5 February 2007

HD Replacement and Bad Cluster Markers

This is a common scenario...

  • Hard drive develops bad sectors
  • File systems have some clusters marked as Bad
  • You image partition(s) from old hard drive to new replacement
  • New hard inherits bad cluster markers that are now inappropriate
...that can present in interesting ways, if file system is NTFS:

  • BING images the sick hard drive OK
  • BING images the contents to new hard drive OK
  • You use BING to shrink the partition
  • BING checks the file system OK
  • BING shrinks the file system OK
  • BING re-checks the file system, and fails!
The FATxx equivalent is more like this:

  • BING images the sick hard drive OK
  • BING images the contents to new hard drive OK
  • You use BING to shrink the partition
  • BING checks the file system, fails!
  • You manually clear bad cluster markers
  • You use BING to shrink the partition
  • BING checks the file system OK
  • BING shrinks the file system OK
  • BING re-checks the file system OK

What is going on here? Well, it depends on the file system.

With FATxx, BING sees the bad cluster markers when it checks the file system before it attempts the resize, "sees" the bad cluster markers inherited when the file system was imaged off the old hard drive, and backs out of the resize. Only when you clear these bad cluster markers (as you should) will BING attempt the resize, and will then generally succeed.

With NTFS, BING fails to see the bad cluster markers and is happy to resize the volume, which is dangerously inappropriate if the volume is still on the sick hard drive. NTFS points to bad clusters by cluster address; if these point beyond the end of the file system after the partition is shrunk, they are seen as invalid by BING's post-resize file system check.

Clearing Bad Cluster markers in FATxx

If there's a better way, I haven't found it! What I do is edit the file system on the new hard drive using ye olde Norton Disk Edit, selecting the two FATs in different panes, searching these for the raw byte sequence that marks a bad cluster, and editing these to 0 (free cluster available for use). When done, a file system check can be expected to detect FAT32's boot record free space value to be incorrect, and I allow that to be fixed.

Obviously this is serious caveat territory, and I look up FAT details to see what the Bad Cluster value is, and then run into byte-order toe-stubbers while searching for these. Norton Disk Edit runs from DOS or a Win9x DOS mode, and DOS can't safely "see" beyond 137G, so more caveats there.

Clearing Bad Cluster markers in NTFS

I haven't found an easy way to do this, but the process is documented at Katy's Homepage - so if you know of any free tools that can automate this, please comment with details!

If the Bad Cluster pointer is invalidated by shrinking the NTFS volume or partition, as described above, then the invalidated pointer will be "fixed" (cleared?) by ChkDsk /F

The problem is those Bad Cluster records that remain valid, and thus are not cleaned up by ChkDsk /F, or (if marked clusters are not re-tested) by ChkDsk /R.

1 comment:

Michael said...

Thanks for your nice post!