[clue] NTFS logical structure corruption?

[dshaw at famece.com]

Hi all,

Thanks for the thoughtful replies. First, a couple of clarifications. The
errant drive is the internal drive in a laptop, so making the filesystem
available on-line, or mounting the drive on a different machine, are more
difficult-to-implement suggestions than I'm willing to go for at this
time. In part this is because overall, the machine seems to run fine. I'm
just worried that something may be amiss that will lead to additional
troubles in the future.

Jim Ockers wrote:

> I assume you've done CHKDSK C: /F and rebooted,

Correct. Many times, with different options, using the DOS tools available
under XP/SP3. Nothing is ever reported.

> If you boot the machine from a Windows XP
> CD and enter the recovery console, can you
> delete the file?

I haven't tried this yet, but will try to get to it tonight.

> If you fire up Norton Ghost

ok—- so here's some data I didn't put in my initial message. The only real
backup software I've worked with is Maxtor's Maxblast, a free copy that
came with a Maxtor drive. It is supposedly smart enough about NTFS to know
whether it can do "logical" backups or sector-by-sector backups. It can
create a C drive image without complaint, and browsing that image, I can
enter the problem folder and see the file I can't delete. Maxblast can
even restore the whole image without complaint, but with the same outcome
on the C drive when I'm done. A look at disk defragmenter graphics before
and after the restore suggests Maxblast was doing a logical file rebuild,
but I suppose it could switch back and forth as needed...  And
unfortunately, there's no "restore everything but" option.

> Also there were some command line utilites
> like CACLS.EXE that would let you manipulate

Right. I’ve tried manipulating the situation with them as well. In
addition, I have a suite of commercial UNIX utilities for Windows loaded
on the machine to help me get anything done, and have used them as well.
This was how I found the problem in the first place, when I tried to run a
"find C:" and it failed when it ran into the bad directory. Now I having
to run find with a "-prune" clause to avoid it.

> Can you find a version of WINFILE.EXE (the
> old Windows NT file manager) from Windows NT

Have not tried this. Any suggestions where I might such a thing that would
run under XP?

> the reason I mention Ghost is because it's had
> really good NTFS support just about from the beginning.

Thanks for this recommendation. If nothing else works I may get to this.
My gut level is to ignore the whole thing. I'm just worried that with all
the multiply-hard-linked files I'm seeing that something else is wrong.
Whether any of this is left over from the virus cleaning I have no idea. I
have another laptop with XP and a copy of Fedora loaded on it that I
should be able to get running tonight. I'll see whether that produces any
interesting comparisons.

Davis L. Willson wrote:

> 1) Use CHKDSK to repair the filesystem
> 2) Use TAKEOWN to take ownership of the
> files and directories you can't access.
> 3) Use ICACLS to give Administrators:Full
> Control and SYSTEM:Full Control on them.

I thought I had tried all these approaches already, but I'll try to take
another shot at it tonight.

Dave Shaw