Share via

CHKDSK false positive file errors - Sanity Check

Anonymous
2013-09-09T23:55:45+00:00

Have a Dell Inspiron 1501 with XP Home 2002 Service Pack 3.... all updates.

I am having problems with another company's anti-virus software and tech support.  The tech runs CHKDSK in command prompt read only mode and gets error messages and tells me an error in the windows file system is the reason for the problem.  (Problem is a firewall that controls with inbound and outbound traffic will not start.)  I tell the tech that "CHKDSK / f shows no problem ... does he want to look at the  winlogon file."  Tech is adamant that CHKDSK (run in the command prompt window) shows a problem. 

Ok, I recall from ancient history that CHKDSK in the prompt window will show a false positive problem because other programs are accessing the files as the check is being done (Sorry, I am not technical)  and the way to know if there is a problem is to run CHKDSK /f.

Here is the log from the CHKDSK / f run with this power up ...is there a problem with the file system?

Event Type: Information

Event Source: Winlogon

Event Category: None

Event ID: 1001

Date: 9/9/2013

Time: 5:43:34 PM

User: N/A

Computer: BENDTLAPTOP

Description:

Checking file system on C:

The type of the file system is NTFS.

Cleaning up minor inconsistencies on the drive.

Cleaning up 6 unused index entries from index $SII of file 0x9.

Cleaning up 6 unused index entries from index $SDH of file 0x9.

Cleaning up 6 unused security descriptors.

  54934267 KB total disk space.

  44470764 KB in 164022 files.

     66624 KB in 16037 indexes.

         0 KB in bad sectors.

    428551 KB in use by the system.

     65536 KB occupied by the log file.

   9968328 KB available on disk.

      4096 bytes in each allocation unit.

  13733566 total allocation units on disk.

   2492082 allocation units available on disk.

Internal Info:

10 2f 05 00 66 bf 02 00 4f e8 03 00 00 00 00 00  ./..f...O.......

5f 0f 00 00 07 00 00 00 9d 09 00 00 00 00 00 00  _...............

ea eb b4 0b 00 00 00 00 5c cd b5 9d 00 00 00 00  ...............

0e 13 68 21 00 00 00 00 00 00 00 00 00 00 00 00  ..h!............

00 00 00 00 00 00 00 00 14 db e8 cc 00 00 00 00  ................

99 9e 36 00 00 00 00 00 a8 39 07 00 b6 80 02 00  ..6......9......

00 00 00 00 00 b0 47 9a 0a 00 00 00 a5 3e 00 00  ......G......>..

Will CHKDSK  (without F) in safe mode yield an different results than form the prompt window?


Thank you for assistance!!!

Windows for home | Previous Windows versions | Files, folders, and storage

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

Answer accepted by question author

Anonymous
2013-09-10T06:37:59+00:00

Running chkdsk in Safe Mode with no parameters is unlikely to yield different results, but you can sure try it.

Here is what I usually say regarding what I think you are seeing:

Chkdsk provides information specific to each file system in a status report. The status report shows errors found in the file system.  If you run chkdsk without the /r or /f command-line option on an active partition it might report spurious errors because it cannot lock the drive.  You should use chkdsk occasionally on each disk to check for errors.

If you run chkdsk from a command prompt while Windows is running (like you are doing), it may report errors or it may not report errors - and it may report different errors each time you run it.  It doesn't necessarily mean there is something wrong - is the way you are running chkdsk.

Here is how Microsoft explains this observation:

"...CHKDSK may report that a disk is corrupted even when there is no

real corruption present. This can happen if NTFS happens to modify

areas of the disk on behalf of some program activity that CHKDSK is

examining at the same time. To verify a volume correctly, the volume

must be in a static state, and the only way to guarantee that state is

to lock the volume. CHKDSK only locks the volume when /F or /R (which

implies "F") is specified. Thus, you may need to run CHKDSK more than

once to get it to complete all stages in read-only mode."

Read the entire article here:

http://support.microsoft.com/kb/187941

If you are running chkdsk from a command prompt (running just chkdsk with no options), you are not in the static state required and as Microsoft says, you may see errors "when no real corruption is present". That is the way it works if you use it that way.

The usual problems or "errors" seen when running chkdsk from command prompt involve the USN Journal or "minor inconsistencies in unused index entries".   If XP is not in a static state, the USN Journal and other things regarding your HDD could be and are probably changing all the time, so chkdsk may report issues in these areas because chkdsk is not being run when the system is in a static state.  

If you do not run chkdsk in a static state and it reports issues, that does not mean there is a problem - it is the way you are running chkdsk.    That is the way it works (or might work).

If you want chkdsk to actually try to fix problems, your system must be in a "static state".

There are only two ways to be sure your system is in a static state when running chkdsk.

One way is to run chkdsk from the XP Recovery Console so that XP is not "running" to interfere with chkdsk and when it will be impossible for things to be changing on the volume.

The other way is to schedule the chkdsk to run on the next reboot of the system before XP has a chance to finish loading and look for the results on the chkdsk with error correction in the Event Viewer.

When you choose to run chkdsk with error correction either from the disk properties Tools options or from a Command Prompt (chkdsk /r) you must respond in the affirmative to this question:

Would you like this volume to be checked the next time the system restarts?

If you respond in the affirmative, then chkdsk /r will be scheduled to run the next time XP reboots.

Running a chkdsk with error correction can take a long time - perhaps many hours depending on the size of the volume, the amount of data on the volume and what chkdsk finds to do.  Be patient and wait observing the percent complete on the screen which may even appear to go backwards sometimes.  If the HDD light is blinking or you can hear the system "working" chkdsk is still running, so do not try to interrupt it.

If you run chkdsk /r from the XP Recovery Console, you can watch it and see everything that is happening.  Sometimes that is a little more interesting to watch so you can keep an eye on it.  If you have no genuine bootable XP media from which you can boot into the XP Recovery Console, it is easy to make a bootable XP Recovery Console CD (no XP media required).

If the chkdsk with error correction runs the next time the system is rebooted, the activity and result will show up in the Application Event Log.  If you want to see what chkdsk did when it ran on the reboot, look in the Application log for events sourced by Winlogon and that have the date and time close to the time chkdsk was run.

Was this answer helpful?

0 comments No comments

2 additional answers

Sort by: Most helpful
  1. Anonymous
    2013-09-10T16:17:27+00:00

    No problemo - maybe you can teach him/her a few things.

    Obviously I have run into this "problem" of running just plain chkdsk from a Command Prompt before and already had that copy/paste reply figured out in my notes (I didn't just make that stuff up today!).

    Since you did not specify what AV software is or what kind of problems you are having there is not much more to offer except to say that some third part AV software is regarded around here to be generally problematic - like Norton and McAfee especially (even the paid versions).

    So if you want ideas in those areas and since you already marked this topic as "Answered" you may want to start a new question/topic/thread with more details about your system and the issues you are seeing.  Starting a new question that has no Answer yet will get many smart eyeballs on your new topic.

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2013-09-10T16:03:53+00:00

    Thank you very much for the reply and scanty check :)  I don't know if the tech did not know about CHKDSK  in prompt mode or if he was blowing me off because he did not know the answer to the problem.

    Was this answer helpful?

    0 comments No comments