A chkdsk /r on a Windows XP NTFS system partition revealed bad clusters in a file. chkdsk reported "bad clusters in file xyz have been replaced" (translated). The filesystem is stored on a plain SATA disk (no RAID).

Quoting http://www.ntfs.com/data-integrity.htm:

If the error occurred during a read, NTFS returns a read error to the calling program, and the data is lost.

Ok, I guess the file is corrupted... really?

Quoting http://support.microsoft.com/kb/187941/en-us

When an unreadable sector is located, NTFS will add the cluster containing that sector to its list of bad clusters and, if the cluster was in use, allocate a new cluster to do the job of the old. If a fault tolerant disk driver is being used, data is recovered and written to the newly allocated cluster. Otherwise, the new cluster is filled with a pattern of 0xFF bytes.

What is meant by "fault tolerant" disk driver? A RAID system? Is there any means to determine if chkdsk restored the file without data loss or do I have to resort to using a hex editor to search to file for a 4 kB bloc filled with 0xff? I am pretty sure the file is corrupted and I can easily restore it from backup, but I would like to now if there is a definitive answer.

link|improve this question
If you have a backup, then simply restore the file and compare with the one that chkdsk repaired. – Greg Hewgill Mar 13 '11 at 19:14
Seems like the Microsoft documentation is incorrect: I found a zero-filled 4k block by comparing the file relocated by chkdsk with the restored one from backup (no 0xff filling). So my assumption was correct, the file is in fact corrupted. – georg Mar 13 '11 at 21:31
feedback

migrated from stackoverflow.com Mar 13 '11 at 19:15

This question came from our site for professional and enthusiast programmers.

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown

Browse other questions tagged or ask your own question.