Wednesday, January 20, 2010

Windows 7 NTFS worry...

Out of the blue, my Windows 7 install decided to run chkdsk on my system drive on startup (once). It didn't find any problems.

A little bit more digging revealed Ntfs event number 55 had been logged last time the computer was on:
"The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume [volume name]."

Obviously a little bit worrying. Since chkdsk didn't find anything actually wrong, I did a little bit of stress testing to double check for any stability issues - but those seemed fine. The drive in question is a Samsung SLC SSD, again no real sign of any issues there - S.M.A.R.T. data is OK, and actually the normalised wear-levelling attribute is still at 99 (!).

So I decided to leave it at that and wait to see if it reoccurs. (Actually, I decided to switch my SATA controller into AHCI mode which unleashed some separate problems, but I'll write about those separately).

Occur again it did - several days later. This time I caught the message in the event log before I shut down the computer. Indeed I checked the dirty flag of the volume, and it was set. Similarly, chkdsk wasn't flagging up anything as wrong.

Seemed to me that something must have changed recently to start triggering this. There were a few things I could think of, but I simply disabled the real-time protection of my anti-virus (MSE "Ongoing Beta"). Some weeks later and it hasn't reoccurred - but that may well be a coincidence. Not sure what to make of it, but I will have to continue to monitor it..

Update: The Windows photo importing functionality seems to be something that likes to trigger this (see comments). Still investigating whether MSE is relevant or not.

Update: It likes to happen when importing the photos but not always reliably. So far it has only happened with MSE real-time protection enabled. The photo importer is set to import to the "My Pictures" folder, and also picture 'streaming' is enabled. You might also get the dreaded "The file or directory is corrupted and unreadable" message as well. I will also add that I tested on Windows 7 64-bit.

Looks like an OS bug anyway, I don't see why anti-virus should cause this type of error.

Some relevant links:
http://groups.google.com/group/tortoisesvn/browse_thread/thread/69f3e36e6bbf7389?pli=1 (note the post title, easy to miss..)
http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/6c3ed415-704b-482d-a20b-69277f6cd4ad (my god there are some idiotic replies)

First one seems interesting, some issue with file locks according to it.

Update: A statement from a Microsoft employee from the TechNet forums:
"This is a known regression in Windows 7 in the NTFS file system. It occurs when doing a superceding rename over a file that has an atomic oplock on it (atomic oplocks are a new feature in Windows 7). The indexer uses atomic oplocks which is why it helped when you disabled the indexer. Explorer also uses atomic oplocks which is why you are still seeing the issue. When this occurs STATUS_FILE_CORRUPT is incorrectly returned and the volume is marked "dirty" which is a signal to the system that chkdsk needs to be run. No actual corruption has occured.

Neal Christiansen
NTFS Development Lead"

8 comments:

Anonymous said...

You're problem wouldn't happen to coincide with you using an external usb device like a digital camera by any chance?

The reason I ask is: I've been battling the same errors for the last 2 weeks on a rig I built for a mate. Built from scratch last month using new components & Windows 7 Pro 64bit, I worked on it for 3 weeks before he collected it. Up to that point it had been running flawlessly with no errors in the Event Viewer.

Since he started using it his logs are full of Event ID 55 Ntfs errors with CHKDSK running on most boots despite his machine otherwise running fine. I double checked all the hardware and ran Seatools on the hard drive thinking it might be failing but everything checked out ok.

He's a designer and amatuer photographer who uses his camera nearly every day. I suspected this could be related to the problem and a few hours ago my suspicions where confirmed when I transfered photos from my own camera to my pc.

Normally I immediately unplug it after transfer but this time I forgot & left it connected. An hour or so later I started to hear the Windows device connected/disconnected noise and realised what I'd done. I unplugged the camera (it's battery was now flat) and checked the Event logs, Event ID 55 was present for the first time since I installed Windows 7 back in October. Rebooted and you guessed it, for the 1st time my very own CHKDSK.

Now I've used this Olympus camera several times over the last few months without any problems but today was the first time I've A) connected it when the battery was nearly dead and B) forgot to unplug it after transfering the pics.

For the record, I'm using Avast and he's using Microsoft Security Essentials.

DisplayNameHere said...

The second time it happened, at the time of the event log message I was importing some photos from an SD card connected to a USB memory card reader (using the Windows wizard).

I've done that a few times afterwards without issue though. So hmmm....

Anonymous said...

Thanks for letting me know. Used the camera again today with no problems so I'm still scratching my head over this. After Googling some more and seeing others mention having the same problem after importing, I'm thinking it's just a mildly annoying and worrying Windows 7 bug. I'll tell my mate to try disabling his MSE real-time protection when he's importing pics and see how he gets on.

Cheers.

Roll on SP1, quick as you like please Microsoft.

DisplayNameHere said...

Ahha - I tried importing some photos and it happened again (this time it displayed an error as well).

That was with MSE real-time protection on. That could still be a red herring, I'll do some more testing with it off..

Anonymous said...

I've been seeing this problem for 3 months now. As others have said, it is caused when I transfer pictures from my camera using "picture options" + "import pictures and videos using Windows". It seems to only happen if I transfer several pictures at once (2 or 3 does not seem to trigger it). I am using MSE antivirus. There is definitely a connection with the antivirus software and event ID 55. If I tell MSE not to scan the USB that the camera is using then the problem does not occur. (The fault is not with MSE per se. The problem occurred more frequently when I was using ESET.)

Unknown said...

Actually I'm really glad this blog is here. I have had the same error 55 reported by ntfs. But there's nothing wrong with the volume according to chkdisk. Also I verified which device the eventlog is referencing with this tool "WinObj v2.15" (link below) cause it just says /device/harddiskvolume2 (on my system one of the add on sata controllers is addressed first, even though I turned it on after windows 7 was installed).

for the object viewer go here:
http://technet.microsoft.com/en-us/sysinternals/bb896657.aspx

as referenced here: http://www.eggheadcafe.com/software/aspnet/32892917/determin-drive-letter-using-deviceharddiskvolume.aspx

This error usually occurs after I import photos from an SD card. The camera device seems to work (for cameras that windows 7 recognizes that way).

However I have run into several correlations researching this problem being related to antivirus as well.

So I can't really determine if the realtime protection is related to the problem, but I think if realtime protection (from any vendor) uses indexing then it may simply be a problem when the new files are indexed from a portable device on the target file system for the antivirus.

I'm on windows 7 x64 and I've tried importing images both with windows live and the windows picture importer. The difference is I'm running symantec norton 360 antivirus and not MSE.

This problem started when I got a new camera and had to start using a card reader instead of the portable device manager.

It's a hassle but at least now I know I don't have to replace my disk array or anything. I'm going to try disabling indexing for the disk and the card reader.

re: ntfs (55) "The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume" after importing pictures.

Anonymous said...

I had this problem too. When Using Kaspersky it resulted in hard failures to download photos. Repeated retries would eventually import, but multiple NTFS errors would appear for each. It was certainly worrying!

Once KIS was removed and MSE installed the errors were restricted to the system log, plus of course the chkdsk on reboot.

I installed MS Hotfix 982927 as referenced in the Technet article and it works! I have checked on the Windows 7 SP1 RC Hotfix list and this fix is there, so it looks like all will be good once SP1 is released and, although your mileage may vary and the usual precautions should be taken, it appears the hotfix is a safe one to apply.

Serial - Goddess founder said...

Your running :

chkdsk C: /f

right?

Just because there has been an issue with chkdsk forever where if you don't run it with the /f flag it just simply doesn't run some checks. I remember it wound me up when I first found out because I was running check disk without the flag (thinking it would tell me if I needed to run with) and merrily being told all was ok even when I personally KNEW there was a fault.