• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 560
  • Last Modified:

How do i find a file that chkdsk says has a bad index entry

Windows 2003 server suddenly getting a NTFS error (system event ID 55) requiring that chkdsk be run.  The process always gives 'deleting an index entry from index $0 of file 25". Then it inserts an index entry into the same file.   How can I tell which file 'file 25' is ?  No more info about that particular file is given.

When this happens there are a lot of SRV error 2000, which I have not been able to find a resolution for, and the spooler service stops and restarts.  The service is used by our scanning solution.  Not sure whether the spooler is causing the corruption or the corruption is causing the service to stop.  Has anyone had this combination of issues?  Any help would be appreciated.
0
quaybj
Asked:
quaybj
  • 2
1 Solution
 
SandeshdubeyCommented:
Know way to know for sure what file is being deleted, in a windows file system, the files all have numbers, that particular one is file number 25, trying to translate that back to the name of the file is very hard to do.
More than likely that file was open and being written to when the power failed, so it gets scrambled, if chkdsk cannot reassemble/recover the file, then it will delete it so the entire file system does not have issues, but some times chkdsk will delete a critical system file, but it has no choice but to correct the file system.
You should let chkdsk run to completion.
I doubt the hard drive is failing, unless you start seeing "Sectors" being recovered during chkdsk.

Anyway, backup your critical data immediately. Then run chkdsk /f. To be on the safe side.
Also install the latest hotfix and Service Pack on the server.Get the SCSI/RAID firmware updated also check the h/w health from the vendor.

Refer this link also if it helps:
http://www.eventid.net/display.asp?eventid=55&eventno=1210&source=Ntfs&phase=1
0
 
quaybjAuthor Commented:
Sandeshdubey,

Thanks for your response.  I was afraid there would not be an easy way.  
I have run chkdsk /f several time, same file has the same problem, but so do others.  We are backed up.  No sectors being recovered.  Service pack is up to date, will check the firmware. It's not a cluster , and the file allocation size is ok, so i did not apply the hotfix from the article.

My next move is to move all the data off to a NAS, format the volume, and hope the corruption does not travel with it.
0
 
SandeshdubeyCommented:
Before you proceed with formating the volume you can proceed with chkdsk /r and check if the corruption is fixed.

Take the full server backup before you proceed with chkdsk /r.
0

Featured Post

Free recovery tool for Microsoft Active Directory

Veeam Explorer for Microsoft Active Directory provides fast and reliable object-level recovery for Active Directory from a single-pass, agentless backup or storage snapshot — without the need to restore an entire virtual machine or use third-party tools.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now