WinXP CHKDSK, Unused Index Entries

Tecknomage wrote:

Running *WinXP SP3*

When I run CHKDSK (/f/v) on 3 of my hard drives I get the following:

Cleaning up 1 unused index entries from index $SII of file 9.
Cleaning up 1 unused index entries from index $SDH of file 9.
Cleaning up 1 unused security descriptors data stream.
Fixing mirror copy of the security descriptors data stream.

Search on MS Support returns:
http://support.microsoft.com/kb/831374

Fix download top of page gets a ZIP containing 2 *Win Server 2003*
'fix' files.

No *clear* instructions for use on WinXP.

Clarification please.

That KB article first lists a Windows 2003 Server section. The Windows
XP section is farther down the page. Scroll down.

It says there was a problem with chkdsk resetting undiscovered security
indexes (those not associated with a file definition) under certain
conditions. Did you exceed those conditions? The recommended cure for
Windows XP is to obtain the latest service pack. Yet you say that you
already have SP-3 for Windows XP, so that article won't help you.

From what I read, the above occurs due to open files. Redundant info is
out of sync for the open files which gets in sync when they are closed.

Another cause is deleting a file/folder that had custom permissions
defined for it. When deleting a custom-permissioned file or folder, the
ACL is not deleted but is instead cached. "chkdsk /f" removes the no
longer valid ACLs. This is normal behavior.

If you restore a lot of files from backups and where you opted to
include NTFS security information (and to restore it on recovery), it's
possible the security descriptor was not written correctly. There is a
specific format for this, like making sure on a file restore that 20
bytes are left at the end of the security descriptor block to handle a
security descriptor header. After a file/partition restore and where
NTFS permissions were included (in the backup and then again in the
restore), it's possible some files lost their user-defined permissions
and which got replaced by default permissions when you ran "chkdsk /f".
I remember seeing this with restores from NTbackup and xcopy (with the
/o [ACL info] and /x [audit] switches). I haven't use either in maybe a
decade so I don't know if service packs have updated these tools to
eliminate the loss of recorded permissions in the backup upon a restore
(and I don't recall seeing the "unused index entries" output when
running "chkdsk /r" but I can't check now since that requires a reboot).
So it's possible that your customized permissions for a file or folder
upon a restore from backups means you lost some after running chkdsk.

When you run chkdsk, have you exited all the running applications? Same
message occurs when you reboot into Windows' safe mode and rerun chkdsk?
Do any major file manipulations before running chkdsk, like restore from
a backup, clone partitions/drives, or use some automatic backup backup
utility (e.g., Comodo's Time Machine)?