

Because the NT/2000/XP version of RECOVER requires you to specify a filename and path , it cannot destroy a file system the way the old DOS RECOVER command could.

SCANDISK

You should check your FAT partitions under Windows 9x/Me regularly for the problems discussed in this chapter and any other difficulties that might arise. By far the easiest and most effective solution for disk diagnosis and repair under Windows 9x/Me is the SCANDISK utility, included with DOS 6 and higher versions, as well as with Windows 9x/Me. This program is more thorough and comprehensive than CHKDSK or RECOVER under those operating systems and can perform the functions of both of themand a great deal more.

SCANDISK is similar to a scaled-down version of third-party disk repair programs such as Norton Disk Doctor, and it can verify both file structure and disk sector integrity. If SCANDISK finds problems, it can repair folders and FATs. If the program finds bad sectors in the middle of a file, it marks the clusters (allocation units) containing the bad sectors as bad in the FAT and attempts to read the file data by rerouting around the defect.

Windows 9x includes both DOS and Windows versions of SCANDISK , which are named SCANDISK.EXE and SCANDSKW.EXE , respectively. Windows scans your drives at the beginning of the operating system installation process and automatically loads the DOS version of SCANDISK whenever you restart your system after turning it off without completing the proper shutdown procedure. You can also launch SCANDISK.EXE from a DOS prompt or from a batch file using the following syntax:

[View full width]
 
[View full width]
Scandisk x: [/a] [/n] [/p] [dblspace.nnn/drvspace.nnn] x: - designator of the drive that you want to scan /a - scans all local fixed hard disks /n - noninteractive mode; requires no user input /p - scans only, without correcting errors /custom - runs Scandisk with the options configured in the [CUSTOM] section of the Scandisk.ini file dblspace.nnn or drvspace.nnn - scans a compressed volume file, where nnn is replaced by the file extension (such as 001)

The SCANDISK.INI file, located in the C:\WINDOWS\COMMAND folder on a Windows system by default, contains extensive and well-documented parameters you can use to control the behavior of SCANDISK.EXE . Note that the options in the SCANDISK.INI file are applied only to the DOS version of the utility and have no effect on the Windows GUI version.

You also can run the GUI version of the utility by opening the Start menu and selecting Programs, Accessories, System Tools. Both versions scan and repair the FAT and the folder and file structures, repair problems with long filenames, and scan volumes that have been compressed with DriveSpace or DoubleSpace.

SCANDISK provides two basic testing options: Standard and Thorough. The difference between the two is that the Thorough option causes the program to scan the entire surface of the disk for errors in addition to the items just mentioned. You also can select whether to run the program interactively or let it automatically repair any errors it finds.

The DOS and Windows versions of SCANDISK also test the FAT in different ways. The DOS version scans and, if necessary, repairs the primary copy of the file allocation table. After this, it copies the repaired version of the primary to the backup copy. The Windows version, however, scans both copies of the FAT. If the program finds discrepancies between the two copies, it uses the data from the copy that it judges to be correct and reassembles the primary FAT using the best data from both copies. If the FAT information is not reconstructed correctly, some or all of your data might become inaccessible.

SCANDISK also has an Advanced Options dialog box that enables you to set the following parameters:

  • Whether the program should display a summary of its findings

  • Whether the program should log its findings

  • How the program should repair cross-linked files (two folder entries pointing to the same cluster)

  • How the program should repair lost file fragments

  • Whether to check files for invalid names, dates, and times

Although SCANDISK is good, and is certainly a vast improvement over CHKDSK (but not the CHKDSK included in Windows NT/2000/XP and later, which was greatly improved), I recommend using one of the commercial packages, such as the Norton Utilities (included with Norton SystemWorks), for any major disk problems. These utilities go far beyond what is included in DOS or Windows.

Disk Defragmentation

The entire premise of a file system is based on the storage of data in clusters that can be located anywhere on the disk. This enables the computer to store a file of nearly any size at any time. The process of following a chain to locate all the clusters holding the data for a particular file can force the hard disk drive to access many locations on the disk. Because of the physical work involved in moving the disk drive heads, reading a file that is heavily fragmented in this way is slower than reading one that is stored on consecutive clusters.

As you regularly add, move, and delete files on a disk over a period of time, the files become increasingly fragmented, which can slow down disk performance. You can relieve this problem by periodically running a disk defragmentation utility on your drives, such as the one included with Windows. When you run the Disk Defragmenter, the program reads the pointers to all of the clusters to all of the files on the drive, in order to determine which files are fragmented.

The program then writes any fragmented files to contiguous clusters and deletes the originals . By progressively reading, writing, and erasing files, the defragmenting program eventually leaves the disk in a state where all files exist on contiguous clusters. As a result, the drive is capable of reading any file on the disk with a minimum of head movement, thus providing what is often a noticeable performance increase.

The Windows Defragmentation utility provides this basic defragmenting function. It also enables you to select whether you want to arrange the files on the disk to consolidate the empty clusters into one contiguous free space (which takes longer). The Windows 98/Me version adds a feature that examines the files on the disk and arranges them with the most frequently used program files grouped together at the front of the disk, which can make programs load more quickly. Such a function is not necessary under Windows NT/2000/XP because those newer versions of Windows use a prefetch function to more quickly locate frequently accessed files.

To show how defragmenting works, see the example of a fragmented file shown in Table 10.40.

Table 10.40. Fragmented File

Folder

Name

Starting Cluster

Size

PLEDGE.TXT

1002

2

USCONST.TXT

1000

4

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

1004

In use, points to next cluster

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

1005

In use, points to next cluster

01005

FFFFh

End of file

...

...

...

65526

Last cluster available


In the preceding example, the file USCONST.TXT is fragmented in two pieces. If you ran a defragmenting program, the files would be read off the disk and rewritten in a contiguous fashion. One possible outcome is shown in Table 10.41.

Table 10.41. Defragmented File

Folder

Name

Starting Cluster

Size

PLEDGE.TXT

1004

2

USCONST.TXT

1000

4

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

1002

In use, points to next cluster

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

1005

In use, points to next cluster

01005

FFFFh

End of file

...

...

...

65526

Last cluster available


Although it doesn't look like much was changed, you can see that now both files are in one piece, stored one right after the other. Because defragmenting involves reading and rewriting a possibly large number of files on your drive, it can take a long time, especially if you have a large drive with a lot of fragmented files and not very much free working space on the drive.

Third-party defragmentation utilities, such as the Speed Disk program included in the Norton Utilities, provide additional features, such as the capability to select specific files that should be moved to the front of the disk. Speed Disk also can defragment the Windows swap file and files that are flagged with the system and hidden attributes, which Disk Defragmenter will not touch.

Caution

Although the disk-defragmentation utilities included with Windows and third-party products are usually quite safe, you should always be aware that defragmenting a disk is an inherently dangerous procedure. The program reads, erases, and rewrites every file on the disk and has the potential to cause damage to your data when interrupted improperly. Although I have never seen a problem result from the process, an unforeseen eventsuch as a power failureduring a defragmentation procedure can conceivably be disastrous. I strongly recommend that you always run a disk-repair utility, such as CHKDSK (Windows NT/2000/XP or later) or SCANDISK (Windows 9x/Me), on your drives before defragmenting them and have a current backup ready.


Windows NT 4.0 does not include a defragmentation utility, but Windows 2000 and Windows XP do include such a utility. Note that third-party defragmentation utilities available for recent and current versions of Windows, such as Golden Bow Systems' VoptXP (www.vopt.com), are often faster and offer more features than Windows's own defragmentation programs.

Third-Party Programs

When you have a problem reading a file or portions of a drive, the best course of action might be to use one of the more powerful third-party disk-repair utilities on the market. The Norton Utilities by Symantec (also included in Norton SystemWorks) stands as one of the more popular data recovery programs on the market today. This program is comprehensive and automatically repairs most types of disk problems.

Norton Utilities and Norton SystemWorks

Programs such as Norton Disk Doctor can perform much more detailed repairs with a greater amount of safety. Disk Doctor preserves as much of the data in the file as possible and can mark the FAT so the bad sectors or clusters of the disk are not used again. These programs also save Undo information, enabling you to reverse any data recovery operation.

Disk Doctor is part of Symantec's Norton Utilities package, which includes a great many other useful tools. For example, Norton Utilities has an excellent sector editor (Norton Disk Editor) that enables you to view and edit any part of a disk, including the master and volume boot records, FATs, and other areas that fall outside the disk's normal data area. Currently, no other program is as comprehensive or as capable of editing disks at the sector level. The disk editor included with Norton Utilities can give the professional PC troubleshooter or repairperson the ability to work directly with any sector on the disk, but this does require extensive knowledge of sector formats and disk structures. The documentation with the package is excellent and can be very helpful if you are learning data recovery on your own.

Note

Data recovery is a lucrative service that the more advanced technician can provide. People are willing to pay much more to get their data back than to replace a hard drive.


You also can create a rescue disk for restarting your system and testing the drive in case of emergencies, unerase accidentally deleted files (even if the Recycle Bin was bypassed), and unformat accidentally formatted drives.

Norton Utilities is now available in version 2005 as part of Norton SystemWorks 2005 (for Windows 98/Me/NT/2000/XP). SystemWorks 2005 also includes Norton Anti-Virus and CheckIt diagnostics; the SystemWorks 2005 Premier version also includes Norton Ghost disk imaging software. Some of the programs provided with Norton Utilities are designed to be run from the command line or from a DOS prompt, such as the following:

  • Norton Disk Doctor ( NDD.EXE )

  • Disk Editor ( DISKEDIT.EXE )

  • UnErase ( UNERASE.EXE )

  • UnFormat ( UNFORMAT.EXE )

  • Rescue Restore ( RESCUE.EXE )

Most Norton Utilities programs are designed to be run from within the Windows graphical user interface (GUI), and several of the utilities include both Windows and command-prompt versions. You should be careful not to use older versions of Norton Utilities, such as version 8.0 (designed for Windows 3.1 and MS-DOS), with 32-bit versions of Windows because of the possibility of data loss due to a lack of support for long filenames and large drives.

File Systems and Third-Party Disk Utilities

The most important consideration when you purchase third-party disk utilities is to choose products that support your file system. For example, Norton Utilities supports both FAT (including FAT32) and NTFS files systems, as does SpinRite 6. Beware of older utilities that don't support NTFS, for example. Never use a disk utility not designed for your file system, and never use an out-of-date disk utility (designed for an earlier operating system) on your disk. In both cases, you could cause irreparable damage to the data on your drive.




Upgrading and Repairing Microsoft Windows
Upgrading and Repairing Microsoft Windows (2nd Edition)
ISBN: 0789736950
EAN: 2147483647
Year: 2005
Pages: 128

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net