Wednesday, July 22, 2009

Don’t run Chkdsk!

Data Recovery Tech Tip # 1

Don’t run Chkdsk!!!

There are tonnes of myths about data recovery techniques and tips. Like the freezer trick or my personal favorite: the bang-your-hard-drive-as-hard-as-you-can-on-a-desk trick! Go ahead, Google those, you’ve find them and tones of other weird ones. I’d like to just write an article to debunk yet another data recovery statement everyone seems to make when they are trying to do-it-yourself recovery.

Chkdsk (Pronounced check disk)

Myth - Look, It's a failed hard drive, let’s run Chkdsk! It will recover the data!!!

My Answer - No Don’t!

Chkdsk is a windows utility that creates and displays a status report for the disk. The chkdsk command also lists and corrects errors on the disk.

I can’t count the number of drives that come in for data recovery that has been chkdsk’d. This windows application will check file system integrity but not care about user data. And how do I know that a drive has been chkdsk’d?

You know right away when you see this.



Why write down all the reasons when I’ve found a great technical article and I couldn’t say it better my self.

Chkdsk: Life-Saver or Disk-Drive Killer?

http://www.interdatarecovery.com/index.php/chkdsk-life-saver-or-disk-killer

I did get verification from Microsoft TechNet as to exactly what it does. You can read it below, basically what it says is that user data is not prioritized, the stability of the file system is! Using this application to logically fix what sometimes is a physically damaged hard drive can result in what's most important being lost, your data! (Caution: Below I’ve included some facts about Chkdsk but it gets seriously technical).

So Basically, My point is this.. For all you Do-it-Yourself-ers, technical dabblers or even tech shops that are running chkdsk in the hopes of saving your clients data! Think twice! On an already failed disk, you may make more problems than you fix. In most cases I’ve seen chkdsk ruin any chance of recovering some of your client’s most important files (like the outlook mail .pst or .dbx files).

Know your facts about Data Recovery!!!

Save those files!!!

Call us first!!!

RecoverMyPC.com

As Promised, Below is my technical findings on why Chkdsk is bad for you!

Chkdsk is a windows utility that creates and displays a status report for the disk. The chkdsk command also lists and corrects errors on the disk.

Source: Mircosoft.
http://technet.microsoft.com/en-us/library/bb491051.aspx

CHKDSK's activity is split into three major "stages" during which it examines all the "metadata" on the volume and an optional fourth stage. Metadata is "data about data." It is the file system overhead, so to speak, that is used to keep track of everything about all of the files on the volume. Metadata tells what allocation units make up the data for a given file, what allocation units are free, what allocation units contain bad sectors, and so on. The "contents" of a file, on the other hand, is termed "user data." NTFS protects its metadata through the use of a transaction log. User data is not so protected.


CHKDSK examines each file record segment (FRS) in the volume's master file table (MFT). Every file and directory on an NTFS volume is uniquely identified by a specific FRS in the MFT.



During its second stage, CHKDSK displays a message on the screen saying that it is verifying indexes and counts from 0 to 100 percent complete a second time. During this phase, CHKDSK examines each of the indexes on the volume. Indexes are essentially NTFS directories and the percent complete that CHKDSK displays during this phase is the percent of the total number of directories on the volume that have to be checked. During this stage, CHKDSK examines each directory on the volume for internal consistency and also verifies that every file and directory represented by an FRS in the MFT is referenced by at least one directory. It also confirms that every file or subdirectory referenced in each directory actually exists as a valid FRS in the MFT and checks for circular directory references. Finally, it confirms that the various time stamps and file size information associated with files are all up-to-date in the directory listings for those files. At the end of this phase, CHKDSK has ensured that there are no "orphaned" files and that all the directory listings are for legitimate files. An orphaned file is one for which a legitimate FRS exists, but which is not listed in any directory. When an orphaned file is found, it can often be restored to its rightful directory, provided that directory is still around. If the directory that should hold the file no longer exists, CHKDSK will create a directory in the root directory and place the file there. If directory listings are found that reference FRSs that are no longer in use or that are in use but do not correspond to the file listed in the directory, the directory entry is simply removed.



It should be pointed out that NTFS does not guarantee the integrity of user data following an instance of disk corruption -- even when a full CHKDSK is run immediately after corruption has been detected. Thus, there may be files that CHKDSK cannot recover. Also, files that are recovered may be internally corrupted even after CHKDSK has been run. It, therefore, remains vitally important that mission critical data be protected by means of a regimen of periodic backups or other robust disaster recovery methodology.

Source: Microsoft
http://support.microsoft.com/kb/187941

Have any computer related questions, you can use our facebook page, our website which has tonnes more articles and content www.recovermypc.com or contact us directly at info (at) recovermypc (dot) com

No comments:

Post a Comment