Maintaining Your Windows Vista System : Checking Your Hard Disk for Errors

7/11/2011 9:22:39 AM

Our hard disks store our programs and, most importantly, our precious data, so they have a special place in the computing firmament. They ought to be pampered and coddled to ensure a long and trouble-free existence, but that’s rarely the case, unfortunately. Just consider everything that a modern hard disk has to put up with:

General wear and tear— If your computer is running right now, its hard disk is spinning away at between 5,400 and 10,000 revolutions per minute. That’s right, even though you’re not doing anything, the hard disk is hard at work. Because of this constant activity, most hard disks simply wear out after a few years.
The old bump-and-grind— Your hard disk includes read/write heads that are used to read data from and write data to the disk. These heads float on a cushion of air just above the spinning hard disk platters. A bump or jolt of sufficient intensity can send them crashing onto the surface of the disk, which could easily result in trashed data. If the heads happen to hit a particularly sensitive area, the entire hard disk could crash. Notebook computers are particularly prone to this problem.
Power surges— The current supplied to your PC is, under normal conditions, relatively constant. It’s possible, however, for massive power surges to assail your computer (for example, during a lightning storm). These surges can wreak havoc on a carefully arranged hard disk.

So, what can you do about it? Windows Vista comes with a program called Check Disk that can check your hard disk for problems and repair them automatically. It might not be able to recover a totally trashed hard disk, but it can at least let you know when a hard disk might be heading for trouble.

Check Disk performs a battery of tests on a hard disk, including looking for invalid filenames, invalid file dates and times, bad sectors, and invalid compression structures. In the hard disk’s file system, Check Disk also looks for the following errors:

Lost clusters
Invalid clusters
Cross-linked clusters
File system cycles

The next few sections explain these errors in more detail.

Understanding Clusters

Large hard disks are inherently inefficient. Formatting a disk divides the disk’s magnetic medium into small storage areas called sectors, which usually hold up to 512 bytes of data. A large hard disk can contain tens of millions of sectors, so it would be too inefficient for Windows Vista to deal with individual sectors. Instead, Windows Vista groups sectors into clusters, the size of which depends on the file system and the size of the partition, as shown in Table 1.

Table 1. Default Cluster Sizes for Various File Systems and Partition Sizes
Partition Size	FAT16 Cluster Size	FAT32 Cluster Size	NTFS Cluster Size
7MB–16MB	2KB	N/A	512 bytes
17MB–32MB	512 bytes	N/A	512 bytes
33MB–64MB	1KB	512 bytes	512 bytes
65MB–128MB	2KB	1KB	512 bytes
129MB–256MB	4KB	2KB	512 bytes
257MB–512MB	8KB	4KB	512 bytes
513MB–1,024MB	16KB	4KB	1KB
1,025MB–2GB	32KB	4KB	2KB
2GB–4GB	64KB	4KB	4KB
4GB–8GB	N/A	4KB	4KB
8GB–16GB	N/A	8KB	4KB
16GB–32GB	N/A	16KB	4KB
32GB–2TB	N/A	N/A	4KB

Still, each hard disk has many thousands of clusters, so it’s the job of the file system to keep track of everything. In particular, for each file on the disk, the file system maintains an entry in a file directory, a sort of table of contents for your files. (On an NTFS partition, this is the Master File Table, or MFT.)

Understanding Lost Clusters

A lost cluster (also sometimes called an orphaned cluster) is a cluster that, according to the file system, is associated with a file, but that has no link to any entry in the file directory. Program crashes, power surges, or power outages are some typical causes of lost clusters.

If Check Disk comes across lost clusters, it offers to convert them to files in either the file’s original folder (if Check Disk can determine the proper folder) or in a new folder named Folder.000 in the root of the %SystemDrive%. (If that folder already exists, Check Disk creates a new folder named Folder.001 instead.) In that folder, Check Disk converts the lost clusters to files with names like File0000.chk and File0001.chk.

You can look at these files (using a text editor) to see whether they contain any useful data and then try to salvage it. Most often, however, these files are unusable and most people just delete them.

Understanding Invalid Clusters

An invalid cluster is one that falls under one of the following three categories:

A file system entry with an illegal value. (In the FAT16 file system, for example, an entry that refers to cluster 1 is illegal because a disk’s cluster numbers start at 2.)
A file system entry that refers to a cluster number larger than the total number of clusters on the disk.
A file system entry that is marked as unused, but is part of a cluster chain.

In this case, Check Disk asks whether you want to convert these lost file fragments to files. If you say yes, Check Disk truncates the file by replacing the invalid cluster with an EOF (end of file) marker and then converts the lost file fragments to files. These are probably the truncated portion of the file, so you can examine them and try to piece everything back together. More likely, however, you just have to trash these files.

Understanding Cross-Linked Clusters

A cross-linked cluster is a cluster assigned to two different files (or twice in the same file). Check Disk offers to delete the affected files, copy the cross-linked cluster to each affected file, or ignore the cross-linked files altogether. In most cases, the safest bet is to copy the cross-linked cluster to each affected file. That way, at least one of the affected files should be usable.

Understanding Cycles

In an NTFS partition, a cycle is a corruption in the file system whereby a subfolder’s parent folder is listed as the subfolder itself. For example, a folder named C:\Data should have C:\ as its parent; if C:\Data is a cycle, C:\Data—the same folder—is listed as the parent instead. This creates a kind of loop in the file system that can cause the cycled folder to “disappear.”

Running the Check Disk GUI

Check Disk has two versions: a GUI version and a command-line version. See the next section to learn how to use the command-line version. Here are the steps to follow to run the GUI version of Check Disk:

1.	In Windows Explorer, right-click the drive you want to check and then click Properties. The drive’s properties sheet appears.
2.	Display the Tools tab.
3.	Click the Check Now button and enter your User Account Control credentials. The Check Disk window appears, as shown in Figure 1. Figure 1. Use Check Disk to scan a hard disk partition for errors.
4.	Activate one or both of the following options, if desired: Automatically Fix File System Errors— If you activate this check box, Check Disk automatically repairs any file system errors that it finds. If you leave this option deactivated, Check Disk just reports on any errors it finds. Scan for and Attempt Recovery of Bad Sectors— If you activate this check box, Check Disk performs a sector-by-sector surface check of the hard disk surface. If Check Disk finds a bad sector, it automatically attempts to recover any information stored in the sector and it marks the sector as defective so that no information can be stored there in the future.
5.	Click Start.
6.	If you activated the Automatically Fix File System Errors check box and are checking a partition that has open system files, Check Disk will tell you that it can’t continue because it requires exclusive access to the disk. It will then ask whether you want to schedule the scan to occur the next time you boot the computer. Click Schedule Disk Check.
7.	When the scan is complete, Check Disk displays a message letting you know and a report on the errors it found, if any.

The AUTOCHK Utility

If you click Schedule Disk Check when Check Disk asks whether you want to schedule the scan for the next boot, the program adds the AUTOCHK utility to the following Registry setting:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

This setting specifies the programs that Windows Vista should run at boot time when the Session Manager is loading. AUTOCHK is the automatic version of Check Disk that runs at system startup. If you want the option of skipping the disk check, you need to specify a timeout value for AUTOCHK. You change the timeout value by adding the AutoChkTimeOut setting as a DWORD value in the same Registry key:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\

Set this to the number of seconds that you want to use for the timeout. Another way to set the timeout value is to use the CHKNTFS /T:[time] command, where time is the number of seconds to use for the timeout. (If you exclude time, CHKNTFS returns the current timeout setting.) For example, the following command sets the timeout to 60 seconds:

CHKNTFS /T:60

When AUTOCHK is scheduled with a timeout value greater than 0, you see the following the next time you restart the computer:

A disk check has been scheduled.
To skip disk checking, press any key within 60 second(s).

You can bypass the check by pressing a key before the timeout expires.

Running Check Disk from the Command Line

Here’s the syntax for Check Disk’s command-line version:

CHKDSK [volume [filename]] [/F] [/V] [/R] [/X] [/I] [/C] [/L:[size]]


volume	The drive letter (followed by a colon) or volume name.
filename	On FAT16 and FAT32 disks, the name of the file to check. Include the path if the file isn’t in the current folder.
/F	Tells Check Disk to fix errors automatically. This is the same as running the Check Disk GUI with the Automatically Fix File System Errors option activated.
/V	Runs Check Disk in verbose mode. On FAT16 and FAT32 drives, Check Disk displays the path and name of every file on the disk; on NTFS drives, displays cleanup messages, if any.
/R	Tells Check Disk to scan the disk surface for bad sectors and recover data from the bad sectors, if possible. This is the same as running the Check Disk GUI with the Scan for and Attempt Recovery of Bad Sectors option activated.
/X	On NTFS nonsystem disks that have open files, forces the volume to dismount, invalidates the open file handles, and then runs the scan (the /F switch is implied).
/I	On NTFS disks, tells Check Disk to check only the file system’s index entries.
/C	On NTFS disks, tells Check Disk to skip the checking of cycles within the folder structure. This is a rare error, so using /C to skip the cycle check can speed up the disk check.
/L:[size]	On NTFS disks, tells Check Disk to set the size of its log file to the specified number of kilobytes. The default size is 65,536, which is big enough for most systems, so you should never need to change the size. Note that if you include this switch without the size parameter, Check Disk tells you the current size of the log file.