NTFS creates an entry for each file and folder, listing the cluster(s) that contain its content. This error indicates NTFS was unable to read the entry — and most often there's nothing wrong with the content itself, just the location of the entry.
NTFS keeps a record of every file and folder in its master file table. If NTFS can't find the entry for a given file, then Windows will tell you that the file is corrupt, when in fact its contents are sitting perfectly intact a few clusters away.
chkdsk writes out a new file table making the file system internally consistent; therefore, chkdsk will eliminate entries it cannot resolve – that's the very same info a recovery would use.The wordage refers to your file. The problem almost always lies with the record describing it.
NTFS maintains a master file table — a "database" that has one entry per file/folder on the drive. Each entry provides information regarding the file or folder; including the file/folder's name, size, permissions and most important, which clusters on the disk store the files/folders' data.
Windows says that some file(s), or directories, have been corrupted and cannot be accessed. This does not mean the content of these files is missing. The content is still there in their cluster locations. It usually means NTFS could no longer find the pointer to those pieces of content.
That is why a single entry that has been damaged by some means can completely remove an entire "folder" tree from view. Directories (also known as folders) are files too. The contents of each directory file are simply a list of what items are located inside them. If you damage just one directory record then all of the contents located beneath it become completely unreachable in a single action while remaining physically on the disk.
It's very important to identify the reason for this error because it dictates how quickly this issue may be resolved, or whether it should be treated as a potential indicator of a larger hardware problem.
Caused by power loss, a system crash/forced shut down, or a device removal while Windows was writing to it. Most commonly found on working equipment, but typically only affects what was being written to when the interruption occurred.
There is a particular area on your storage that holds the master file table. If you get a "bad sector" error here but all other parts of the disk read fine — it's location that matters more than how many bad sectors exist.
USB devices and memory cards were removed from the system prior to Windows finishing writing them out. exFAT & FAT32 are much less redundant than NTFS therefore can handle this much worse.
When the error starts spreading across multiple files during a period of time measured in days or weeks then it's your hard drive failing and not an incident. This type of situation is where the symptoms reported by Windows are not what is wrong with your drive.
It is the order that makes the difference and nearly everybody always gets it backwards.
If possible, access your drive on a separate computer. Or, find another way to get into the folder. Sometimes, when there's something wrong with a directory reference, just going in from a different angle will avoid it altogether.
Back up anything that you can read, to a completely separate drive. In other words, copy off whatever you can, most important files first. The biggest mistake people make is skipping this step. And, it is the most important step.
The number of reallocated sectors and the number of pending sectors is all you need to know to determine if we're talking about an event or a failing drive. It makes all the difference in determining how to proceed after this point.
And only if your SMART report says you have no problems. On a good drive, chkdsk frequently fixes issues like this. It is what the utility was made for.
The most important thing to know about running it.
chkdsk is used to make a file system internally consistent. If it identifies a record that points to areas of the disk that do not make any sense, instead of trying to determine what the record should be saying; chkdsk will remove the record and mark the areas of the disk as "free". Afterwards, the volume will then be consistent (which is what it was designed to create).
For a single interrupted write on a healthy drive, this is a real solution, and any file you lose was already corrupted. However, if you use this tool on a drive with bad sectors located under your master file table, it may potentially scan across the damaged area, discarding entries as it moves through. Each item discarded is a file/folder that a data recovery service would have been able to rebuild based on existing information. People show up at this point after running chkdsk and find far fewer files than when they began.
NTFS has a backup copy of all key MFT (master file table) records. A data recovery process uses these and other redundant data found on the volume itself (instead of deleting them). This is performed against a read-only disk image. Therefore, whatever is being recovered cannot get any worse during this process. Individual drives in Manchester start from £300 +VAT, after a free 48-hour diagnostic.
NTFS is unable to read or interpret the entry for that particular file — not because the information within the file has been harmed. The data is generally located within its clusters unharmed — however the entry that points to it is now broken.
Directories are also files; therefore, their content represents the list of items stored within them. Harm one directory record and instantly all the records beneath it become inaccessible. However, they remain on the physical disk.
Only after you check your SMART status and copy whatever you can. When running chkdsk, it will correct errors by deleting those records that it cannot reconcile — as long as the drive is healthy that is actually repairing the issue. But if there is a drive with bad sector areas then it may delete entries that a recovery would rebuild.
The most common cause of this type of failure is a partial write — i.e., when a power loss occurs during a write operation — e.g., power failure, unplugging the drive before completing a write operation, etc. Additionally, it may result from bad sectors under the master file table area, resulting in the error message while the rest of the drive appears to be reading fine.
Generally, yes, and often completely. NTFS maintains back-up versions of all key information about how the file system was laid out. Therefore, in order to rebuild the layout instead of deleting any data, you are generally able to recover from these backups. Since recovery occurs within a read-only version of the file system, there is no risk that anything will become worse as part of attempting to do the recovery.
Pay attention to if it spreads. An event such as a single folder becoming corrupted due to a sudden loss of power is different from seeing the exact same error appear across multiple files for many days or weeks — then you have a disk that’s failing — check reallocated and pending sector counts.