Where did recovered files or directories go? [solved]

[mxnerd]

As title.

One of my Windows 7 NTFS volume went corrupted, I let Windows fix the volume at boot up. I saw messages of thousands of files being converted to directories. But when I went back to the machine after several hours, I could not find any said directories under the volume using Windows Explorer.

Where did those files go? I have turned on the option to show all hidden files.

Thanks.

 

[kleinkinstein]

Hmmm, something smells awry. Try Everything to find and locate.

 

[mxnerd]

Thanks. But still can't find anything. It's really weird.

 

[mxnerd]

Windows tells me my NTFS volume gets corrupted yet again. I rescan the volume and let Windows fix NTFS, and like last time, tons of error message saying that recovered orphaned files has been converted into directory files. And I could not find any after reboot!

Last time the NTFS volume could have been caused power outage, but this time no power outage at all! I used Hitachi disk diagnostics utility and could not find any errors, what exactly is happening here?

Every time it happens the disk gets slow. That's when I look at the event logs.

This is a 3TB volume, wondering if there is any 3TB related system problems?

 

[Elixer]

What does the event log say?

 

[mxnerd]

Event log message:
"The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume Hitachi 3TB GPT DATA_VOL."

3 times in 3 minutes yesterday evening.

After scanning and fixing NTFS at boot up, no more NTFS errors.

But I really don't know when I will catch another NTFS error.

 

[imagoon]

If chkdsk thinks it found something it goes in <driveletter>\found.000 (or .001 etc depending on the number of runs). They are hidden so turn on viewing hidden and system files.

 

[mxnerd]

I have turned on showing all hidden and system files, just couldn't find any found.xxx folder.

It sounds weird, but I start to wonder whether it's caused by Realtek HD audio driver.

I installed Realtek HD audio driver a few days back, and I just noticed that whenever I was watching videos on NBA.com or Youtube.com, the audio playback starts to stutter now and then, and when it does that, the video stops a second or so and keyboard, mouse also stop responding.

I remember years back Realtek audio drivers causes BSOD, sudden shutdown and frozen system. I can't believe that the system still has similar symptom after I installed Realtek HD audio driver years later, even though I'm running on complete different hardware.

I uninstalled the Realtek HD driver and seems the system is more stable and no more video/audio stuttering. Will see. Just can't understand why Realtek drivers sucks so much while Microsoft driver works so well, what the hell the engineers at Realtek were doing after all these years?

 

[mxnerd]

Apparently I was wrong.

Did a reboot after Windows update, Windows told me the recycled bin gets corrupted, a different volume, but same disk. When I looked at the event log, it says NTFS gets corrupt again,

And I get a Kernel-EventTracing error. Session "WbadminUIInBuiltTracing" failed to start with the following error: 0xC0000035.

Don't really know what that means?

What's going on? I ran Hitachi disk utility's extended test and found nothing error. Has the cache on the disk gone bad?

Funny thing is, I didn't even touch that volume in the past few days.

No BSOD, no frozen system, no sudden shutdown.

 

[Elixer]

Apparently I was wrong.

Did a reboot after Windows update, Windows told me the recycled bin gets corrupted, a different volume, but same disk. When I looked at the event log, it says NTFS gets corrupt again,

And I get a Kernel-EventTracing error. Session "WbadminUIInBuiltTracing" failed to start with the following error: 0xC0000035.

Don't really know what that means?

What's going on? I ran Hitachi disk utility's extended test and found nothing error. Has the cache on the disk gone bad?

Funny thing is, I didn't even touch that volume in the past few days.

No BSOD, no frozen system, no sudden shutdown.

The HD isn't the only way for things to get corrupted.
I would run memtest86+ (note the +) overnight and make sure it has 0 errors.
If that is OK, then I would run OCCT or prime95 for 3-4 hours and they should also have 0 errors.

 

[mxnerd]

Don't know if it's NTFS table has been messed up, looks like Windows keeps recovering orphaned files which could just be deleted file entries and throw them into recycle bin and doing it over and over. Just could not find any so called recovered files/directories anywhere after chkdsk and reboot process.

Will do memtest overnight the coming days. It's really frustrating. No wonder MS Windows & INTEL's PC world is losing battleground.

 

[mxnerd]

Tested memory and no error.

I move the hard drive to another machine and use Hitachi utility and still no errors, but it reports the HD as 2TB, but the hard drive is actually 3TB! And I can' make sense of these numbers showing on the report.

Besides, I ran CHKDSK again in Windows, and this time I noticed CHKDSK said:

Repairing Usn Journal file record segment.
36052368 USN bytes processed.

What does that mean? Is the drive failing? But how come Hitachi utility keeps telling me the drive is good?

 

[imagoon]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>diskpart

Microsoft DiskPart version 6.1.7601
Copyright (C) 1999-2008 Microsoft Corporation.
On computer: XISTOS-PRIME

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          238 GB      0 B
  Disk 1    Online          298 GB      0 B
  Disk 2    Online         1863 GB      0 B        *

DISKPART>

Do that and post it here, please.

 

[mxnerd]

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          698 GB   552 GB
  Disk 1    Online         2794 GB  1024 KB        *   <---  this is the Hitachi 3TB disk

============

Check the warranty on Hitachi website, input the serial# and was told the serial is invalid. What the xxxx? I bought the disk at Fry's retail store with retail package.
Does WD void all Hitachi warranty after they bought Hitachi storage division?

 

[imagoon]

Ok good, they didn't do that odd ball MBR 3TB hack crap on you then. We are having a run of issues like that running VMWare workstation VM's on ESata / USB3. Wiping the drive and going GPT seems to fix it. It is very odd.

 

[mxnerd]

Wow, you hit the mark! Really thankful.

I was running VMware workstation 9.01 on the internal drive. I did think about it's possibility, but doubt it. Never experience this before.

So if I wipe the drive and reformat the drive, it's good to go? Or should I move to another drive for safety, I also got a Hitachi 2TB drive, maybe I should swap them so VMware run on this drive?

BTW, the serial# on the Hitachi retail package is different from what Hitachi disk utility reports. One is JM1311abcdefgh, and the other is abcdefgh0S03228, really don't know why Hitachi can mess with their serial# so badly?

 

[imagoon]

Oh really hmmm. Are you getting random vmdk corruption messages when you try to boot a VM?

The GPT thing isn't "proven" yet for us. It seems to have fixed it but it could be something as simple as the common VM's people are using moved to above the 2TB mark. I know one of the guys did open a VMWare ticket and from what I heard, the tech on the other end didn't seem to "get it." VMWare does use drivers for things like disk pass through, I wonder if it is related.

 

[mxnerd]

Oh really hmmm. Are you getting random vmdk corruption messages when you try to boot a VM?

Yes, and a lot. But I always think it's because of Windows NTFS itself or the motherboard, since I was replacing old motherboard with new one and swap things around.

I think I better move these VMs to 2TB drive and use MBR partitions. Thanks again.

Best,

 

[imagoon]

Yes, and a lot. But I always think it's because of Windows NTFS itself or the motherboard, since I was replacing old motherboard with new one and swap things around.

I think I better move these VMs to 2TB drive and use MBR partitions. Thanks again.

Best,

I'm not convinced it is GPT doing it. We have a ticket open with VMWare and it has made up to having engineers calling us and having us run some debug stuff. If I get a real answer I'll try to remember to let you know. 3TB MBRs are failing also (that fake out trick that WD / Seagate is going since MBR is 2TB only.)

 

[mxnerd]

Thanks imagoon. Really appreciated.

 

[mxnerd]

Hi imagoon. I think I found the culprit. It's the Intel SATA/RAID (Intel Rapid Storage Technology, IRST) driver!

I move the 3TB drive from the motherboard with new driver to the one without. Although the one without new IRST driver still recognize the drive as 3TB, yet it keeps corrupting the NTFS volume!

How did I find it out? Because I followed your advice and delete all partitions on 3TB drive, all of a sudden the system recognize the 3TB drive as 750GB drive! Till then I realized it could be driver problem.

When I checked the driver that comes with Windows, it showed the year is 2008. After I install the new driver, it was recognized as 3TB drive again.

So in my case it's Windows's old driver that can't properly detect 3TB drive, yet still happily let you continue to use it until NTFS gets corrupted. It shouldn't be VMware's fault.

Best,

 

[imagoon]

Hmmm, we are seeing it on USB. Might not be the same issue. Maybe I should try the chipset drivers for the heck of it.