Maintaining Your Windows XP System : Checking Your Hard Disk for Errors (part 1)

Understanding Clusters

Large hard disks are inherently inefficient. When you format a disk, the disk’s magnetic medium is divided into small storage areas called sectors, which usually hold up to 512 bytes of data. A large hard disk can contain tens of millions of sectors, so it would be too inefficient for Windows XP to deal with individual sectors. Instead, Windows XP groups sectors into clusters, the size of which depends on the file system and the size of the partition, as shown in Table 1.

Table 1. Default Cluster Sizes for Various File Systems and Partition Sizes

Partition Size	FAT16 Cluster Size	FAT32 Cluster Size	NTFS Cluster Size
7MB–16MB	2KB	N/A	512 bytes
17MB–32MB	512 bytes	N/A	512 bytes
33MB–64MB	1KB	512 bytes	512 bytes
65MB–128MB	2KB	1KB	512 bytes
129MB–256MB	4KB	2KB	512 bytes
257MB–512MB	8KB	4KB	512 bytes
513MB–1,024MB	16KB	4KB	1KB
1,025MB–2GB	32KB	4KB	2KB
2GB–4GB	64KB	4KB	4KB
4GB–8GB	N/A	4KB	4KB
8GB–16GB	N/A	8KB	4KB
16GB–32GB	N/A	16KB	4KB
32GB–2TB	N/A	N/A	4KB

Still, each hard disk has many thousands of clusters, so it’s the job of the file system to keep track of everything. In particular, for each file on the disk, the file system maintains an entry in a file directory, a sort of table of contents for your files. (On an NTFS partition, this is called the Master File Table, or MFT.)

Understanding Lost Clusters

A lost cluster (also sometimes called an orphaned cluster) is a cluster that, according to the file system, is associated with a file, but that has no link to any entry in the file directory. Lost clusters are typically caused by program crashes, power surges, or power outages.

If Check Disk comes across lost clusters, it offers to convert them to files in either the file’s original folder (if Check Disk can determine the proper folder) or in a new folder named Folder.000 in the root of the %SystemDrive%. (If that folder already exists, Check Disk creates a new folder named Folder.001 instead.) In that folder, Check Disk converts the lost clusters to files with names like File0000.chk and File0001.chk.

You can take a look at these files (using a text editor) to see whether they contain any useful data and then try to salvage the data. Most often, however, these files are unusable and most people just delete them.

Understanding Invalid Clusters

An invalid cluster is one that falls under one of the following three categories:

• A file system entry with an illegal value. In the FAT16 file system, for example, an entry that refers to cluster 1 is illegal because a disk’s cluster numbers start at 2.

• A file system entry that refers to a cluster number larger than the total number of clusters on the disk.

• A file system entry that is marked as unused, but is part of a cluster chain.

In this case, Check Disk asks whether you want to convert these lost file fragments to files. If you say yes, Check Disk truncates the file by replacing the invalid cluster with an EOF (end of file) marker and then converts the lost file fragments to files. These are probably the truncated portion of the file, so you can examine them and try to piece everything back together. More likely, however, you just have to trash these files.

Understanding Cross-Linked Clusters

A cross-linked cluster is a cluster that has somehow been assigned to two different files (or twice in the same file). Check Disk offers to delete the affected files, copy the cross-linked cluster to each affected file, or ignore the cross-linked files altogether. In most cases, the safest bet is to copy the cross-linked cluster to each affected file. This way, at least one of the affected files should be usable.

Understanding Cycles

In an NTFS partition, a cycle is a corruption in the file system whereby a subfolder’s parent folder is listed as the subfolder itself. For example, a folder name C:\Data should have C:\ as its parent; if C:\Data is a cycle, C:\Data—the same folder—is listed as the parent instead. This creates a kind of loop in the file system that can cause the cycled folder to “disappear.”

Running the Check Disk GUI

Check Disk has two versions: a GUI version and a command-line version. See the next section to learn how to use the command-line version. Here are the steps to follow to run the GUI version of Check Disk:

1.	In Windows Explorer, right-click the drive you want to check and then click Properties. The drive’s property sheet appears.
2.	Display the Tools tab.
3.	Click the Check Now button. The Check Disk window appears, as shown in Figure 1. Figure 1. Use Check Disk to scan a hard disk partition for errors.
4.	Activate one or both of the following options, if desired: Automatically Fix File System Errors If you activate this check box, Check Disk will automatically repair any file system errors that it finds. If you leave this option deactivated, Check Disk just reports on any errors it finds. Scan for and Attempt Recovery of Bad Sectors If you activate this check box, Check Disk performs a sector-by-sector surface check of the hard disk surface. If Check Disk finds a bad sector, it automatically attempts to recover any information stored in the sector and it marks the sector as defective so that no information can be stored there in the future.
5.	Click Start.
6.	If you activated the Automatically Fix File System Errors check box and are checking a partition that has open system files, Check Disk will tell you that it can’t continue because it requires exclusive access to the disk. It will then ask whether you want to schedule the scan to occur the next time you boot the computer. Click Yes to schedule the disk check.
7.	When the scan is complete, Check Disk displays a message letting you know and a report on the errors it found, if any.

The AUTOCHK Utility

If you click Yes when Check Disk asks whether you want to schedule the scan for the next boot, the program adds the AUTOCHK utility to the following Registry setting:

   HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

This setting specifies the programs that Windows XP should run at boot time when the Session Manager is loading. AUTOCHK is the automatic version of Check Disk that runs at system startup. If you want the option of skipping the disk check, you need to specify a timeout value for AUTOCHK. You change the timeout value by using the AutoChkTimeOut setting in the same Registry key:

   HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

Set this to the number of seconds you want to use for the timeout. Another way to do this is to use the CHKNTFS /T:[time] command, where time is the number of seconds to use for the timeout. (If you exclude time, CHKNTFS returns the current timeout setting.) For example, the following command sets the timeout to 60 seconds:

   CHKNTFS /T:60

When AUTOCHK is scheduled with a timeout value greater than 0, you see the following the next time you restart the computer:

   A disk check has been scheduled.
   To skip disk checking, press any key within 10 second(s).

You can bypass the check by pressing a key before the timeout expires.

Running Check Disk from the Command Line

Here’s the syntax for Check Disk’s command-line version:

CHKDSK [volume [filename]] [/F] [/V] [/R] [/X] [/I] [/C] [/L:[size]]

volume	The drive letter (followed by a colon) or volume name.
filename	On FAT16 and FAT32 disks, the name of the file to check. Include the path if the file isn’t in the current folder.
/F	Tells Check Disk to automatically fix errors. This is the same as running the Check Disk GUI with the Automatically Fix File System Errors option activated.
/V	Runs Check Disk in verbose mode. On FAT16 and FAT32 drives, Check Disk displays the path and name of every file on the disk; on NTFS drives, displays cleanup messages, if any.
/R	Tells Check Disk to scan the disk surface for bad sectors and recover data from the bad sectors, if possible. This is the same as running the Check Disk GUI with the Scan for and Attempt Recovery of Bad Sectors option activated.
/X	On NTFS nonsystem disks that have open files, forces the volume to dismount, invalidates the open file handles, and then runs the scan (the /F switch is implied).
/I	On NTFS disks, tells Check Disk to check only the file system’s index entries.
/C	On NTFS disks, tells Check Disk to skip the checking of cycles within the folder structure. This is a rare error, so using /C to skip the cycle check can speed up the disk check.
/L:[size]	On NTFS disks, tells Check Disk to set the size of its log file to the specified number of kilobytes. The default size is 65,536, which is plenty big enough for most systems, so you should never need to change the size. Note that if you include this switch without the size parameter, Check Disk tells you the current size of the log file.