Finding out which file is affected by a bad sector

By | February 8, 2017

Hard disk ‘repair’ software like Spinrite, DiskPatch or the hard disk manufacturer diagnostic software often identifies bad sectors in the form of an LBA address (logical block addressing). A commonly asked question is, “how do I determine, which file is affected by a bad sector?”.

What is bad sector repair?

Bad sector repair utilities do not actually repair bad sectors and often the original data in the sector is lost.

Hard disks have a pool of ‘spare’ sectors. If a bad sector develops it can be taken out of service and replaced by one from the spare pool. Using a S.M.A.R.T. utility you can observe and how many sectors have been reallocated this way. The disk all handles this internally:

Assume the sector at LBA address 100 can not be read and is reallocated. From this moment on, all reads and writes to LBA address 100 are redirected to the spare sector that was assigned to this address.

Hard disk repair software scans the disk, allowing the disk to discover bad sectors. When ‘hitting’ a bad sector the disk will add the LBA address of the sector to the ‘pending reallocation’ list. The disk will not yet reallocate the sector because once it has done that, no attempts can be made to get the data from the sector. So the disk does not make that decision. By writing data to the sector you can signal to the disk that the data is given up on.

Which file is affected by a bad sector, if any?

As this hard disk repair software runs in an out of Windows environment (DOS mostly) and does address the physical disk rather than a logical volume, it has no way of telling if, and if so, which files are affected by the repairs. There are several possible effects if bad sectors were repaired, depending on what was actually in the sectors.: Were they part of – empty, unallocated space, – file system structures, – system files, – or user files.

Unallocated Space

As reallocation of sectors that aren’t in use by any file system or files does not result in data loss, we can ignore this.

File System Level

If the file system itself is affected by bad sectors, the first tool that comes to mind to address those is Chkdsk.exe. Of course Chkdsk scans at the cluster level rather than the sector level. A sector is the smallest addressable unit on hard disk. A cluster is the smallest addressable unit in a file system. It’s how the file system organizes data. A cluster is usually several sectors in size.

If chkdsk runs into read problems while scanning clusters it will:

  1. Determine if a file is affected and if so, try to recover the data from the cluster(s).
  2. Add the cluster(s) to the $BADCLUS  table where it basically marks the cluster as bad so it will not be used again. This not the same as the disk itself reallocating bad sectors! As far as the disk concerns, the bad sectors still exist. The cluster is marked ‘bad’ at the file system level.

Addressing issues that may occur after sector reallocation on the file system level:

If we’d run a disk repair utility *after* chkdsk, and let it repair (read: reallocate) bad sectors, the $BADCLUS file would need to be updated. After all, the clusters that were marked bad no longer contain bad sectors.

You can then use Chkdsk to re-evaluate the bad clusters by specifying /B switch, so chkdsk /b [enter].

Theoretically bad sectors in the first $MFT entries can be overcome by using the $MFTMIRR which backs up the first 10 records of the MFT. I am not sure how Chkdsk handles this however, I have never seen it happen.

A corrupt boot sector, which technically is a file as far as NTFS is concerned, could be addressed by using the backup boot sector (which is technically NOT a file, nor part of the file system). Typically Chkdsk will mention the file system is RAW and will refuse repairs. A utility like DiskPatch [Fix NTFS boot sector] can copy the backup boot sector to the boot sector, or it can even rebuild a boot sector from scratch.

Minor file system damage can be fixed using Chkdsk.

System Files (Windows)

Windows includes a system file checker (SFC.exe) that can be used to verify system files after sector reallocation. More info here. You can use it to verify if any system files were affected (corrupted) and repair them.

User Files

To find out if user files are or were affected by bad sectors or bad sector repair (sector reallocation) you can use ‘NFI.exe’.

The Microsoft support tool NFI.exe can be used to convert a LBA sector address to a file path. This way you can determine which files need to be restored from backup after sector reallocation.

> nfi.exe
Dumps information about an NTFS volume, and optionally determines
which volume and file contains a particular sector.

Usage: nfi drive-letter [logical-sector-number]

Drive-letter can be a single character or a character followed
 by a colon (i.e., C or C: are acceptable).

Logical-sector-number is a decimal or 0x-prefixed hex
 number, specifying a sector number relative to the volume
 whose drive letter is given by drive-letter. If not
 specified, then information about every file on the volume
 is dumped.

nfi NT-device-path physical-sector-number

Determines which volume a given physical sector on a drive is
 within, and then which file on the volume it is in.

NT-device-path is the NT-style path to a physical device.
 It must not include a partition specification.

Physical-sector-number is a decimal or 0x-prefixed hex
 number, specifying a sector number relative to the physical
 drive whose device path is given by NT-device-path.

nfi full-win32-path

Dumps information about a particular file. full-win32-path
 must start with a drive letter and a colon.

Note you must omit the “\\?” prefix of the block device path. Example:

C:\Users\admin\Downloads>nfi \Device\Harddisk0\DR0 28521816
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.

***Physical sector 28521816 (0x1b33558) is in file number 5766 on drive C.


Alternative: HD Sentinel

I am currently test driving the new beta for HD Sentinel. The Pro version this time. And after doing the article ‘Looking for Spinrite Alternative‘ I was pleasantly surprised when I discovered even more disk scan, test and repair options.

But what may be even cooler is it can help you to determine which file is affected by a bad sector!

disk surface scan options, new: repair which file is affected by a bad sector unfortunately the system disk can't be locked. so no read/write scan possibleread only surface scan of system driveview specific sector and which file is using it

Leave a Reply

Your email address will not be published. Required fields are marked *