RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Bird, B. <bar...@ed...>]

Szaka,

Thanks for taking an interest in this problem.

The missing information (I had to write it down off the screen!) is:

----
NTFS volume version: 3.0 (you knew that)
Checking filesystem consistency...
100.00 percent completed

Totally 1 cluster accounting mismatches
----
Yes, it's always the same cluster number, and only one.

This Windows installation has Service Pack 3 installed, plus four 
Hotfixes (Q326830, Q331953, Q810833, Q811493).
These hotfixes are to do with security, fixing unchecked buffers and
the like and I can't see would affect the filesystem as such. 811493 
is the closest, fixing an error in the way the kernel passes error 
messages to a debugger.

Unfortunately I don't seem to be able to turn Norton Antivirus off 
without uninstalling it.  However, it has a 'pause for 10 minutes' 
feature which I selected, then closed Windows down and ran 
ntfsresize again under Linux.  This made no difference, exactly 
the same error occurred again.

If you care to send me a special program that can extract slices 
of this filesystem for inspection, I'd be happy to run it and send 
you the results.

Regards,

Barry

PS I got hold of your ntfsmeta program and ran it to get the 'boot record', 
if that helps (the small number of unused sectors seems at variance with the

report in Windows that more than 91% of the disc is unused 
8388736/39085137 = 21.5% unused! - I suppose I just don't know how to
interpret 
this):

Jump                :                        
OEM_ID              :  NTFS                  
Bytes/sector        :  512                   
Sectors/cluster     :  1                     
Reserved sectors    :  0                     
Fats                :  0                     
Root entries        :  0                     
Sectors             :  0                     
Media type          :  248                   
Sectors/fat         :  0                     
Sectors/track       :  63                    
Heads               :  240                   
Hidden sectors      :  63                    
Large sectors       :  0                     
Unused              :  8388736               
Number of sectors   :  39085137              
LCN of $MFT         :  16                    
LCN of $MFTMirr     :  29208                 
Clusters/MFT record :  2                     
Clusters/index block:  8                     
Volume serial number:  10683704130303964288  
Boot sector checksum:  0                     
End of sector marker:  43605                 
=====================================================================
Volume name         :  
NTFS major version  :  3                     
NTFS minor version  :  0                     
NTFS flags          :  0                     
Number of clusters  :  39085137              
Cluster size        :  512                   
MFT record size     :  1024                  
LCN of $MFT         :  16                    
LCN of $MFTMirr     :  29208                 
Num. of $MFT records:  12935                 

-----Original Message-----
From: Szakacsits Szabolcs [mailto:sz...@si...]
Sent: 10 July 2003 19:02
To: Bird, Barry
Cc: 'lin...@li...'
Subject: Re: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem



Hi,

On Wed, 9 Jul 2003, Bird, Barry wrote:

> Perhaps this experience could be used to improve ntfsresize.

Thanks for reporting.

> On running ntfsresize from a floppy I got
>
>   ./ntfsresize -i /dev/hda1
>   ntfsresize version:  1.7.1s
>
>   Cluster Size: 512 bytes
>   Current volume/device size: 20011590144 bytes (20012 MB)
>
>   cluster accounting failed at 19542568 (ox12a3228): extra cluster in
$Bitmap

Here there should be some more information, like

	"Totally <NUMBER> cluster accounting mismatches."

> So I followed the advice, ran Chkdsk, made sure Windows shut down
> properly, and it made no difference. With Windows 2000 you have to
> schedule chkdsk to run and make corrections to NTFS at the next Windows
> reboot.

Right, if it's system partition. Doing it from the GUI Windows just reports
everything is OK but didn't (can't) correct the errors.

> All told I must have run chkdsk 3 times,

It's enough once, I mean if you have only one partition, schedule the
chkdsk, reboot and it must do the check.

> It is interesting to note however, that the position of this alleged
> error is exactly half-way along the partition, which is where the 'More
> metadata' is located.

Is it always at position 19542568 or it changes? Also how many mismatches
ntfsresize reports altogether?

> I should also point out that this is a relatively fresh installation of
> W2k,

If chkdsk indeed doesn't help, you could try applying W2K Service PACK.
There were several NTFS related fixes AFAIR.

> and I had used the Windows 2000 defragmenter to squeeze all the files
> (only 1.7Gb) to the start of the partition (was this my mistake?).

No, but one can try to resize without using it first also.

> Norton Antivirus is installed.

Well, if you think some application could make "last minute" magic to the
filesystem, etc, you could disable it temporarily.

> Has anyone else reported this problem?

Yes, there were several inconsist NTFS reports but chkdsk could always fix
them. So your case is unique.

Cheers,

	Szaka