NTFS is "dirty" - updated

User discussion and information resource forum for Image products.
Post Reply
borate
Posts: 112
Joined: Thu Oct 27, 2011 9:51 pm

NTFS is "dirty" - updated

Post by borate »

Installed fresh copy of 2.99.00 on Windows 10 C: - a "system/active/primary" partition. In Power Options, Fast Startup is disabled.

DRIVE 0 has Windows 7 loaded on C: That's it, but for the "system reserved" partition.
DRIVE 1 has Windows 10 loaded on C: It also has D: for data only, and a "system reserved" partition.

While using Windows 10 (drive 1), an image of its C: partition is written to its D: data partition.
Then, while booted into Windows 7 (drive 0) an image of the Win 10 C: partition is written to the same D: data partition on drive 1.

When the image written while in Win 10 is restored, it corrupts the NTFS. When the image of Win10 written while in Win 7 is restored there is no corruption.

This issue was first reported with Windows 8. If I did not have a dual-boot system it would force use of IFD or another alternative in order to image C:.

A suggested cause is that Win 10 "sees" the other O/S.
Perhaps, but back when XP and Windows 7 were set up to dual boot similarly, imaging Win 7 from within Win 7 did not corrupt the file system.
This behavior began when Win 8 replaced XP - same legacy dual boot situation, where the DOS screen prompts for which O/S to use.
Last edited by borate on Thu Mar 17, 2016 4:42 pm, edited 1 time in total.
TeraByte Support
Posts: 3598
Joined: Thu May 05, 2011 10:37 pm

Re: NTFS corruption - updated

Post by TeraByte Support »

Use PHYLock or VSS and use byte-for-byte validation. When you restore use
2.99-00 Image for Linux or Image for Windows boot disk. restore with byte
for byte validation. And you should probably run chkdsk /f on all drives.

Also, there being something marked dirty, wanting to run chkdsk or saying
not shutdown correctly is not corruption.


"borate" wrote in message news:11269@public.image...

Installed fresh copy of 2.99.00 on Windows 10 C: - a
"system/active/primary" partition. In Power Options, Fast Startup is
disabled.

DRIVE 0 has Windows 7 loaded on C: That's it, but for the "system reserved"
partition.
DRIVE 1 has Windows 10 loaded on C: It also has D: for data only, and a
"system reserved" partition.

While using Windows 10 (drive 1), an image of its C: partition is written to
its D: data partition.
Then, while booted into Windows 7 (drive 0) an image of the Win 10 C:
partition is written to the same D: data partition on drive 1.

When the image written while in Win 10 is restored, it corrupts the NTFS.
When the image of Win10 written while in Win 7 is restored there is no
corruption.

This issue was first reported with Windows 8. If I did not have a dual-boot
system it would force use of IFD or another alternative in order to image
C:.

A suggested cause is that Win 10 "sees" the other O/S.
Perhaps, but back when XP and Windows 7 were set up to dual boot similarly,
imaging Win 7 from within Win 7 did not corrupt the file system.
This behavior began when Win 8 replaced XP - same legacy dual boot
situation, where the DOS screen prompts for which O/S to use.

borate
Posts: 112
Joined: Thu Oct 27, 2011 9:51 pm

Re: NTFS is "dirty" - suggested operations completed

Post by borate »

TeraByte Support wrote:
> Use PHYLock or VSS and use byte-for-byte validation. When you restore use
> 2.99-00 Image for Linux or Image for Windows boot disk. restore with byte
> for byte validation. And you should probably run chkdsk /f on all
> drives.
>
> Also, there being something marked dirty, wanting to run chkdsk or saying
> not shutdown correctly is not corruption.

Thanks for the response and clarification on "corruption." That came from the Event Viewer, which reports...
"The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume J:."

Other partitions check out fine.
Per your instructions, created a Windows 10 image from within Windows 10 (drive 1) and saved it to that drive's data partition, D:, and then two tests were made...

#1: A restore from the Windows 7 drive (drive 0).
#2: A restore using the IFD restore CD.

Both had the same result: "the drive is dirty" - and required an extensive chkdsk /f
When this image is restored, extra verbiage that's never seen normally - "the restore is complete" (may not be exact wording) - appears on the screen prior to the usual acknowledgement that "the restore has completed successfully."

Just to be clear, in case the following has a bearing on this issue...

When Windows 10 is in use (drive 1) the Windows 7 drive appears as drive letter J:, which contains the Windows 7 O/S + programs, and some data files.
When Windows 7 is in use (drive 0) the Windows 10 drive appears as drive letters J: and K:, the O/S + programs, and the data only partitions respectively.

The DOS screen offers the choice to boot either. By default, Windows 10 boots, unless Windows 7 is manually chosen.

The fact that one O/S sees the drive that contains the other O/S is intentional, and has never caused any conflicts.
As mentioned earlier, when XP and Windows 7 were in a similar configuration, imaging Windows 7 while using Windows 7 never resulted in problems.
TeraByte Support
Posts: 3598
Joined: Thu May 05, 2011 10:37 pm

Re: NTFS is "dirty" - suggested operations completed

Post by TeraByte Support »

Sounds more like you either using RST hybrid setup in maximized mode (or
similar) or you perhaps have and old out of sync EMBR. Without any details
(ifw screen shots, log files, partinfo listing, system details, etc..) ,
can't point you directly where to look.

"borate" wrote in message news:11275@public.image...

TeraByte Support wrote:
> Use PHYLock or VSS and use byte-for-byte validation. When you restore use
> 2.99-00 Image for Linux or Image for Windows boot disk. restore with byte
> for byte validation. And you should probably run chkdsk /f on all
> drives.
>
> Also, there being something marked dirty, wanting to run chkdsk or saying
> not shutdown correctly is not corruption.

Thanks for the response and clarification on "corruption." That came from
the Event Viewer, which reports...
"The file system structure on the disk is corrupt and unusable. Please run
the chkdsk utility on the volume J:."

Other partitions check out fine.
Per your instructions, created a Windows 10 image from within Windows 10
(drive 1) and saved it to that drive's data partition, D:, and then two
tests were made...

#1: A restore from the Windows 7 drive (drive 0).
#2: A restore using the IFD restore CD.

Both had the same result: "the drive is dirty" - and required an extensive
chkdsk /f
When this image is restored, extra verbiage that's never seen normally -
"the restore is complete" (may not be exact wording) - appears on the screen
prior to the usual acknowledgement that "the restore has completed
successfully."

Just to be clear, in case the following has a bearing on this issue...

When Windows 10 is in use (drive 1) the Windows 7 drive appears as drive
letter J:, which contains the Windows 7 O/S + programs, and some data files.
When Windows 7 is in use (drive 0) the Windows 10 drive appears as drive
letters J: and K:, the O/S + programs, and the data only partitions
respectively.

The DOS screen offers the choice to boot either. By default, Windows 10
boots, unless Windows 7 is manually chosen.

The fact that one O/S sees the drive that contains the other O/S is
intentional, and has never caused any conflicts.
As mentioned earlier, when XP and Windows 7 were in a similar configuration,
imaging Windows 7 while using Windows 7 never resulted in problems.

borate
Posts: 112
Joined: Thu Oct 27, 2011 9:51 pm

Re: NTFS is "dirty" - updated

Post by borate »

TeraByte Support wrote:

> Sounds more like you either using RST hybrid setup in maximized mode (or
> similar) or you perhaps have and old out of sync EMBR. Without any details
> (ifw screen shots, log files, partinfo listing, system details, etc..) ,
> can't point you directly where to look.

Your first sentence refers to items that are beyond my understanding.

As to the second sentence, there are no unusual IFW screens other than the previously noted extra "the restore has completed."
What log file would be useful, specifically? I spot none associated with IFW.

Drive 0 is an SSD (one partition + system) Drive 1 is a non-SSD SATA. (two partitions + system)
Attached here, partition info and disk management snapshots - while booted into drive 1/Windows 10. C: and D: are drive 1; J: is drive 0 (Windows 7).
Attachments
Disk management
Disk management
2.JPG (102.91 KiB) Viewed 11734 times
Partition info
Partition info
1.JPG (57.13 KiB) Viewed 11734 times
TeraByte Support(PP)
Posts: 1644
Joined: Fri Aug 12, 2011 12:51 am

Re: NTFS is "dirty" - updated

Post by TeraByte Support(PP) »

Unless changed from the default, the IFW log file (ifw.log) is saved in the IFW installation folder (otherwise, look in settings and see where it's getting saved). For PartInfo, you can save a report using the "Export to Text File..." option in the File menu.
borate
Posts: 112
Joined: Thu Oct 27, 2011 9:51 pm

Re: NTFS is "dirty" - updated

Post by borate »

Located IFW.log on the other drive. Here's a look at all events for that day, followed by PARTIFG.TXT...

[3/17/2016 9:13:54 AM] Image for Windows 2.99-00
[3/17/2016 9:13:54 AM] Starting REFRESHED INSTALL. FBlk 19. Dict TT 1.9. WinUpdate - to notif. WIA to auto (delay). Irfanview register/refresh plugins. Coolsoft 1.15.2. MS Keyboard 2.7.133. Superfetch OFF; tweak CAPI and DCom. Readyboot set to circular. Snipping shortcut created/all SCs moved under START. OneDrive enabled. VCF file for Contacts updated. Tiles culled....
imagew.exe /b /d:w1@0x1 /f:"F:\IFW\W10_l511c" /v /desc:"REFRESHED INSTALL. FBlk 19. Dict TT 1.9. WinUpdate - to notif. WIA to auto (delay). Irfanview register/refresh plugins. Coolsoft 1.15.2. MS Keyboard 2.7.133. Superfetch OFF; tweak CAPI and DCom. Readyboot set to circular. Snipping shortcut created/all SCs moved under START. OneDrive enabled. VCF file for Contacts updated. Tiles culled."
[3/17/2016 9:13:54 AM] Deleting F:\IFW\W10_l511c.TBI
[3/17/2016 9:13:55 AM] PHYLock is waiting for drive writing to stop ...
[3/17/2016 9:14:01 AM] PHYLock using drive J:
[3/17/2016 9:14:01 AM] PHYLock Started
[3/17/2016 9:14:01 AM] PHYLock Using Disk
[3/17/2016 9:14:01 AM] PHYLock version 12
[3/17/2016 9:14:02 AM] Backup: Drive 1 (J:) MBR 0 Partition (01) 976111 MiB NTFS
[3/17/2016 9:14:02 AM] To: F:\IFW\W10_l511c.TBI
[3/17/2016 9:27:37 AM] INFO: Total Sectors:1999074447 Total Allocated:68703928
[3/17/2016 9:27:37 AM] INFO: 58876104 Sector(s) backed up
[3/17/2016 9:28:16 AM] Validating: MBR 0 Partition (01) 976111 MiB NTFS
[3/17/2016 9:28:16 AM] From: F:\IFW\W10_l511c.TBI
[3/17/2016 9:39:36 AM] Operation Completed with Error Code 0
[3/17/2016 9:39:36 AM] Stop
--------------------------------------------------------------------------
[3/17/2016 10:51:54 AM] Image for Windows 2.99-00
[3/17/2016 10:51:54 AM] Starting REFRESHED INSTALL. FBlk 19. Dict TT 1.9. WinUpdate - to notif. WIA to auto (delay). Irfanview register/refresh plugins. Coolsoft 1.15.2. MS Keyboard 2.7.133. Superfetch OFF; tweak CAPI and DCom. Readyboot set to circular. Snipping shortcut created/all SCs moved under START. OneDrive enabled. VCF file for Contacts updated. Tiles culled....
imagew.exe /r /d:w1@0x1 /f:"K:\IFW\W10_l511test" /vb
[3/17/2016 10:51:55 AM] Unable to obtain a lock on drive J:

The volume is in use by an application or Windows itself. Please
close the offending application and retry or use a recovery boot disk.
Visit http://www.terabyteunlimited.com/howto/ for details.

You can also attempt to invalidate all opened handles and force
a dismount by choosing ignore.
[3/17/2016 10:51:58 AM] Restoring: MBR 0 Partition (01) 976111 MiB NTFS
[3/17/2016 10:51:58 AM] To: Drive 1 (J:) MBR 0 Partition (01) 976111 MiB NTFS
[3/17/2016 10:51:58 AM] From: K:\IFW\W10_l511test.TBI
[3/17/2016 11:02:04 AM] Validating: MBR 0 Partition (01) 976111 MiB NTFS
[3/17/2016 11:02:04 AM] From: K:\IFW\W10_l511test.TBI
[3/17/2016 11:12:11 AM] Operation Completed with Error Code 0
[3/17/2016 11:12:11 AM] Stop
--------------------------------------------------------------------------
[3/17/2016 12:30:11 PM] Image for Windows 2.99-00
[3/17/2016 12:30:11 PM] Starting REFRESHED INSTALL. FBlk 19. Dict TT 1.9. WinUpdate - to notif. WIA to auto (delay). Irfanview register/refresh plugins. Coolsoft 1.15.2. MS Keyboard 2.7.133. Superfetch OFF; tweak CAPI and DCom. Readyboot set to circular. Snipping shortcut created/all SCs moved under START. OneDrive enabled. VCF file for Contacts updated. Tiles culled....
imagew.exe /r /d:w1@0x1 /f:"F:\IFW\W10_l511c"
[3/17/2016 12:30:11 PM] Restoring: MBR 0 Partition (01) 976111 MiB NTFS
[3/17/2016 12:30:11 PM] To: Drive 1 (J:) MBR 0 Partition (01) 976111 MiB NTFS
[3/17/2016 12:30:11 PM] From: F:\IFW\W10_l511c.TBI
[3/17/2016 12:44:30 PM] Operation Completed with Error Code 0
[3/17/2016 12:44:30 PM] Stop


PARTINFG, Version 1.02
Copyright (c) 2009,2013 TeraByte, Inc. All Rights Reseverd

Run Date: 3/19/2016 4:23 PM

===============================================================================
MBR Partition Information (HD0 - 0x4F80ED07)
(CHS: 1022/254/63) (WCHS: 243201/255/63)
+====+====+=============+====+=============+=============+=============+
| 0: | 80 | 0 1 1 | 7 | 1023 254 63 | 63 | 1999074447 |
| 1: | 0 | 1023 254 63 | 27 | 1023 254 63 | 1999075328 | 919552 |
| 2: | 0 | 1023 254 63 | f | 1023 254 63 | 1999996110 | 1907027955 |
+====+====+=============+====+=============+=============+=============+
Volume Information
+----+----+-------------+----+-------------+-------------+-------------+
| 0: | 0 | 1023 254 63 | 7 | 1023 254 63 | 63 | 1907027892 |
| 1: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
| 2: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
| 3: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
+----+----+-------------+----+-------------+-------------+-------------+
MBR Partition Information (HD0) Continued:
+====+====+=============+====+=============+=============+=============+
| 3: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
+====+====+=============+====+=============+=============+=============+
===============================================================================
BOOT SECTOR INFORMATION
-------------------------------------------------------------------------------
File System ID: 0x7 LBA: 63 Total Sectors: 1999074447 ID: 0x1
Jump: EB 52 90
OEM Name: NTFS
Bytes Per Sec: 512
Sec Per Clust: 8
Res Sectors: 0
Zero 1: 0x0
Zero 2: 0x0
NA 1: 0x0
Media: 0xF8
Zero 3: 0x0
Sec Per Track: 63
Heads: 255
Hidden Secs: 63
NA 2: 0x0
NA 3: 0x800080
Total Sectors: 0x7727748E
MFT LCN: 0xB95A1
MFT Mirr LCN: 0x7077C9
Clust Per FRS: 0xF6
Clust Per IBlock: 0x1
Volume SN: 0x250BAB5BEF51F9ED
Checksum: 0x0
Boot Flag: 0xAA55
-------------------------------------------------------------------------------
File System ID: 0x7 LBA: 1999996173 Total Sectors: 1907027892
Jump: EB 52 90
OEM Name: NTFS
Bytes Per Sec: 512
Sec Per Clust: 8
Res Sectors: 0
Zero 1: 0x0
Zero 2: 0x0
NA 1: 0x0
Media: 0xF8
Zero 3: 0x0
Sec Per Track: 63
Heads: 255
Hidden Secs: 63
NA 2: 0x0
NA 3: 0x800080
Total Sectors: 0x71AAEFB0
MFT LCN: 0xBBFFE
MFT Mirr LCN: 0x51FAF3
Clust Per FRS: 0xF6
Clust Per IBlock: 0x1
Volume SN: 0x53E36A7DC0E41BE2
Checksum: 0x0
Boot Flag: 0xAA55
-------------------------------------------------------------------------------
===============================================================================
MBR Partition Information (HD1 - 0xCC8E6351)
(CHS: 1022/254/63) (WCHS: 14593/255/63)
+====+====+=============+====+=============+=============+=============+
| 0: | 0 | 0 32 33 | 7 | 12 254 63 | 2048 | 204800 |
| 1: | 80 | 12 223 20 | 7 | 1023 254 63 | 206848 | 234231808 |
| 2: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
| 3: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
+====+====+=============+====+=============+=============+=============+
===============================================================================
BOOT SECTOR INFORMATION
-------------------------------------------------------------------------------
File System ID: 0x7 LBA: 2048 Total Sectors: 204800 ID: 0x1
Jump: EB 52 90
OEM Name: NTFS
Bytes Per Sec: 512
Sec Per Clust: 8
Res Sectors: 0
Zero 1: 0x0
Zero 2: 0x0
NA 1: 0x0
Media: 0xF8
Zero 3: 0x0
Sec Per Track: 63
Heads: 255
Hidden Secs: 2048
NA 2: 0x0
NA 3: 0x800080
Total Sectors: 0x31FFF
MFT LCN: 0x2155
MFT Mirr LCN: 0x2
Clust Per FRS: 0xF6
Clust Per IBlock: 0x1
Volume SN: 0x3A88C74788C6FFFD
Checksum: 0x0
Boot Flag: 0xAA55
-------------------------------------------------------------------------------
File System ID: 0x7 LBA: 206848 Total Sectors: 234231808 ID: 0x2
Jump: EB 52 90
OEM Name: NTFS
Bytes Per Sec: 512
Sec Per Clust: 8
Res Sectors: 0
Zero 1: 0x0
Zero 2: 0x0
NA 1: 0x0
Media: 0xF8
Zero 3: 0x0
Sec Per Track: 63
Heads: 255
Hidden Secs: 206848
NA 2: 0x0
NA 3: 0x800080
Total Sectors: 0xDF617FF
MFT LCN: 0xC0000
MFT Mirr LCN: 0x2
Clust Per FRS: 0xF6
Clust Per IBlock: 0x1
Volume SN: 0x2CB8C975B8C93DD8
Checksum: 0x0
Boot Flag: 0xAA55
-------------------------------------------------------------------------------
===============================================================================
MBR Partition Information (HD2 - 0xD61ACFC5)
(CHS: 1023/254/63) (WCHS: 1953/255/63)
+====+====+=============+====+=============+=============+=============+
| 0: | 80 | 512 1 0 | 7 | 1023 254 63 | 128 | 31375232 |
| 1: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
| 2: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
| 3: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |
+====+====+=============+====+=============+=============+=============+
===============================================================================
BOOT SECTOR INFORMATION
-------------------------------------------------------------------------------
File System ID: 0x7 LBA: 128 Total Sectors: 31375232 ID: 0x1
Jump: EB 52 90
OEM Name: NTFS
Bytes Per Sec: 512
Sec Per Clust: 8
Res Sectors: 0
Zero 1: 0x0
Zero 2: 0x0
NA 1: 0x0
Media: 0xF8
Zero 3: 0x0
Sec Per Track: 63
Heads: 255
Hidden Secs: 128
NA 2: 0x0
NA 3: 0x80
Total Sectors: 0x1DEBF7F
MFT LCN: 0xC0000
MFT Mirr LCN: 0x2
Clust Per FRS: 0xF6
Clust Per IBlock: 0x1
Volume SN: 0x3C54009F54005E50
Checksum: 0x0
Boot Flag: 0xAA55
-------------------------------------------------------------------------------
TeraByte Support(PP)
Posts: 1644
Joined: Fri Aug 12, 2011 12:51 am

Re: NTFS is "dirty" - updated

Post by TeraByte Support(PP) »

If Intel RST (Rapid Storage Technology)/Intel SRT (Smart Response Technology) or something similar is being used it's usually shown in the BIOS or tray app. If it's being used it needs to be in enhanced mode and not maximized mode.
http://www.intel.com/content/www/us/en/ ... ology.html
http://www.intel.com/content/dam/www/pu ... -brief.pdf

Try using VSS when creating the backup instead of using PHYLock. If VSS works let us know the storage driver and controller/adapter being used.

You can also check UpperFilters for any other drivers. Normally, just "phylock PartMgr" is there. In the Registry Editor, browse to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}

Many users, including myself, back up and restore Windows 10 systems without issues. The problem you're having is most likely unique to your system or configuration.
borate
Posts: 112
Joined: Thu Oct 27, 2011 9:51 pm

Re: NTFS is "dirty" - updated

Post by borate »

Thanks for the continued support.

In the BIOS, the closest reference to Intel RST was an item labeled "Intel Speedstep technology. It's enabled. In the registry entry that you cited, the sole upper filter listed is Phylock Partmgr.
Switched to VSS, imaged and restored. Success, for the first time in many years, but not without glitches...

Prior to writing the image "attempting to make a snapshot" and "gathering data" took about three minutes. Probably a normal process, but thereafter the following error was seen in Event Viewer...

"Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
This is often caused by incorrect security settings in either the writer or requestor process."

An explanation from MS support...

"This issue occurs when using a 3rd party backup program that utilizes Windows VSS (Volume Shadow Service) and has its own requestor.
It looks like the requestor (the backup application) does not allow system writer to call back into their process and hence generates the error in the application log."

After applying the following procedure, as suggested in a forum, the next image creation did not generate the VSS error. "Snapshot"and "gathering" still took three minutes.

"From the Start Menu, select Run
The Run dialog opens.

In the Open field, input dcomcnfg and click OK.
The Component Services dialog opens.

Expand Component Services, Computers, and My Computer.
Right-click My Computer and click Properties on the pop-up menu.

The My Computer Properties dialog opens.

Click the COM Security tab.
Under Access Permission click Edit Default.

The Access Permissions dialog opens.

From the Access Permissions dialog, add the "Network Service" account with Local Access allowed.
Close all open dialogs.
Restart the computer."

As overall progress concluded, "processing exclude list" cycled for about three minutes before the restore was complete. This is new, but likely a VSS thing.

Examination of the event viewer revealed approximately ten search-related errors after each of my two test restores of VSS-created images. That doesn't happen when Phylock is used.
TeraByte Support
Posts: 3598
Joined: Thu May 05, 2011 10:37 pm

Re: NTFS is "dirty" - updated

Post by TeraByte Support »

The VSS event item is a non-issue:
https://www.terabyteunlimited.com/kb/article.php?id=563

Yes, it's normal for processing exclude list items will take extra time.

SpeedStep is something completely unrelated.

Email support to get more details from your system.
Post Reply