Solved

How do i find a file that chkdsk says has a bad index entry

Posted on 2011-09-09
3
524 Views
Last Modified: 2012-05-12
Windows 2003 server suddenly getting a NTFS error (system event ID 55) requiring that chkdsk be run.  The process always gives 'deleting an index entry from index $0 of file 25". Then it inserts an index entry into the same file.   How can I tell which file 'file 25' is ?  No more info about that particular file is given.

When this happens there are a lot of SRV error 2000, which I have not been able to find a resolution for, and the spooler service stops and restarts.  The service is used by our scanning solution.  Not sure whether the spooler is causing the corruption or the corruption is causing the service to stop.  Has anyone had this combination of issues?  Any help would be appreciated.
0
Comment
Question by:quaybj
  • 2
3 Comments
 
LVL 24

Expert Comment

by:Sandeshdubey
ID: 36515368
Know way to know for sure what file is being deleted, in a windows file system, the files all have numbers, that particular one is file number 25, trying to translate that back to the name of the file is very hard to do.
More than likely that file was open and being written to when the power failed, so it gets scrambled, if chkdsk cannot reassemble/recover the file, then it will delete it so the entire file system does not have issues, but some times chkdsk will delete a critical system file, but it has no choice but to correct the file system.
You should let chkdsk run to completion.
I doubt the hard drive is failing, unless you start seeing "Sectors" being recovered during chkdsk.

Anyway, backup your critical data immediately. Then run chkdsk /f. To be on the safe side.
Also install the latest hotfix and Service Pack on the server.Get the SCSI/RAID firmware updated also check the h/w health from the vendor.

Refer this link also if it helps:
http://www.eventid.net/display.asp?eventid=55&eventno=1210&source=Ntfs&phase=1
0
 

Author Comment

by:quaybj
ID: 36523925
Sandeshdubey,

Thanks for your response.  I was afraid there would not be an easy way.  
I have run chkdsk /f several time, same file has the same problem, but so do others.  We are backed up.  No sectors being recovered.  Service pack is up to date, will check the firmware. It's not a cluster , and the file allocation size is ok, so i did not apply the hotfix from the article.

My next move is to move all the data off to a NAS, format the volume, and hope the corruption does not travel with it.
0
 
LVL 24

Accepted Solution

by:
Sandeshdubey earned 500 total points
ID: 36526892
Before you proceed with formating the volume you can proceed with chkdsk /r and check if the corruption is fixed.

Take the full server backup before you proceed with chkdsk /r.
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question