Anti-Virus and File Associations Get Corrupted Adding New Disk

[sburtchin]

I recently changed from 80GB Maxtor + 8GB Fujitsu to two 100GB maxtor HDD's. Everything was imaged and restored with Ghost from old to new and partitions validated 100% to CRC files before booting Windows. Windows 2000 seems to recognize all the new disks and partitions OK, but there seems to be two persistent problems related to this:

The change killed my EZ-Antivirus "Real-Time Protection" and its ability to update virus signatures. It was functional otherwise - I think. The only way I could get it to work again was to reinstall it, which has nasty side effects. If I don't reinstall the EZ Firewall too, then it uninstalls the firewall. Reinstalling both overwrites all my preferences for both the Antivirus and Firewall.

The change also had a strange effect on file associations. Windows Explorer can't find the icons to display for many files. For example, ".mpeg" files just have a white box with the Windows logo in the center for their icon instead of the Windows Media Player icon. But if I double-click the file, it still opens and plays in Windows Media Player. After numerous restarts and about 12 hours runtime, the WMP icons came back. Adding a new partition on the second disk killed them again - AND the Antivirus!

Now, I'm tweaking the partitions on the second HDD, and every time I move, resize or add a partition there the same problems repeat. What's going on:confused:?

[classicsoftware]

I would think the installation program is putting some files on that partition and you are messing it up by changing the partition.

Why don't you make all the necessary changes and then re-install your AV program.

[sburtchin]

That would make sense if I were moving or resizing a partition that contained data or program files, or even an adjacent partition, but adding a partition on another area of the disk into unpartitioned space . . . :confused::confused:

I have been using Rannish Partition Manager and PTEDIT mostly. Windows Disk Management has not complained at all. CHKDSK is happy too. All formatting has been done with Disk Management and DOS 7.10.

[classicsoftware]

It's the AV program and it may put information on each partition as part of it's installation routine. In any event, it's not the why, but the what. You either need to do what I say or change AV software.

[sburtchin]

OK! Well that explains the stuff I found on my HDD's where I expected to find all zeroes. This AV is crap but came free with my Road Runner, so the price was right. I will look into something else.

I hope to be done tweaking now and won't have to reinstall it again. With luck the icon problem will cure itself like it did once before.

Thanks!

[mjc]

I wouldn't be surprised if the AV is also doing some kind of checksum on each partition...

[Sylvander]

"the WMP icons came back. Adding a new partition on the second disk killed them again"
Was WMP originally installed on C:?
And is WMP now installed on C: [by restoring a backup image of C: to C:] and at the same location as originally?
The icons for the files opened by WMP [as the default player] are held in the exe file for WMP.
So the location of WMP [wmplayer.exe] is used to find the icons.
The location would be registered in the registry against each data file type for which WMP is the default player.
You could check them and fix them either from inside the registry [using regedit], or from outside the registry using "Windows Explorer->Tools->Folder Options...->File Types". [see the images below]

[Sylvander]

Here are the settings inside the registry that are being displayed in the form shown above...

Go to:

1. "HKCR\.mpeg"
And read the Default->Data = "mpegfile". [image 1 below]

2. "HKCR\mpegfile\DefaultIcon"
And read the Default->Data = "C:\PROGRA~1\WINDOW~2\wmplayer.exe,-120". [image 2 below]
120 is the identifying number in the "wmplayer.exe" file that is given to this icon.
[Usually the icons are numbered 1, 2, 3 etc up to as many icons held in the file. Only 2 icons are displayed above and yet the number is 120 :confused: ]

[Sylvander]

I was reading something recently about long filenames that might explain your problem.

Windows uses long filenames right?

Does Ghost make cluster-for-cluster images?
Or does it backup files and folders and keep them in that [compressed] form in the backup? [With LFN's truncated to DOS aliases]
If the files were restored by Ghost with the folder and file names altered, then many things would not work because they would no longer be at the same addresses [as recorded in the registry].

A LITTLE ASIDE
-----------------------------------------------------------------------
I've been trying to deal with the bigger problem of folders and/or files that no longer link back to the file tables [have become lost fragments or chains].
These therefore become unseen/unseeable by the OS [Windows] though drive editors can see them.
They occupy space on the drive, are registered as "Invalid Long Filenames" [BY Microsoft Scandisk etc], cannot be deleted or defragmented by Windows, just sit there occupying space on the partition making that space unusable.
Managed to eliminate one portion of one of these "lost chains" for a folder name [by marking it as deleted using "DiskEdit" and then using Eraser within Windows to write zeros to "Unused Space" on the partition].
Seems [in the FAT system?] a long name is made up of a number of [normally unseen] "files" which should be linked together.
-----------------------------------------------------------------------

[sburtchin]

"Was WMP originally installed on C:?
And is WMP now installed on C: [by restoring a backup image of C: to C:] and at the same location as originally?"
YES (actually G: and still G: ) and NO (new HDD, very different partition layout)
It is a dual-boot the "Microsoft" way with Windows 98 on C: (FAT32) and Windows 2000 on G: (FAT32). This is one method of multibooting I'll never do again:mad:!

""Windows Explorer->Tools->Folder Options...->File Types""
I did this already and the dialog already had the right icon selected. Just clicking "OK" (without making any changes at all) fixed it for the rest of the session, but after a Restart the icon was lost again. But once again Windows repaired itself after about 6 or 8 hours runtime, and all is good and well with no action on my part:confused::D.

I think Windows is constantly checking and tweaking itself. For example, recently I was logged in about 2 hrs and a message popped-up that Windows 2000 had finished installing new hardware (I had added some logical partitions on the second HDD, but sometimes I make partition changes and never get the pop-up:confused:). Sometimes there is lots of HDD activity when I am doing nothing.

"Does Ghost make cluster-for-cluster images?
Or does it backup files and folders and keep them in that [compressed] form in the backup? [With LFN's truncated to DOS aliases]"
Ghost makes file-by-file images when it understands the filesystem, and sector-by-sector images automatically when it does'nt. I don't know how the data is stored in the image, but the LFN's are there somewhere (just a guess, but if I were the programmer I would store them separate from the file content just as most filesystems do). Ghost also captures the boot sector and other important stuff not contained in files.

I have'nt made the switch yet to IforD because Ghost is so amazingly smart. For example, when I restored C: Ghost automatically updated BOOT.INI, BOOTSECT.DOS, BOOTSECT.W95, and \CMDCONS\BOOTSECT.DAT. It will restore to any partition big enough to hold the defragmented files. The restored partitions are defragmented much better than Windows DEFRAG can do! How :cool: is that! Too bad Symantec had to kill Ghost:(.

"I've been trying to deal with the bigger problem of folders and/or files that no longer link back to the file tables [have become lost fragments or chains].
These therefore become unseen/unseeable by the OS [Windows] though drive editors can see them.
They occupy space on the drive, are registered as "Invalid Long Filenames""
I'm not sure if this is related to your problem, but here goes: FAT16/FAT32 use hidden directory table entries to store LFN's. There is normally no file associated directly to these entries. NTFS is much smarter. It matters when copying files from one partition to another the order in which they are put into the new partition, because this determines the DOS-equivalent name that is associated to the LFN. I don't remember the details, but I think it had to do with the use of XCOPY. This can cause programs that rely on DOS equivalents to stop functioning. Many of the new backup programs (eg. SyncBack) make individual file (or zipped file) backups rather than the traditional backups where everything is compressed into one file. I don't know how reliably these would handle LFN's with FAT filesystems because the target market is mostly NTFS.

How can I find out if I have any "Invalid Long Filenames"?

[Sylvander]

"new HDD, very different partition layout"
I think that doesn't matter; just so long as the programs were originally on G: and the addresses for things [in the registry also on G:] are all on G: listed in that registry, and they are now on G: then everything is at the correct address and should work.

"but after a Restart the icon was lost again. But once again Windows repaired itself after about 6 or 8 hours runtime, and all is good and well with no action on my part"
Strange eh? :confused:

"Sometimes there is lots of HDD activity when I am doing nothing"
Process Explorer could help tell you what's active at that time.
I found that happening and Process Explorer let me know it was the hibernation file [hiberfil.sys] that was causing that. Seems that when Windows is 1st loaded it takes some time for hiberfil.sys to be built. During that time, %CPU usage is high; once completed the %CPU usage drops back down to a low level.

"I was logged in about 2 hrs and a message popped-up that Windows 2000 had finished installing new hardware "
I had that happen and it made sense to me at the time, though I've forgotten it now.
Something like...
My shredder is on the same set of extension sockets as the PC/printer/USB-HDD/monitor/speakers.
When I was shredding, the power drain had an effect on my PC's PSU [which is rather inadequate I'd guess]].
The PC auto-disabled my "Universal Card Reader", and a warning was displayed that the device had been "improperly removed".
I vaguely remember that because of the rejuggling of "devices" it was reported that a new device had been detected and was automatically installed [my Windows installation file set is on my G: partition, so any files/drivers needed would be automatically fetched].
I remember thinking it was the REMOVAL of something that caused this, which I thought particularly memorable.

"the LFN's are there somewhere"
Do you think Ghost handles LFN's OK?
The stuff I was reading said that certain [DOS-based?] programs couldn't handle LFN's, and they'd be lost.

"Ghost is so amazingly smart"
I imagine there's a risk that those "smart" things might go wrong.
Keeping it simple involves less risk.

"How can I find out if I have any "Invalid Long Filenames"?"
I use the EBCD "Microsoft Scandisk" to scan the file systems on the partitions on the internal HDD [having added USB-for-DOS drivers to the EBCD it can also scan my external USB HDD]; that detects and warns of "Invalid Long Filenames" [but cannot fix them].
The EBCD "DiskEdit" program does an even better job...
When you use it to go to a partition, the 1st thing it does is to scan the contents for errors.
What it found on mine were these invalid LFN's and it displayed them in a list [3 items]...
Then I use the mouse cursor to highlight one of the errors and click "GoTo" and it jumps to highlight the 1st part of that location on the partition.
What I then did was to enable writing to the drive [reconfigure that]...
Then placed the cursor at the 1st character [by clicking on it]...
Then hit "Ctrl+E".
My instructions said this would replace that 1st character with a sigma character, which would mark the file as deleted.
It didn't do that...
Instead, what happened was...
"Deleted" was added a few characters to the right.
[Erased things were marked "Erased" with date and time, with lots of zeros filling the space]
I've since discovered I should have done this to all the [linked?] parts of the LFN to delete them all.
After I'd used "Eraser" to write zeros to the "unused space on the partition" and come back in with "DiskEdit", [the deleted part was "Erased", but] the remaining portions of that LFN were being reported [and I was having trouble placing the cursor on the 1st character].
These are strange regions to me and I want to move with care.

[sburtchin]

"Process Explorer could help tell you what's active at that time."
Nice program! I should spend more time at microsoft.com to see what other nice tools they have for free. The incessant HDD activity has stopped since I moved to the new HDD. Two things are different: There is over 1GB free space here vs. about 400MB before, and this one is formatted FAT32 (vs. NTFS). I think NTFS constantly tweaks and defragments itself. That may have been most or all of it. But I think I remember a lot of HDD activity even when booted to the FAT32 partition on the old HDD - about 400MB free space there too - Hmmmm.....

AN ASIDE:
--------------------------------------------------------------------------
You're probably wondering how I converted my operating system partition to FAT32. I did'nt. I just did a drag'n'drop from the NTFS partition to the FAT32 partition in Windows Explorer, then booted the FAT32 partition and remapped it to G: with regedt32. After a restart all was well and good:)! (The one caveat is that you can't be logged into the source partition while copying the files. Also, my boot sector and NTLDR are on C:.) I ran this way for about two months without ever noticing any problems before changing to the new HDD's.

Why FAT32? NTFS is probably better for Windows 2000 (microsoft says so), but in my old configuration, the program files were on a separate partition D:. So to make the move I need a primary for C: (NT boot sector + Win98), a logical for G: (Win2000) a logical for D: (Win2000 Program Files - this partition occurrs after my "Data Share" partition on the second HDD) and a logical that Win98 thinks is D: (Win98 Program Files). I'm stingy with partitions, so I put the Win98 Program Files on the same partition with the Windows 2000 operating system. This is all legacy stuff and these three partitions will be wiped clean (other stuff is planned for them) when I finish configuring clean (and independent!) installs of Windows 98 and Windows 2000 on other partitions.
--------------------------------------------------------------------------

"Do you think Ghost handles LFN's OK?
The stuff I was reading said that certain [DOS-based?] programs couldn't handle LFN's, and they'd be lost."
I think it handles them them VERY well! I have never had a problem related to LFN's (that I am aware). Any DOS program has to be evaluated on its on individual merrits; COPY, XCOPY, Volkov Commander, etc. Ghost was built for the corporate marketplace, and then crippled to create a consumer product, so it has years of intense scrutiny by IT departments paying big bucks. In Ghost I trust, but for many programs on EBCD I learn them in case I ever need them, but for routine movement of important data I trust (current) Microsoft most for moving data on Microsoft filesystems. IforD is DOS based too, but I think imaging programs in general get intense scrutiny for how they handle LFN's, because if they did'nt do it right there would be lots of complaints.

"I imagine there's a risk that those "smart" things might go wrong."
IforD has some complex options when you use it from the command line. I'm still trying to figure out what some of them do. I'm much more wary of the programs that are super-easy to use and marketed only to consumers. I think most imaging programs tweak the 'actual' boot sector and have provisions for updating "boot.ini" too.

"I use the EBCD "Microsoft Scandisk" . . . The EBCD "DiskEdit" program does an even better job..."
I'm staying away from SCANDISK, but I will give Norton DiskEdit a go.

[mjc]

Well, M$ just picked up that whole batch of tools over the past few months...before they were Sysinternals and well...I feel a rant coming on and won't go there...

[sburtchin]

Oh please do..... Maybe someday M$ will be the only software supplier and we won't have to look anywhere else!:)

With no competition they can lower their production costs and pass the savings to us:D! Right?:( Get ready!:eek:

[mjc]

The basic rant goes something like this...

Sysinternals existed for a long time making small, useful programs that either beat the MS item, hands down or did things that MS just didn't want to do. Instead of MS trying to make their product better, the gave the founder of Sysinternals a job offer and big salary...and a promise to keep his stuff available...but how long it will remain is a big question.

Whether or not the products will be updated any longer is also in question...

And now you have to go get them from an MS download site....

And...

...

[sburtchin]

I think they give you a tube of that for free now with each M$ purchase!

The Sysinternals product I wanted was NTFSDOS. I see they have not included it in their list of downloads. On their forum they state that they also do not have any plans to add it, but if there is enough consumer demand then they will:rolleyes:. I'm not sure I'll live that loooong. Their hidden agenda is becomming more clear:(.

[sburtchin]

So the location of WMP [wmplayer.exe] is used to find the icons.
The location would be registered in the registry against each data file type for which WMP is the default player.
You could check them and fix them either from inside the registry [using regedit], or from outside the registry using "Windows Explorer->Tools->Folder Options...->File Types".I thought the problem fixed itself again, but it was temporary:confused:. Apparently it has something to do with either how long I am logged in, or something I do during the session. Just playing one of those files does'nt fix it. I can fix it for my current session with the "Windows Explorer->Tools->Folder Options...->File Types" method you explained, but this fix is only good until I shut down. The first time the correct icon was already selected and I just clicked "OK" (without changing anything) and the problem was (temporarily) fixed:confused:. Today I tried the same method, and it said "Cannot find G:\PROGRA~1\WINDOW~2\wmplayer.exe". Then I clicked "Browse...", found it, and that fixed the problem (temporarily).

I suspect (strongly) that the problem has to do with mis-assignment of LFN's (remember how I got Windows 2000 from NTFS to FAT32)."[COLOR="Blue"]You're probably wondering how I converted my operating system partition to FAT32. I did'nt. I just did a drag'n'drop from the NTFS partition to the FAT32 partition in Windows Explorer, then booted the FAT32 partition and remapped it to G: with regedt32. After a restart all was well and good:)! (The one caveat is that you can't be logged into the source partition while copying the files. Also, my boot sector and NTLDR are on C:.) I ran this way for about two months without ever noticing any problems before changing to the new HDD's.Maybe this problem was there and I just did'nt notice. Is there any way I can get a list of DOS short filenames and directory names (having same first 6 characters) so I can check to see if any have been assigned to the wrong LFN?

I have determined that my Windows Media Player program is at "G:\PROGRA~1\WINDOW~3\wmplayer.exe". So now I know the cause of this specific problem, but completely confused why it sometimes fixes itself (and temporarily too!):confused:. Any ideas on how to rematch the SFN's to the correct LFN's?

[Sylvander]

"but this fix is only good until I shut down"
So it's as if...
When you restart...those new registry settings are gone?
Could it be that Windows is unable to boot using that copy of the registry [due to the changes in it?], and automatically reverts to the copy before that which is a working copy?
And in that copy, those settings don't exist?
Could the settings you added cause a boot to fail?
I wonder if running a "Registry repair program" is called for?

""Cannot find G:\PROGRA~1\WINDOW~2\wmplayer.exe""
G:\PROGRA~1\WINDOW~2\wmplayer.exe data setting in the "Shell\Play\Command" key should [probably] have quotes around it to cater for LFN's and long addresses with spaces in them.
Here's one of my settings...
"C:\Program Files\Windows Media Player\wmplayer.exe" /Play "%L"
I copied and pasted this, so it's exactly as in the registry, quotes and all.
Notice the names in the address have spaces in them which must be catered for by using the quotes.

"Any ideas on how to rematch the SFN's to the correct LFN's?"
Can't think of anything "straight off the top of my head", though I vaguely remember reading of a program that restores LFN's.
Do the LFN's show OK in Windows Explorer?
Learned recently that LFN's [on FAT partitions] are held in multiple files on the HDD partition [I viewed them with the EBCD DiskEdit prog], so much of a file name to each file.
I marked one of those [folder] file name files as "deleted", and once back in Windows, the folder name had changed to a truncated DOS equivalent [well it would if part of its name had just been deleted].

[sburtchin]

"So it's as if...
When you restart...those new registry settings are gone?
Could it be that Windows is unable to boot using that copy of the registry [due to the changes in it?], and automatically reverts to the copy before that which is a working copy?"
It more as if the settings never get to the registry.

The key
HKEY_CLASSES_ROOT\mpegfile\shell\play\command
has the value
"G:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:9 /Play "%L"
(has quotes) which explains why I have no trouble playing the files.

The key
HKEY_CLASSES_ROOT\mpegfile\DefaultIcon
has the value
G:\PROGRA~1\WINDOW~2\wmplayer.exe,-120
which explains why the icon is not associated since the SFN of the second level directory where "wmplayer.exe" can be found is "WINDOW~3". After fixing the icon in Folder Options, this registry value gets changed to the following
G:\Program Files\Windows Media Player\wmplayer.exe,1
no quotes! I could probably fix this one icon by changing "~2" to "~3" in this registry key. By this method I probably have a few hundred more (or even more) registry keys with SFN's to evaluate whether they associate with the correct LFN, and then fix the ones that don't. Not sure if that is feasible in my lifetime! Probably easier to fix the filesystem.

I think what's happening here is that for some keys, the LFN's get converted (incorrectly) to SFN's on the next boot. Seems like this should produce the correct result:confused:. And sometimes it fixes itself (temorarily):confused: :confused: .

"Do the LFN's show OK in Windows Explorer?"
I see only the LFN's in Windows Explorer. I wish there was a way I could see the SFN's too.

"Learned recently that LFN's [on FAT partitions] are held in multiple files on the HDD partition"
Actually, on FAT partitions, the LFN's are held in multiple directory entries (as many as needed depending on the length of the LFN). When you look next time, notice that each one is 32 bytes and that they line up in a nice neat column. The association between the LFN and the SFN is determined by their positions in the table relative to eachother. So I guess I could fix one by swapping SFN's in the directory table --- Yikes:eek: I'll have to REALLY want to before I attempt THAT manually!

ASIDE
--------------------------------------------------------------------------
I wonder if you give a long name, and later shorten the name, if those extra directory table entries (not being used anymore) become lost and unavailable --- like the problem you said you were having. I wonder if they get reused if you lengthen the name again. If you make the name longer than the original (by enough to require another 32 byte entry) then I think it must get moved to an entirely different place in the table, as it would no longer fit at its original location. At least for files in the root directory because that table is at a fixed location on the disk --- Unless the whole table gets re-written with each change in order to keep things compacted:confused:.
--------------------------------------------------------------------------

[Sylvander]

"Not sure if that is feasible in my lifetime!"
There might be a way!
If you could export either the whole registry or just the "HKEY_CLASSES_ROOT" branch to a ".reg" file; open it in Word, then "Find & Replace" G:\PROGRA~1\WINDOW~2\wmplayer.exe,-120 with G:\Program Files\Windows Media Player\wmplayer.exe,1, and import the changed file.
Make sure you keep 2 copies of the reg file; one changed, one unchanged.
Every time I tried to export the whole of my registry to a reg file it didn't complete; guess the file or the job was too big. :(
But it's worth a try.

"like the problem you said you were having"
I've decided that this "problem" was just the inability of "MS Scandisk" and "DiskEdit" to handle LFN's adequately, because when I run "chkdsk" in a DOS command window within Windows it reports NO PROBLEMS with "Invalid Long Filenames" at any location.

"If you make the name longer than the original (by enough to require another 32 byte entry) then I think it must get moved to an entirely different place in the table, as it would no longer fit at its original location"
Sounds right to me.

"I wonder if you give a long name, and later shorten the name, if those extra directory table entries (not being used anymore) become lost and unavailable"
Surely they just get marked as "Deleted", and the space becomes available.

"I wonder if they get reused if you lengthen the name again"
Wouldn't it just be the normal matter of chance which available space is used; Windows not being so smart as to know to use that particular space.

"Unless the whole table gets re-written with each change in order to keep things compacted"
That would make sense; kind of silly if the designers arranged to use spaces for folder names scattered all over the place.

[sburtchin]

Thanks for the advice:). I mainly wanted to understand the problem and fix it too if not too involved. I previously planned on doing a clean installation of Windows 2000 to another partition, so eventually this one will get trashed. This installation was not well documented or imaged regularly, and probably has a lot of small problems that have accumulated over the years --- hence why I had a fresh install planned. I'm now keeping good records and system images regularly. Before my focus was mostly on data backups.

"There might be a way!
If you could export either the whole registry or just the "HKEY_CLASSES_ROOT" branch to a ".reg" file; open it in Word, then "Find & Replace" G:\PROGRA~1\WINDOW~2\wmplayer.exe,-120 with G:\Program Files\Windows Media Player\wmplayer.exe,1, and import the changed file."
My comment about feasibility was referring to the fact that there are many filetypes not finding their icons, and there are hundreds of SFN's that could potentially not be associated correctly (and causing other small problems not known to me). It's a nuiscence I can live with until I get my new installation properly configured:). It is interesting that the ",-120" got changed to ",1". Even more interesting is that this time the registry kept the last fix I made in the Folder Options:confused:.

Have you ever noticed a wrong association between a SFN and LFN with your Windows 2000 on FAT32?

"Surely they just get marked as "Deleted", and the space becomes available."
I agree, as that would be the obvious best method. I was fishing for an explanation to the lost clusters you reported.

""Unless the whole table gets re-written with each change in order to keep things compacted"
That would make sense; kind of silly if the designers arranged to use spaces for folder names scattered all over the place."
My guess is that the option requiring the least movement of data is always chosen and the whole of the (root) directory table is only rewritten when you defrag. May be different for sub-directories since I think those tables are kept in (hidden) files.

[Sylvander]

"Have you ever noticed a wrong association between a SFN and LFN with your Windows 2000 on FAT32?"
No.

"I was fishing for an explanation to the lost clusters you reported"
Don't you mean lost chains and file fragments?
I noticed only yesterday that when something went wrong with a program and Windows froze and I was forced to switch off...
That when I rebooted...
Even though there was an automatic scan by chkdsk at restart, and problems were found and fixed...
The program [Firefox] wasn't working correctly.
And I was able to fix that by scanning the file system using MS Scandisk and repairing broken links in the file chains.

[sburtchin]

"Don't you mean lost chains and file fragments?"
Yes

"Even though there was an automatic scan by chkdsk at restart, and problems were found and fixed...
. . .
And I was able to fix that by scanning the file system using MS Scandisk and repairing broken links in the file chains."
Sometimes I get the automatic chkdsk scan, but never had a filesystem problem on this computer yet - (keeping fingers crossed).

[Sylvander]

"never had a filesystem problem on this computer yet"
Ah, but have you ever scanned using "MS Scandisk"?
My PC seems in good shape; generally works well and gives little trouble.
And yet, when I scan [during one of my regular checks] using Scandisk, there is often a problem or few that it fixes [seems things go wrong not so infrequently].
Just recently I scanned the the file systems on the partitions on my external USB HDD using chkdsk [in checking mode] running in a DOS command window within Windows, and it found a problem [turned out to be a "Lost chain"; in fact a lost ".img" backup file].
I decided to double-check it using the EBCD "MS Scandisk".
It found the "lost" file and recovered it as "FILE000.CHK".
When I booted back into Windows [after taking a look at it] I "Erased" it.

[sburtchin]

"Just recently I scanned the the file systems on the partitions on my external USB HDD using chkdsk [in checking mode] running in a DOS command window within Windows, and it found a problem [turned out to be a "Lost chain"; in fact a lost ".img" backup file].
I decided to double-check it using the EBCD "MS Scandisk".
It found the "lost" file and recovered it as "FILE000.CHK"."
I have done this in the past with SCANDISK, but now I stay away from it because others have warned me that panicks and marks amny good sectors as bad.

What is "checking mode"? Do you mean "/F"? In fact I did have once a minor problem on EVERY partition and "CHKDSK /F" fixed them. I only found it by accident when testing the NTFSDOS version of CHKDSK from EBCD. I don't remember any lost chains being converted to files that time. Running CHKDSK again (w/o "/F") it reported "no problems found".

[Sylvander]

"What is "checking mode"? Do you mean "/F"?"
No, that's the "fix" switch.
The basic chkdsk command [with no switches] only checks all drives/partitions for errors [read-only]; doesn't apply any fixes [no writing].