2

Sometimes My PC check disk on startup.

Here is the log

Checking file system on D:
The type of the file system is NTFS.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                         
Deleting orphan file record segment 29143.
Deleting orphan file record segment 29148.
Deleting orphan file record segment 29152.
Deleting orphan file record segment 29155.
............
Deleting orphan file record segment 29179.
Index entry PL0EF5~1 of index $I30 in file 0x99 points to unused file 0x702a.
Deleting index entry PL0EF5~1 in index $I30 of file 153.
Index entry PL2BA0~1of index $I30 in file 0x99 points to unused file 0x702d.
Deleting index entry PL2BA0~1 in index $I30 of file 153.
.............
Index entry full.mp4 of index $I30 in file 0x3ac5c points to unused file 0x7016.
Deleting index entry full.mp4 in index $I30 of file 240732.
..................
 293603908 KB total disk space.
 109135160 KB in 659568 files.
    299360 KB in 107552 indexes.
         0 KB in bad sectors.
    905852 KB in use by the system.
     65536 KB occupied by the log file.
 183263536 KB available on disk.

      4096 bytes in each allocation unit.
  73400977 total allocation units on disk.
  45815884 allocation units available on disk.

THen window start, i realize that i lost some files. That mentioned on the log: PL0EF5~1, full.mp4.... I searched the solution, then find folder "found.00X" But i can't find the lost files.

Any idea to help me recover these files would be appreciated. I also need to help to prevent "Deleting index entry" loss my files.

Thanks

djsmiley2kStaysInside
  • 6,643
  • 2
  • 31
  • 43
Tho D
  • 21
  • 1
  • 1
  • 3
  • 2
    note that the 'Deleting index entry' event did not lose your files, it reacted to the fact that the files had already been lost. check your hard disks SMART stats to see if the disk is dying and replace it if it is unhealthy. unfourtunatly, it may not be possible to recover files that are so damaged that the filesystem can't see them any more. you can try disk carving utilities like photorec, and mabey even utilities like Recuva to see if they turn up, but thiss is not a simple undelete scenario, since the files data was damaged on disk, independent of the filesystem. – Frank Thomas Dec 19 '14 at 17:37
  • But i'm sure the files on 'Deleting index entry' log I'm still using as well. After a reboot, my pc check disk, then they delete them. – Tho D Dec 20 '14 at 03:40
  • Just before reboot, i still use them as well. I used chkdsk /r but and oget no problem. Recuva don't show the lost files. Any idea? – Tho D Dec 20 '14 at 03:47
  • the log you are seeing is produced by chkdsk /r so that won't do anything. Also, you have it wrong, the file was already damaged, before chkdsk deleted the index. thats why it says the index points to an unused file (probably a bad block that could not be read, so it could not be reallocated). Check your SMART stats and look for uncorrectable reads, reallocaated sectors, and pending sectors, because your disk may be physically dying. needless to say, backup the files you want to keep now. you may want to give photorec a try; it should recognize mp4 files by their binary signature, if intact. – Frank Thomas Dec 20 '14 at 05:26
  • I run yesterday: chkdsk /f and there is no problem. I checked S.MART, but it show ok. I have dual boot Win XP and Win 7. I work almost on win XP, i use win 7 for gaming only. And sometimes win 7 show chkdsk on startup. Whenever it happens, if it the show "delete index entry" i think i lost files. – Tho D Dec 20 '14 at 11:38
  • Then i find out the solution, i unchecked "Allow indexing service to index this disk for fast files search" and the losing files become "minimum". I think that is the confliction XP and 7 not my driver is bad. – Tho D Dec 20 '14 at 11:39
  • that is not the kind of index we are talking about. file system indexes and full text content indexing are entirely different things. that setting will have NO impact on the log messages you discovered. NTFS indexing and $I30: http://forensicmethods.com/ntfs-index-attribute Content indexing: http://technet.microsoft.com/en-us/library/dd744700%28v=WS.10%29.aspx There is no setting or utility in windows where you can change NTFS $I30 indexing in any way. it is a set-in-stone component of the NTFS filesystem. – Frank Thomas Dec 21 '14 at 03:44

0 Answers0