Run ChkDsk, get this error at the end: "The second NTFS boot sector is unwriteable."

[Dankk]

I ran a full ChkDsk on my D: drive (2TB Seagate Barracuda Green, storage only, Windows is not installed on it), and although the check seemed to go fine through all five steps, I received this error at the end:

Write failure with status 0xc0000010 at offset 0x1d1c0effe00 for 0x200 bytes.
The second NTFS boot sector is unwriteable.

Internal Info:
00 ae 06 00 cd ad 06 00 0e 16 0c 00 00 00 00 00  ................
c4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

My computer seems to be performing fine; I have no reason to think there are any problems with it, other than the error I received above. What does this mean? What is the "second NTFS boot sector", and why is it unwriteable? Is something wrong with my hard drive?

Sorry, I'm not terribly well-versed when it comes to hard drives and storage, so if someone could explain in simple terms what might be happening, and what I can do to fix it, I would appreciate it a lot.

I'm especially confused about the "boot sector" part, because I'm definitely not booting from this drive. Windows is installed and boots from a totally separate SSD. Thanks.

 

[Nothinman]

Any portion of a drive being unwriteable is a bad sign. Are there any errors in the eventlog?

 

[Dankk]

Any portion of a drive being unwriteable is a bad sign. Are there any errors in the eventlog?

There are some errors in the event log, but I don't think I see anything related to a bad hard drive. What kind of errors should I be looking for?

 

[MarkLuvsCS]

I'd backup any important data immediately and download Seatools to run a full drive test. It will take several hours, but you will find out what Seagates diags tell you.

 

[Dankk]

I'd backup any important data immediately and download Seatools to run a full drive test. It will take several hours, but you will find out what Seagates diags tell you.

Thanks for the suggestion; I'll run a full drive test tonight. I already have SeaTools installed and have done a couple of short tests which came up clean. I'll do a long one next and report back.

If anyone else has any other advice, I'd appreciate it a lot.

 

[taltamir]

run chkdisk again? maybe it was just a singular bad sector that got reallocated.

 

[Dankk]

Alright, I ran a long generic test on the drive in Sea Tools. Took ~5 hours. It passed.

I should also mention that I defragged the drive too before running the test. Defraggler reports that the drive is in good health. I've been checking SMART info, and it all reports good. So far, this hard drive has passed every diagnostic test I've thrown at it.

run chkdisk again? maybe it was just a singular bad sector that got reallocated.

I suppose I could, although that will take another several hours. I feel like I'll wear out the drive prematurely if I keep running all these checks. I'll certainly run chkdsk again soon though.

Anything else I should try?

 

[taltamir]

Don't worry about wearing it out.
Do make sure you have working backups before playing with it though

 

[Dankk]

I was under the impression that running chkdsk too much in a short period of time causes extensive wear on the drive. Thanks for the assurance, Taltamir.

Per your advice, I ran chkdsk again. Unfortunately it's pulling up the same error at the end (albeit with slightly different "internal info", but everything else is the same):

Write failure with status 0xc0000010 at offset 0x1d1c0effe00 for 0x200 bytes.
The second NTFS boot sector is unwriteable.

Internal Info:
00 af 06 00 f4 ad 06 00 4c 16 0c 00 00 00 00 00  ........L.......
cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Keep in mind, chkdsk appears to be verifying everything totally fine before this error actually appears. I'll post the full log just for reference:

Checking file system on D:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  438016 file records processed.                                          File verification completed.
  2 large file records processed.                                      0 bad file records processed.       0 EA records processed.                                             
0 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...
  474862 index entries processed.                                         Index verification completed.
  0 unindexed files scanned.                                           0 unindexed files recovered.                                       
CHKDSK is verifying security descriptors (stage 3 of 5)...
  438016 file SDs/SIDs processed.                                         Security descriptor verification completed.
  18423 data files processed.                                            CHKDSK is verifying file data (stage 4 of 5)...
  438000 files processed.                                                 File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  225331118 free clusters processed.                                         Free space verification is complete.
Write failure with status 0xc0000010 at offset 0x1d1c0effe00 for 0x200 bytes.
The second NTFS boot sector is unwriteable.

Internal Info:
00 af 06 00 f4 ad 06 00 4c 16 0c 00 00 00 00 00  ........L.......
cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Anything else I should try?

 

[SunnyD]

Try this:

- Preferably, if you haven't already BACK UP YOUR DATA IF IT'S IMPORTANT TO YOU

- Go into LDM (Disk Management... right click on Computer --> Manage)
- Right Click on your D: drive
- Select "Shrink Volume..."
- Wait patiently for it to query the drive
- Enter in a value slightly smaller than the total size of the drive (perhaps like 1GB less than total)
- Click "Shrink" and let Windows resize the volume (this may take a while)
- Once done, run CHKDSK again and see if the problem persists

If at this point the problem is gone, then you can go back and do the reverse by selecting "Extend Volume" from the right click context menu and extending the volume back to the end of the drive. Once done, run CHKDSK again and see if the problem reappears.

If the problem does persist or does reappear, you likely have some unmapped bad sectors that the drive isn't picking up and flagging, and your best bet would be to do a full diagnostic and full surface defect scan with something like SeaTools or WDTools to see if the drive may need to be replaced or repaired.

 

[Dankk]

Thanks for the help SunnyD, I googled around and discovered that same solution, and now would certainly be a good time to try it... but...

Unfortunately I think I'm just going to have to do a full reformat. This is what happens when I try to shrink the volume in Windows disk manager:

Doesn't let me shrink it at all. Not even a little. Ok; I thought maybe Windows is just being stubborn, so I installed Acronis Disk Director and tried to shrink it there. Uh-oh:

If Acronis says it's corrupt, then that's enough for me. Time to just give in and reformat. I have everything backed up on an external hard drive, so I think I'm good for now. I'll do a full format and before transferring everything over, I'll run another ChkDsk on the empty reformatted drive. If there's no errors, then good. If there's still errors, then I suspect I have a bad drive.

I'll report back and let you guys know what happens.

 

[taltamir]

AFAIK the second sector (the one with issues) contain FS info.
Chkdsk tries to modify it probably to make some changes and fails.
I don't know why the HDD is not reallocating this sector though...

I would suggest deleting all partitions, running a bad sector scan, and then repartition, full format, and run chkdsk again.

If it is still doing it then RMA the drive.

 

[SunnyD]

AFAIK the second sector (the one with issues) contain FS info.
Chkdsk tries to modify it probably to make some changes and fails.
I don't know why the HDD is not reallocating this sector though...

I would suggest deleting all partitions, running a bad sector scan, and then repartition, full format, and run chkdsk again.

If it is still doing it then RMA the drive.

Sometimes the drive will mark the sectors, but the OS doesn't update the table (could even be because the OS "can't" for the same reason the table is unwriteable).

My guess, based on what LessThanDan said about trying to shrink the volume being not possible because it's corrupt means the drive itself is failing.

If the drive is "disposable" at this point, which it sounds like it is, then yeah you have nothing to lose by formatting it. Still, I'd run something like SeaTools (or preferably whatever manufacturer diagnostic is available for that particular brand of drive) and do a full diagnostic on the drive. That way if there is something physically wrong with the drive, the diagnostic will give you a code that you can cut to the chase with and include with the RMA request (if still under warranty) and expedite things along instead of adding extra steps.

The other reason I suggest it before formatting away, if the drive has bad sectors on it, it has been my experience that once bad sectors start showing up, they usually end up growing over time. Formatting and thinking remaps will alleviate things is only a bandaid - the drive, once it has bad sectors, will usually get more bad sectors fairly quickly and you'll be back at square one.

 

[Dankk]

Woohoo!

I believe I solved it.

First of all, I tried full-reformatting the drive with the built-in Windows format tool. This took several hours, and unfortunately, only lead to failure. When the progress bar reached the end, it gave me an error: "The format could not be completed" or something like that. Tremendous waste of time. Also a bit disturbing that it couldn't complete a regular format for whatever reason.

I then followed taltamir's advice (kinda). I opened up Acronis Disk Director and deleted the partition completely. I then re-allocated and re-partitioned the the empty space, and reformatted in NTFS as a Primary Active volume.

For whatever reason, by default, Acronis left a couple of megabytes of space unallocated. I'm not sure if this is note-worthy or not. Maybe this is the section of the hard drive that is bad? Regardless, the volume is fully formatted and re-created now.

I ran a chkdsk D: /r, and success!

Windows has checked the file system and found no problems.

1948494844 KB total disk space.
     21588 KB in 7 files.
        16 KB in 14 indexes.
         0 KB in bad sectors.
    125664 KB in use by the system.
     65536 KB occupied by the log file.
1948347576 KB available on disk.

      4096 bytes in each allocation unit.
 487123711 total allocation units on disk.
 487086894 allocation units available on disk.

Another observation: My hard drive has suddenly become quieter now. A lot quieter. It was making very loud noises earlier when in use, and they seemed to have stopped. Probably not a coincidence...

If the drive is "disposable" at this point, which it sounds like it is, then yeah you have nothing to lose by formatting it. Still, I'd run something like SeaTools (or preferably whatever manufacturer diagnostic is available for that particular brand of drive) and do a full diagnostic on the drive. That way if there is something physically wrong with the drive, the diagnostic will give you a code that you can cut to the chase with and include with the RMA request (if still under warranty) and expedite things along instead of adding extra steps.

The other reason I suggest it before formatting away, if the drive has bad sectors on it, it has been my experience that once bad sectors start showing up, they usually end up growing over time. Formatting and thinking remaps will alleviate things is only a bandaid - the drive, once it has bad sectors, will usually get more bad sectors fairly quickly and you'll be back at square one.

This is the only thing that scares me. Do you guys think my hard drive will work fine for now, or will it start having problems again? The long generic test in Sea Tools came up clean, so I'm not sure what to think about that. I bought the hard drive just recently (a couple weeks ago) so if you think I should RMA it for a store replacement, now would be the time to do it since it's still under warranty.

 

[taltamir]

The little bit of free space left is just fine. AFAIK it has to do with alignment.

It sounds to me like the HDD just has a single bad sector in an unfortunate location was causing the various tools to have issues. And that deleting the partition and recreating it allowed it to properly remap now.

I don't believe you will have further issues. But I would still make sure to keep backups of everything.

 

[SunnyD]

Another observation: My hard drive has suddenly become quieter now. A lot quieter. It was making very loud noises earlier when in use, and they seemed to have stopped. Probably not a coincidence...



This is the only thing that scares me. Do you guys think my hard drive will work fine for now, or will it start having problems again? The long generic test in Sea Tools came up clean, so I'm not sure what to think about that. I bought the hard drive just recently (a couple weeks ago) so if you think I should RMA it for a store replacement, now would be the time to do it since it's still under warranty.

Quieter means one of two things.

#1 - you have a fresh drive, so everything is laid down sequentially and contiguously for easy access.

and/or

#2 - you had bad sectors flagged on the drive and they were remapped, causing the head to have to seek elsewhere for the data constantly. Reformatting should reorganize this a bit better so #1 works out on the file system level a lot smoother.

Probably more #1 than #2 if you're constantly adding and deleting from the drive.

If diagnostics came back okay on the drive, then you're probably okay. Just keep it in the back of your mind if you start running into more problems down the road (corrupt files, similar problems, etc). Not saying it will happen, just keep an eye out. I haven't had terrible luck with hard drives, but the few I've had that spawned bad sectors in the past - my experience has been once they show up they only get worse over time. Your situation seems to be slightly different, since they never actually showed up physically on the diagnostics. They just manifested themselves in an odd way. Hopefully just a fluke.

 

[Dankk]

Hey guys,

While chkdsk is reporting that it has "checked the file system and found no problems", there is still something I've noticed from the logs that I want to point out.

When I fixed my initial problem and had my first successful disk scan the other day, there was something else strange happening in the log:

CHKDSK is verifying security descriptors (stage 3 of 5)...

256 file SDs/SIDs processed.
Cleaning up 1 unused index entries from index $SII of file 0x9.
Cleaning up 1 unused index entries from index $SDH of file 0x9.
Cleaning up 1 unused security descriptors.
Security descriptor verification completed.

I'm not sure what these "unused index entries" are. Whatever they were, the disk check apparently fixed them (or "cleaned" them). Well, can't be that big of a deal, right? But I ran another chkdsk, and it did the same thing yet again.

Except this time, it found four of them:

CHKDSK is verifying security descriptors (stage 3 of 5)...

417536 file SDs/SIDs processed.
Cleaning up 4 unused index entries from index $SII of file 0x9.
Cleaning up 4 unused index entries from index $SDH of file 0x9.
Cleaning up 4 unused security descriptors.
Security descriptor verification completed.

Is this something I should be worried about? The fact that I ran two different scans, and it had to clean these "unused index entries" in each scan kind of makes me nervous.

Although... I decided to do some Googling, and found this post: http://answers.microsoft.com/en-us/...ed-index/7adf0d5a-5992-4abb-ad94-2b0ecfe0d24f

People say it's nothing to worry about, but... can I get some confirmation? I'd sleep better at night if I could get some sort of validation from one of the knowledgeable people here on the forums.

Thank you SunnyD and taltamir, this help means a lot to me.

 

[mikeymikec]

Those last chkdsk logs are nothing to worry about. You may even get figures in the thousand mark for the number of unused index entries, it's not a problem. In theory they ought to be taken care of during the normal course of using a computer (e.g. clean shut downs and no system reliability issues), but file systems aren't managed in a 100% foolproof way, so a bit of cleaning up is sometimes required.

I personally feel that if a full chkdsk is run say every year or two (assuming no system reliability issues), it can potentially stop a minor uncorrected file system issue snowballing into something quite ugly (but still fixable with a full chkdsk). However with drives getting bigger and a full chkdsk taking significantly longer, it's not something I do as much as I used to.

Back to the original topic - it's nice, in a way, that the original issue has disappeared essentially, though I wouldn't put a great deal of trust in that drive. Make sure that you've got necessary data backed up. I probably would run a disk check in a year or so's time (assuming no further issues in the course of normal usage). My trust in the drive would be steadily built up after say two years without problems.

Even before the original problem disappeared, I would put a strong bet that the drive would not be accepted for an RMA as SeaTools passed it (I've dealt with drive warranty support on a few occasions, and I've seen blatantly dodgy drives pass the SeaTools long test).

I wonder if some program had messed with the partition structure on that disk in a way that chkdsk couldn't handle. I would be surprised if it was Seagate's fault, but maybe something weird happened during the final stages of Seagate producing the drive. Did the drive arrive unpartitioned or not? I'm always suspicious when I receive a 'new' internal hard disk with a partition structure.

 

[georgi984]

you can try the trial version of this program:
http://www.hdsentinel.com/download.php
i personally find it useful

 

[jolancer]

He said its only a couple weeks old. He probably wouldn't need to RMA it to MFG. just return it for exchange... Thats what I'd do, better safe then sorry.

I was wondering the same thing if it came partitioned, but i guess weather he partitioned it or it came like that, its still loose loose.... Unless the explenation being that He partitioned it himself with some flaky odd partitioning program?

just outa curiousity you could fun a full secctory scan using MHDD

EDIT: Oh yeah about your last couple chkdsk log entries... Like others have said those arn't a big deal, but just my opinion i personally find it odd considering you just clean reformatted the entire disk, I wouldnt expect any of those errors unless it was used for a while at least

EDIT: oh also just fyi, scanning and or reformatting the drive over and over again does not wear down the drive any more then normal operation. and just for the heck of it though its not much of a compairision, i just checkdisked my 90gb data partition an it only came up with 2 index+2 security discrepencys, the last time i scanned my disk coulda been over ~6months ago

 

[taltamir]

He said its only a couple weeks old. He probably wouldn't need to RMA it to MFG. just return it for exchange... Thats what I'd do, better safe then sorry.

Oh, I didn't notice that...
Yea if its so new I would RMA it.

 

[murphyc]

You're better off writing zero's to the whole disk, or finding a tool (linux hdparm command) to issue the ATA Secure Erase command to the disk. This will cause bad sectors to be removed from use. Then you can create NTFS fast, instead of it keeping track of bad blocks/clusters (if 1 sector is bad, NTFS will remove the whole cluster that sector is in from use). Firmware block reallocation is permanent, unlike the file system doing it.

 

[Dankk]

You're better off writing zero's to the whole disk, or finding a tool (linux hdparm command) to issue the ATA Secure Erase command to the disk. This will cause bad sectors to be removed from use. Then you can create NTFS fast, instead of it keeping track of bad blocks/clusters (if 1 sector is bad, NTFS will remove the whole cluster that sector is in from use). Firmware block reallocation is permanent, unlike the file system doing it.

1) What tool would you recommend for zeroing out the disk?

2) Chkdsk (and other utilities) are reporting that my hard drive is in good shape. I apologize for my lack of knowledge in this subject, but what further good will be done by writing zeros to the disk?

3) Is this better than using MHDD as the above poster suggested? MHDD looks like it could be a helpful tool, but it looks a bit intimidating to understand and use.

Another note: I opened up Acronis Disk Director today, and noticed that apparently my hard drive gained ~4GB of unallocated space for no apparent reason. A couple days ago, it was only a couple of megabytes. I never shrunk/resized the volume; this just happened all of the sudden. What's going on here?

And how strongly do you feel that I should just return my hard drive for a replacement while my Newegg store warranty is still good? :\

 

[murphyc]

1) What tool would you recommend for zeroing out the disk?

Well I'm an OS X and Linux guy so I use dd for this, because I can zero parts of drives by LBA (or whole drives) and specify the block size so it goes faster than most GUI utils including Apples. But as long as you use a tools that for sure zeros the whole drive, that's sufficient. But before I'd pay money for a tool I'd download a Linux LiveCD and boot the computer from that. You get dd, smartctl to do SMART tests, and hdparm for issuing the ATA Secure Erase command.

Again, if you find a GUI tool that can issue the secure erase command I'd do that. It nukes everything and since the firmware does it, it's a lot faster than writing zeros through the interface.

http://mackonsti.wordpress.com/2011/11/22/ssd-secure-erase-ata-command/

2) Chkdsk (and other utilities) are reporting that my hard drive is in good shape. I apologize for my lack of knowledge in this subject, but what further good will be done by writing zeros to the disk?

a.) chkdsk actually checks only the file system, which while important, is only a small part of what's on a disk compared to your data.

b.) chkdsk by default may only check the NTFS journal, so it's fine to do that first, but then best to chkdsk /f to force a full check even if the journal is OK.

3) Is this better than using MHDD as the above poster suggested? MHDD looks like it could be a helpful tool, but it looks a bit intimidating to understand and use.

No idea, haven't used it.

Another note: I opened up Acronis Disk Director today, and noticed that apparently my hard drive gained ~4GB of unallocated space for no apparent reason. A couple days ago, it was only a couple of megabytes. I never shrunk/resized the volume; this just happened all of the sudden. What's going on here?

I have no idea based on the available information.

And how strongly do you feel that I should just return my hard drive for a replacement while my Newegg store warranty is still good? :\[/QUOTE]

Entirely up to you and what you find more convenient. This technote certainly gets you off the hook with Newegg and/or the manufacturer for an exchange:

http://technet.microsoft.com/en-us/library/cc975363.aspx

It says "or replace the disk". What I'd do is boot off a Linux CD, and blow away every sector on that drive with ATA Secure Erase. That's 2-3 hours of erase time, vs a trip to a store or having to ship the drive back. But that may be more convenient for you, rather than the hassle of dealing with tools you're just not familiar with or inclined to really use (when will be the next time you use such tools? and maybe you've got better things to do anyway!

 

[murphyc]

1) What tool would you recommend for zeroing out the disk?

Well I'm an OS X and Linux guy so I use dd for this, because I can zero parts of drives by LBA (or whole drives) and specify the block size so it goes faster than most GUI utils including Apples. But as long as you use a tools that for sure zeros the whole drive, that's sufficient. But before I'd pay money for a tool I'd download a Linux LiveCD and boot the computer from that. You get dd, smartctl to do SMART tests, and hdparm for issuing the ATA Secure Erase command.

Again, if you find a GUI tool that can issue the secure erase command I'd do that. It nukes everything and since the firmware does it, it's a lot faster than writing zeros through the interface.

http://mackonsti.wordpress.com/2011/11/22/ssd-secure-erase-ata-command/

2) Chkdsk (and other utilities) are reporting that my hard drive is in good shape. I apologize for my lack of knowledge in this subject, but what further good will be done by writing zeros to the disk?

a.) chkdsk actually checks only the file system, which while important, is only a small part of what's on a disk compared to your data.

b.) chkdsk by default may only check the NTFS journal, so it's fine to do that first, but then best to chkdsk /f to force a full check even if the journal is OK.

3) Is this better than using MHDD as the above poster suggested? MHDD looks like it could be a helpful tool, but it looks a bit intimidating to understand and use.

No idea, haven't used it.

Another note: I opened up Acronis Disk Director today, and noticed that apparently my hard drive gained ~4GB of unallocated space for no apparent reason. A couple days ago, it was only a couple of megabytes. I never shrunk/resized the volume; this just happened all of the sudden. What's going on here?

I have no idea based on the available information.

And how strongly do you feel that I should just return my hard drive for a replacement while my Newegg store warranty is still good? :\

Entirely up to you and what you find more convenient. This technote certainly gets you off the hook with Newegg and/or the manufacturer for an exchange:

http://technet.microsoft.com/en-us/library/cc975363.aspx

It says "or replace the disk". What I'd do is boot off a Linux CD, and blow away every sector on that drive with ATA Secure Erase. That's 2-3 hours of erase time, vs a trip to a store or having to ship the drive back. But that may be more convenient for you, rather than the hassle of dealing with tools you're just not familiar with or inclined to really use (when will be the next time you use such tools? and maybe you've got better things to do anyway!