[comp.sys.ibm.pc] Lost clusters, chains, and files

tkoppel@isis.UUCP (06/08/87)

Earlier this evening, when running a "chkdsk b:*.*", I got the
wonderful and mysterious message:
   1 lost cluster found in 1 chain -- 
    Convert lost chains to files?

What does this mean? The chkdsk went on to say that the disk itself
had all sorts of file system errors .. Can one recover from this 
"lost cluster condition" without reformatting the disk?

Many thanks..

-- 
Ted Koppel == CARL - Colorado Alliance of Research Libraries ==
    303-750-9142    !hao!isis!tkoppel     CompuServe: 71460,1572

darrylo@hpsrlc.UUCP (06/10/87)

In comp.sys.ibm.pc, tkoppel@isis.UUCP (Ted Koppel) writes:

> Earlier this evening, when running a "chkdsk b:*.*", I got the
> wonderful and mysterious message:
>    1 lost cluster found in 1 chain -- 
>     Convert lost chains to files?
> 
> What does this mean? The chkdsk went on to say that the disk itself
> had all sorts of file system errors .. Can one recover from this 
> "lost cluster condition" without reformatting the disk?
> 
> Many thanks..
> 
> -- 
> Ted Koppel == CARL - Colorado Alliance of Research Libraries ==
>     303-750-9142    !hao!isis!tkoppel     CompuServe: 71460,1572
> ----------

     The answer is a "qualified yes".  The default action for chkdsk is to
report but not fix errors (I'm not sure if this is true for *ALL* errors --
very severe ones *may* get fixed).  To get chkdsk to "fix" these errors, you
need to specify the "/f" switch: "chkdsk B:*.* /f".  This time, answer "y"
to the question, "Convert lost chains to files?", and chkdsk will convert
any lost chains that it finds into files (why it asks this question when
the "/f" switch is not specified is beyond me).

***** WARNING!  WARNING!  WARNING! *****
NOTE: IF THE DISK (FLOPPY OR HARD DISK) IS *REALLY* CORRUPTED, RUNNING
CHKDSK WILL NOT DO ANY GOOD AND MAY EVEN TURN THE FILE SYSTEM INTO EVEN MORE
GARBAGE.

     Chkdsk tries to fix the disk as best as it can.  However, something
trashed your disk (like a crashing program, a program that terminated
without cleaning up its files, a TSR conflict, etc.), and this something
may have also trashed some or all of the files on the disk.  This can range
from a file whose contents is complete garbage to a file where only ONE
byte has changed.

     After chkdsk has "fixed" the disk, examine the files which were
created from the lost chain(s).  These are placed in the root directory of
the disk, and are of the form "FILExxxx.CHK", where "xxxx" is a number.

     -- Darryl Okahata
	hplabs!hpcea!hpsrla!darrylo
	CompuServe: 75206,3074

Disclaimer: the above is the author's personal opinion and is not the
opinion or policy of his employer or of the little green men that
have been following him all day.

neuhaus@hplabsb.UUCP (06/10/87)

Do a chkdsk b: /f.

This will convert the lost clusters to *.chk files which you just delete.

Lost clusters are parts of files who forgot who them belong to. They are
typically created by programs that don't close files before terminating
(or got hung and you rebooted the system.)

cramer@kontron.UUCP (Clayton Cramer) (06/10/87)

> Earlier this evening, when running a "chkdsk b:*.*", I got the
> wonderful and mysterious message:
>    1 lost cluster found in 1 chain -- 
>     Convert lost chains to files?
> 
> What does this mean? The chkdsk went on to say that the disk itself
> had all sorts of file system errors .. Can one recover from this 
> "lost cluster condition" without reformatting the disk?
> 
> Many thanks..
> 
> Ted Koppel == CARL - Colorado Alliance of Research Libraries ==

"Lost cluster" means that a cluster of sectors were allocated in the 
FAT (file allocation table), but not attached to any file in the 
directory.  This is frequently the result of a program writing a
file, then the system crashes before the file was closed.  The directory
is therefore out of date, but the FAT shows the cluster as allocated.

Use the /F option on CHKDSK.  This will ask you if you want to free
the lost clusters, or turn them into files.  If you turn them into
files, they go in the root directory with names like "FILExxxx.CHK",
and contain the contents of these clusters.  I've never had any real
use for trying to reconstruct files from these lost clusters.

Before anyone flames PC-DOS for not keeping the directory up to date,
remember that there is a trade-off between perfectly up to date file
system, and performance.  I wrote a file system for a telephone switch
several years ago where the old file system trade-off had been on the 
side of performance -- the wrong choice for a system that had to come 
up automatically and lose no data.  For a system like PC-DOS, Microsoft
chose performance, and I can't claim that this was automatically a
mistake.  (Sure would be nice to have a flag you could set to make
the trade-off at run-time...)

Clayton E. Cramer

timothym@tekigm2.UUCP (06/10/87)

In short, yes.

You can recover lost chains and clusters by the following method:

CHKDSK X: /f

Then if you want to save the chains as files, answer yes to the prompt you're
given. Otherwise CHKDSK will erase the chain, and free up the disk space.



-- 
Tim Margeson (206)253-5240
PO Box 3500  d/s C1-937                          @@   'Who said that?'  
Vancouver, WA. 98668
{amd..hplabs}cae780!tektronix!tekigm2!timothym (this changes daily)

perry@omepd.UUCP (06/10/87)

In article <1855@isis.UUCP> tkoppel@isis.UUCP (Ted Koppel) writes:
>Earlier this evening, when running a "chkdsk b:*.*", I got the
>wonderful and mysterious message:
>   1 lost cluster found in 1 chain -- 
>    Convert lost chains to files?
>
>What does this mean? The chkdsk went on to say that the disk itself
>had all sorts of file system errors .. Can one recover from this 
>"lost cluster condition" without reformatting the disk?

A *cluster* is the logical storage unit on a disk; it is one or more disk
blocks (512bytes each). A *lost cluster* is a cluster that is marked *used*
(i.e., is not free space) but that does NOT belong to any file (or directory)
on the disk. That shouldn't happen but sometimes it does, especially when your
machine crashes during a write operation.
Clusters are *chained* on your disk (in the FAT, to be exact), with a
directory entry pointing to the first block. Thus, if the directory entry gets
trashed all clusters in that *chain* become lost.
CHKDSK gives you the option to recover these *lost clusters*. Call
	CHKDSK /F
(for FIX it) and answer YES to the question above. CHKDSK will create files
FILEnnnn.CHK in the root directory of the disk that contain the lost clusters,
one for each chain. You can then examine these files with an editor or dumper
or whatever, and use them as usual (or delete them to free the space). This
does NOT destroy anything on your disk (the damage has already been done :-)
and doesn't touch files that have no problems. See your DOS manual (CHKDSK
command) for details.
Oh, one thing that probably confused you: if you call CHKDSK *without* the
"/F" argument, it still asks you the conversion question, just to tell you
then that it didn't do anything. Can't make it too clear here now, can we?
------------------------------------------------------------------------
  <<  Perry The Cynic >>		   =>> perry@inteloa.intel.com <<=
				      ...!tektronix!ogcvax!omepd!inteloa!perry
   (Peter Kiehtreiber)				...!verdix!omepd!inteloa!perry

stevev@uoregon.UUCP (06/11/87)

In article <1855@isis.UUCP> tkoppel@isis.UUCP (Ted Koppel) writes:
>Earlier this evening, when running a "chkdsk b:*.*", I got the
>wonderful and mysterious message:
>   1 lost cluster found in 1 chain -- 
>    Convert lost chains to files?
>
>What does this mean? The chkdsk went on to say that the disk itself
>had all sorts of file system errors .. Can one recover from this 
>"lost cluster condition" without reformatting the disk?

A file on a disk is essentially a chain of clusters, and a cluster is
the smallest unit of disk space that can be allocated to a file.
Sometimes a chain of clusters will get unhooked from a directory entry
(often if a file is opened, written to, but not closed properly, i. e.
the machine crashes before the file is closed).  When that happens the
clusters are still marked as allocated but don't correspond to any file
on the disk.  CHKDSK will find these lost chains and give you the option
turning them back into files that you can either delete or possibly
recover lost information from the file.  Recovered files are placed in
the root directory on the disk with names FILEnnnn.CHK where nnnn starts
with 0000.  You must run CHKDSK with the /F switch to have it recover
lost cluster chains.

-- 
Steve VanDevender	uoregon!drizzle!stevev	stevev@oregon1.BITNET
"Bipedalism--an unrecognized disease affecting over 99% of the population.
Symptoms include lack of traffic sense, slow rate of travel, and the
classic, easily recognized behavior known as walking."

jmc@ptsfa.UUCP (Jerry Carlin) (06/11/87)

In article <58200001@hplabsb.UUCP> neuhaus@hplabsb.UUCP (Peter Neuhaus) writes:
>Lost clusters are parts of files who forgot who them belong to. They are
>typically created by programs that don't close files before terminating...

Is this true of MS-DOS backup? I've had to chkdsk my backup diskettes ever
since I found one day that 1/3 of my diskettes were munged (I noticed that
the backup took too many diskettes).

-- 
voice: (415) 823-2441	uucp: {ihnp4,lll-crg,ames,qantel,pyramid}!ptsfa!jmc
CompuServe: 73075,1133	GEnie: jerrycarlin
Where am I? In the village. Whose side are you on? That would be telling.

jpn@teddy.UUCP (John P. Nelson) (06/15/87)

>I hope that this question doesn't sounds dumb, but by doing a CHKDSK /F,
>is there any possibility of loosing/deleting/erasing a file?  From what
>I have heard, if the bad cluster is in one of the files, when you do a
>CHKDSK /F, it will erase the file.  Is this information incorrect?  If so,
>then is it possible for ANY file on the drive to be erased?

This isn't QUITE true.  CHKDSK is simply pointing out a problem that
ALREADY exists, which is that there is no file which contains the
lost clusters!  Also, CHKDSK is giving you a chance to put those lost
clusters BACK into files, so that you can examine them!

As long as "lost clusters" is the ONLY problem which CHKDSK reports, then
there is no way that CHKDSK can do further damage if used with the /F
flag.  On the other hand, if there is significant filesystem damage
(a botched directory, for instance), then CHKDSK may not be able to do
much, and can possibly make the situation worse.  In this case, always
be sure to backup your disk before attempting repair!

davidr@hplsla.UUCP (06/15/87)

My personal  experience  does not leave me  enamored  with  CHKDSK.  About one
third of the time I have  resorted to using /F because of errors  reported  by
CHKDSK  I have  lost a lot of  files.  It seems  to be  especially  if  CHKDSK
reported  clusters  held in duplicate (I do not remember the exact  wording of
the error message, and have no way of  intentially  creating  such, but it was
something  to the effect of two files  claiming use of the same  cluster).  In
saying  that I lost files does not mean that they were  erased,  but that they
became  garbage as CHKDSK tried to straighten out which  clusters  belonged to
which file in which order.  A real  nightmare.  I only wish I could figure out
what causes such a mess-up with the FAT to create this "dual ownership".

Otherwise, if CHKDSK  reports lost  clusters, the /F has simply  created a few
garbage  FILE????.CHK  files at the root level from which  nothing  useful has
ever been recovered (in my case), but has restored some usable disc space upon
their deletion.

*******************************************************************************
-David M. Reed ------ hpLSID ------ hplsla!davidr ------ 335-2460 ------ msUN5-
*******************************************************************************