A chkdsk /r on a Windows XP NTFS system partition revealed bad clusters in a file. chkdsk reported "bad clusters in file xyz have been replaced" (translated). The filesystem is stored on a plain SATA disk (no RAID).

Quoting http://www.ntfs.com/data-integrity.htm:

If the error occurred during a read, NTFS returns a read error to the calling program, and the data is lost.

Ok, I guess the file is corrupted... really?

Quoting http://support.microsoft.com/kb/187941/en-us

When an unreadable sector is located, NTFS will add the cluster containing that sector to its list of bad clusters and, if the cluster was in use, allocate a new cluster to do the job of the old. If a fault tolerant disk driver is being used, data is recovered and written to the newly allocated cluster. Otherwise, the new cluster is filled with a pattern of 0xFF bytes.

What is meant by "fault tolerant" disk driver? A RAID system? Is there any means to determine if chkdsk restored the file without data loss or do I have to resort to using a hex editor to search to file for a 4 kB bloc filled with 0xff? I am pretty sure the file is corrupted and I can easily restore it from backup, but I would like to now if there is a definitive answer.

migrated from stackoverflow.com Mar 13 '11 at 19:15

This question came from our site for professional and enthusiast programmers.

  • If you have a backup, then simply restore the file and compare with the one that chkdsk repaired. – Greg Hewgill Mar 13 '11 at 19:14
  • Seems like the Microsoft documentation is incorrect: I found a zero-filled 4k block by comparing the file relocated by chkdsk with the restored one from backup (no 0xff filling). So my assumption was correct, the file is in fact corrupted. – georg Mar 13 '11 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.