I want to dump the contents of $BadClus (or $Bad) on an NTFS partition so
that I can get a list of the bad clusters on some disks I’m playing with.
I’m not actually a file-system driver guy, but work below that (think
ATAPI.sys), so I don’t know those sorts of things. 
I did a bunch of web searching, and came up with nothing other than it’s a
sparse file – not even the SysInternals NTFSINFO dumps that info…
Can anyone point me in the right direction, hopefully towards a utility, but
code would also be appreciated!
(What I’m actually trying to track down is the OS doing a CHKDSK /F /R and
deciding that there are GIGABYTES worth of bad clusters on a disk that is
seemingly fine. I’ve seen other people on Usenet complain of this, but no
theories nor solutions. So if anyone has had experience with that, I’d love
to hear that as well!)
Thanks!
Try FSCTL_GET_RETRIEVAL_POINTERS
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Taed Wynnell”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, July 31, 2004 3:09 AM
Subject: [ntfsd] How to dump $BadClus?
> I want to dump the contents of $BadClus (or $Bad) on an NTFS partition so
> that I can get a list of the bad clusters on some disks I’m playing with.
> I’m not actually a file-system driver guy, but work below that (think
> ATAPI.sys), so I don’t know those sorts of things.
>
> I did a bunch of web searching, and came up with nothing other than it’s a
> sparse file – not even the SysInternals NTFSINFO dumps that info…
>
> Can anyone point me in the right direction, hopefully towards a utility, but
> code would also be appreciated!
>
> (What I’m actually trying to track down is the OS doing a CHKDSK /F /R and
> deciding that there are GIGABYTES worth of bad clusters on a disk that is
> seemingly fine. I’ve seen other people on Usenet complain of this, but no
> theories nor solutions. So if anyone has had experience with that, I’d love
> to hear that as well!)
>
> Thanks!
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
On Fri, 30 Jul 2004 16:09:07 -0700, you wrote:
I want to dump the contents of $BadClus (or $Bad) on an NTFS partition so
that I can get a list of the bad clusters on some disks I’m playing with.
You aren’t after the *contents*, then - the file itself occupies the
bad clusters, preventing any other files occupying them. You need a
list of which clusters that file occupies - the SysInternals Defrag
tool *may* be able to help there, but will probably need a little
adjustment to do so.
(What I’m actually trying to track down is the OS doing a CHKDSK /F /R and
deciding that there are GIGABYTES worth of bad clusters on a disk that is
seemingly fine. I’ve seen other people on Usenet complain of this, but no
theories nor solutions. So if anyone has had experience with that, I’d love
to hear that as well!)
The obvious route is a reformat, which will of course remove this file
- but if the disk itself is fine, I’d suspect an NTFS software
problem. Alternatively, if you can find a suitable utility (or just
delete the file ‘manually’) then re-run chkdsk, that could do the job.
James.
> I want to dump the contents of $BadClus (or $Bad) on an NTFS partition so
that I can get a list of the bad clusters on some disks I’m playing with.
I’m not actually a file-system driver guy, but work below that (think
ATAPI.sys), so I don’t know those sorts of things.
The easiest way to do this was to use NFI.exe (part of the Microsoft OEM
Support Tools), which is a neat little program that allows you to dump the
cluster numbers for a file (or every file). For example, in my case:
File 8
Bad Cluster List ($BadClus)
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$SECURITY_DESCRIPTOR (resident)
$DATA (resident)
$DATA $Bad (nonresident)
logical sectors 428237-984098 (0x688cd-0xf0422)
logical sectors 989221-1004580 (0xf1825-0xf5424)
logical sectors 1010219-1225258 (0xf6a2b-0x12b22a)
logical sectors 1231918-1234761 (0x12cc2e-0x12d749)
logical sectors 2034299-2034654 (0x1f0a7b-0x1f0bde)
logical sectors 13996680-13997524 (0xd59288-0xd595d4)
logical sectors 16441084-16449535 (0xfadefc-0xfaffff)
I still don’t think that my drive is actually “bad” in any way because I see
this sort of behavior fairly often. In my network of 3500 systems, I’ve
seen this maybe 20 times in the last few months – where one day it has 0
bad sectors, and the next, something like 30% of the drive is allegedly bad,
and coincidentally only in the free space – it never finds any bad sectors
in the used file space (even though the drives are 50% full or so). Also
telling is that SMART counters always show no errors – no reallocated
sectors, pending sectors, or anything else that might be associated with a
flakey drive… The weird thing is that usually, upon rerunning CHKDSK, I’ll
then get an error such as this:
Deleting corrupt attribute record (128, $Bad)
And then the bad sectors disappear again never to return, even upon multiple
runs of CHKDSK /F /R. (Sometimes it doesn’t, though, so does anyone know a
trick to delete a file such as this?)
So, I really don’t think that it’s a hard drive issue, but something
temporarily flaky with NTFS or with FTdisk (I run software mirroring on all
of these drives). And yes, I have the latest hotfixes of each (the most
recent were just a few months ago).
Thanks for your suggestions!