Upgrading and Repairing PCs

FAT File System Utilities

The CHKDSK, RECOVER, and SCANDISK commands are the DOS damaged-disk recovery team. These commands are crude, and their actions sometimes are drastic, but at times they are all that is available or necessary. RECOVER is best known for its function as a data recovery program, and CHKDSK typically is used for inspection of the file structure. Many users are unaware that CHKDSK can implement repairs to a damaged file structure. DEBUG, a crude, manually controlled program, can help in the case of a disk disaster—if you know exactly what you are doing.

SCANDISK is a safer, more automated, more powerful replacement for CHKDSK and RECOVER in Windows 9x/Me. Windows 2000 and XP do not include SCANDISK and instead have beefed up CHKDSK to handle NTFS.

If you are using MS-DOS 5.0 or older, the only disk testing utilities supplied with your version of MS-DOS are CHKDSK and RECOVER. To learn more about how CHKDSK works, see Upgrading and Repairing PCs, 11th Edition, included in electronic form on the DVD packaged with this book.

The RECOVER Command

The DOS RECOVER command is designed to mark clusters as bad in the FAT when the clusters can't be read properly. When the system can't read a file because of a problem with a sector on the disk going bad, the RECOVER command can mark the FAT so another file does not use those clusters. When used improperly, this program is highly dangerous. The RECOVER utility has not been included in DOS since version 5 and is not supplied in Windows 9x/Me because its functionality has been replaced by SCANDISK.

Caution Be very careful when you use RECOVER. Used improperly, it can do severe damage to your files and the FAT. If you enter the RECOVER command without a filename for it to work on, the program assumes you want every file on the disk recovered and operates on every file and subdirectory on the disk. It converts all subdirectories to files, places all filenames in the root directory, and gives them new names (FILE0000.REC, FILE0001.REC, and so on). This process essentially wipes out the file system on the entire disk. Do not use RECOVER without providing a filename for it to work on. This program should be considered as dangerous as the FORMAT command. RECOVER is so notorious for this behavior that older versions of the Norton Utilities had a "recover from DOS RECOVER" option that could sometimes undo the damage caused by improper use of RECOVER.

An improved version of RECOVER that recovers data from a specified file is only one of the command-line programs provided with Windows NT, 2000, and XP. To use this version of RECOVER, which works with both FAT and NTFS file systems, open a command prompt and enter the command as shown here:

RECOVER (drive\folder\filename)

For example, to recover all readable sectors from a file called Mynovel.txt stored in C:\My Documents\Writings, you would enter the following command:

RECOVER C:\My Documents\Writings\Mynovel.txt

Because the NT/2000/XP version of RECOVER requires you to specify a filename and path, it cannot destroy a file system the way the DOS RECOVER command could. However, you should not use wildcards with the NT/2000/XP version of RECOVER. Instead, specify a single filename as shown in this example, or use a third-party tool such as Norton Disk Doctor to check the drive and attempt data recovery from damaged files.

SCANDISK

You should check your FAT partitions regularly for the problems discussed in this chapter and any other difficulties that might arise. By far an easier and more effective solution for disk diagnosis and repair than CHKDSK and RECOVER is the SCANDISK utility, included with DOS 6 and higher versions, as well as with Windows 9x/Me. This program is more thorough and comprehensive than CHKDSK or RECOVER and can perform the functions of both of them—and a great deal more.

Note The equivalent of SCANDISK in Windows NT/2000 and Windows XP is called CHKDSK, but it is far more powerful than the old MS-DOS CHKDSK program. For more information on the old MS-DOS CHKDSK program, see Upgrading and Repairing PCs, 12th Edition, included in its entirety on the DVD accompanying this book.

SCANDISK is similar to a scaled-down version of third-party disk repair programs such as Norton Disk Doctor, and it can verify both file structure and disk sector integrity. If SCANDISK finds problems, it can repair directories and FATs. If the program finds bad sectors in the middle of a file, it marks the clusters (allocation units) containing the bad sectors as bad in the FAT and attempts to read the file data by rerouting around the defect.

Windows 9x includes both DOS and Windows versions of SCANDISK, which are named SCANDISK.EXE and SCANDSKW.EXE, respectively. Windows scans your drives at the beginning of the operating system installation process and automatically loads the DOS version of SCANDISK whenever you restart your system after turning it off without completing the proper shutdown procedure. You can also launch SCANDISK.EXE from a DOS prompt or from a batch file using the following syntax:

[View full width]
Scandisk x: [/a] [/n] [/p] [dblspace.nnn/drvspace.nnn]
x: - designator of the drive that you want to scan
/a - scans all local fixed hard disks
/n - noninteractive mode; requires no user input
/p - scans only, without correcting errors
/custom - runs Scandisk with the options configured in the [CUSTOM] section of the 
Scandisk.ini file
dblspace.nnn or drvspace.nnn - scans a compressed volume file, where nnn is replaced by 
the file extension (such as 001)

The SCANDISK.INI file, located in the C:\WINDOWS\COMMAND directory on a Windows system by default, contains extensive and well-documented parameters you can use to control the behavior of SCANDISK.EXE. Note that the options in the SCANDISK.INI file are applied only to the DOS version of the utility and have no effect on the Windows GUI version.

You also can run the GUI version of the utility by opening the Start menu and selecting Programs, Accessories, System Tools. Both versions scan and repair the FAT and the directory and file structures, repair problems with long filenames, and scan volumes that have been compressed with DriveSpace or DoubleSpace.

SCANDISK provides two basic testing options: Standard and Thorough. The difference between the two is that the Thorough option causes the program to scan the entire surface of the disk for errors in addition to the items just mentioned. You also can select whether to run the program interactively or let it automatically repair any errors it finds.

The DOS and Windows versions of SCANDISK also test the FAT in different ways. The DOS version scans and, if necessary, repairs the primary copy of the file allocation table. After this, it copies the repaired version of the primary to the backup copy. The Windows version, however, scans both copies of the FAT. If the program finds discrepancies between the two copies, it uses the data from the copy that it judges to be correct and reassembles the primary FAT using the best data from both copies. If the FAT information is not reconstructed correctly, some or all of your data might become inaccessible.

SCANDISK also has an Advanced Options dialog box that enables you to set the following parameters:

• Whether the program should display a summary of its findings

• Whether the program should log its findings

• How the program should repair cross-linked files (two directory entries pointing to the same cluster)

• How the program should repair lost file fragments

• Whether to check files for invalid names, dates, and times

Although SCANDISK is good, and is certainly a vast improvement over the old DOS CHKDSK, I recommend using one of the commercial packages, such as the Norton Utilities (included with Norton SystemWorks), for any major disk problems. These utilities go far beyond what is included in DOS or Windows.

Disk Defragmentation

The entire premise of the FAT file systems is based on the storage of data in clusters that can be located anywhere on the disk. This enables the computer to store a file of nearly any size at any time. The process of following a FAT chain to locate all the clusters holding the data for a particular file can force the hard disk drive to access many locations on the disk. Because of the physical work involved in moving the disk drive heads, reading a file that is heavily fragmented in this way is slower than reading one that is stored on consecutive clusters.

As you regularly add, move, and delete files on a disk over a period of time, the files become increasingly fragmented, which can slow down disk performance. You can relieve this problem by periodically running a disk defragmentation utility on your drives, such as the one included with Windows 9x. When you run Disk Defragmenter, the program reads each of the files in the disk, using the FAT table to access its clusters, wherever they might be located.

The program then writes the file to a series of contiguous clusters and deletes the original. By progressively reading, erasing, and writing files, the program eventually leaves the disk in a state where all its files exist on contiguous clusters. As a result, the drive is capable of reading any file on the disk with a minimum of head movement, thus providing what is often a noticeable performance increase.

The Windows Defragmentation utility provides this basic defragmenting function. It also enables you to select whether you want to arrange the files on the disk to consolidate the empty clusters into one contiguous free space (which takes longer). The Windows 98/Me version adds a feature that examines the files on the disk and arranges them with the most frequently used program files grouped together at the front of the disk, which can make programs load more quickly.

To show how defragmenting works, see the example of a fragmented file shown in Table 24.32.

Table 24.32. Fragmented File

Directory
Name	Starting Cluster	Size
PLEDGE.TXT	1002	2
USCONST.TXT	1000	4
FAT16 File Allocation Table
FAT Cluster #	Value	Meaning
00002	0	First cluster available
…	…	…
00999	0	Cluster available
01000	1001	In use, points to next cluster
01001	1004	In use, points to next cluster
01002	1003	In use, points to next cluster
01003	FFFFh	End of file
01004	1005	In use, points to next cluster
01005	FFFFh	End of file
…	…	…
65526	0	Last cluster available

In the preceding example, the file USCONST.TXT is fragmented in two pieces. If you ran a defragmenting program, the files would be read off the disk and rewritten in a contiguous fashion. One possible outcome is shown in Table 24.33.

Table 24.33. Defragmented File

Directory
Name	Starting Cluster	Size
PLEDGE.TXT	1004	2
USCONST.TXT	1000	4
FAT16 File Allocation Table
FAT Cluster #	Value	Meaning
00002	0	First cluster available
…	…	…
00999	0	Cluster available
01000	1001	In use, points to next cluster
01001	1002	In use, points to next cluster
01002	1003	In use, points to next cluster
01003	FFFFh	End of file
01004	1005	In use, points to next cluster
01005	FFFFh	End of file
…	…	…
65526	0	Last cluster available

Although it doesn't look like much was changed, you can see that now both files are in one piece, stored one right after the other. Because defragmenting involves reading and rewriting a possibly large number of files on your drive, it can take a long time, especially if you have a large drive with a lot of fragmented files and not very much free working space on the drive.

Third-party defragmentation utilities, such as the Speed Disk program included in the Norton Utilities, provide additional features, such as the capability to select specific files that should be moved to the front of the disk. Speed Disk also can defragment the Windows swap file and files that are flagged with the system and hidden attributes, which Disk Defragmenter will not touch.

Caution Although the disk-defragmentation utilities included with Windows and third-party products are usually quite safe, you should always be aware that defragmenting a disk is an inherently dangerous procedure. The program reads, erases, and rewrites every file on the disk and has the potential to cause damage to your data when interrupted improperly. Although I have never seen a problem result from the process, an unforeseen event—such as a power failure—during a defragmentation procedure can conceivably be disastrous. I strongly recommend that you always run a disk-repair utility, such as SCANDISK, on your drives before defragmenting them and have a current backup ready.

Windows NT 4.0 does not include a defragmentation utility, but Windows 2000 and Windows XP do include such a utility. Note that third-party defragmentation utilities available for recent and current versions of Windows, such as Golden Bow Systems' VoptXP (www.vopt.com), are often faster and offer more features than Windows's own defragmentation programs.

Third-Party Programs

When you get a Sector not found error reading drive C:, the best course of action is to use one of the third-party disk-repair utilities on the market, rather than DOS's RECOVER or even SCANDISK. The Norton Utilities by Symantec (also included in Norton SystemWorks) stands as perhaps the premier data recovery package on the market today. This package is comprehensive and automatically repairs most types of disk problems.

Norton Utilities and Norton SystemWorks

Programs such as Norton Disk Doctor can perform much more detailed repairs with a greater amount of safety. Disk Doctor preserves as much of the data in the file as possible and can mark the FAT so the bad sectors or clusters of the disk are not used again. These programs also save Undo information, enabling you to reverse any data recovery operation.

Disk Doctor is part of Symantec's Norton Utilities package, which includes a great many other useful tools. For example, Norton Utilities has an excellent sector editor (Norton Disk Editor) that enables you to view and edit any part of a disk, including the master and volume boot records, FATs, and other areas that fall outside the disk's normal data area. Currently, no other program is as comprehensive or as capable of editing disks at the sector level. The disk editor included with Norton Utilities can give the professional PC troubleshooter or repairperson the ability to work directly with any sector on the disk, but this does require extensive knowledge of sector formats and disk structures. The documentation with the package is excellent and can be very helpful if you are learning data recovery on your own.

Note Data recovery is a lucrative service that the more advanced technician can provide. People are willing to pay much more to get their data back than to replace a hard drive.

You also can create a rescue disk for restarting your system and testing the drive in case of emergencies, unerase accidentally deleted files (even if the Recycle Bin was bypassed), and unformat accidentally formatted drives.

Norton Utilities is now available in version 2003 as part of Norton SystemWorks 2003 (for Windows 98/Me/NT/2000/XP). SystemWorks 2003 also includes Norton Anti-Virus and Norton CleanSweep uninstaller; the Professional version also includes Norton Ghost disk imaging. Some of the programs provided with Norton Utilities are designed to be run from the command line or from a DOS prompt, such as the following:

• Norton Disk Doctor (NDD.EXE)

• Disk Editor (DISKEDIT.EXE)

• UnErase (UNERASE.EXE)

• UnFormat (UNFORMAT.EXE)

• Rescue Restore (RESCUE.EXE)

However, most Norton Utilities programs are designed to be run from within the Windows GUI. You must use the Windows GUI to work on NTFS-based drives. You should not use older versions of Norton Utilities, such as version 8.0 (designed for Windows 3.1 and MS-DOS), with 32-bit versions of Windows because of the possibility of data loss due to a lack of support for long filenames and large drives.

SpinRite 5

The SpinRite 5 program from Gibson Research (http://grc.com) provides testing of both IDE and SCSI hard drives as well as removable-media drives of all sizes that have FAT-type file systems, including FAT32. During testing, SpinRite 5 statistically analyzes hard-to-read disk sectors to determine their original contents; it then moves the data to a properly working area of the disk. This process takes longer than with a program such as DiskDoctor, but for heavily damaged disks and drives for which no backup is available, this process can be more successful at recovering data. Another handy feature of SpinRite 5 is its capability to query your drive's partition table to determine the disk geometry originally used to set up the disk. This enables you to access data on a disk even if the factory disk geometry values were not used to prepare the disk with FDISK and were not written down for future use.

File Systems and Third-Party Disk Utilities

The most important consideration when you purchase third-party disk utilities is to choose products that support your file system. For example, Norton Utilities supports both FAT (including FAT32) and NTFS files systems. On the other hand, SpinRite 5 supports all FAT file systems but not NTFS. Never use a disk utility not designed for your file system, and never use an out-of-date disk utility (designed for an earlier operating system) on your disk. In both cases, you could cause irreparable damage to the data on your drive.