[clue] NTFS logical structure corruption?

[Jim Ockers]

Hi Dave,

dshaw at famece.com wrote:
> Hi all,
>
>   
>> If you boot the machine from a Windows XP
>> CD and enter the recovery console, can you
>> delete the file?
>>     
>
> I haven't tried this yet, but will try to get to it tonight.
>
>   
How did that go?
>> If you fire up Norton Ghost
>>     
>
> ok---- so here's some data I didn't put in my initial message. The only real
> backup software I've worked with is Maxtor's Maxblast, a free copy that
> came with a Maxtor drive. It is supposedly smart enough about NTFS to know
> whether it can do "logical" backups or sector-by-sector backups. It can
> create a C drive image without complaint, and browsing that image, I can
> enter the problem folder and see the file I can't delete. Maxblast can
> even restore the whole image without complaint, but with the same outcome
> on the C drive when I'm done. A look at disk defragmenter graphics before
> and after the restore suggests Maxblast was doing a logical file rebuild,
> but I suppose it could switch back and forth as needed...  And
> unfortunately, there's no "restore everything but" option.
>
>   
You might be able to get rid of the offending folders/files with Ghost 
Explorer which lets you edit a .GHO image file.
>
>> Can you find a version of WINFILE.EXE (the
>> old Windows NT file manager) from Windows NT
>>     
>
> Have not tried this. Any suggestions where I might such a thing that would
> run under XP?
>   
I think WINFILE.EXE is not in XP or newer.  You would have to have a 
copy of Windows NT around or else maybe try googling it to see if you 
can download it from somewhere.

>> the reason I mention Ghost is because it's had
>> really good NTFS support just about from the beginning.
>>     
>
> Thanks for this recommendation. If nothing else works I may get to this.
> My gut level is to ignore the whole thing. I'm just worried that with all
> the multiply-hard-linked files I'm seeing that something else is wrong.
> Whether any of this is left over from the virus cleaning I have no idea. I
> have another laptop with XP and a copy of Fedora loaded on it that I
> should be able to get running tonight. I'll see whether that produces any
> interesting comparisons.
>   
I think if CHKDSK does not make any changes then the disk is probably 
OK, it's just in a state where you can't modify that using the command 
line tools you have.  Microsoft does not expose every aspect of their 
API to everyone nor do they necessarily provide any way to access it.  I 
suspect this is probably the case for you.

Jim

-- 
Jim Ockers, P.E., P.Eng. (ockers at ockers.net)
Contact info: http://www.ockers.net/


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue/attachments/20120308/73957ae9/attachment.html