Changed OS drive to windows 11 - all was ok but then started getting 0byte files, file system damaged / now ok?

[Slamdunk]

I recently replaced my main OS drive (old harddisk / not part of the pool) that was running WHS2011 to a new SSD running Windows 11. No other hardware was changed and I removed the storage drives whilst the OS change happened (3 drives)

Having re-installed the drives they all were recognised correctly and I was able to rebuild the pool and activate my licence. Everything seemed ok.

As a matter of caution I started a full disk scan using Stablebit Scanner - I *think* this is where things started going wrong. It advised that all disks and the pool drive had a damaged file system. That said, everything still seemed ok. No bad sectors found, no issues with SMART etc...

However, over the next few weeks I noticed an increasing amount of files starting to show 0 bytes and not being able to be opened. It seemed quite random but was getting increasingly worse. At this point could then hear the server accessing the Drive(s) a lot (constant writing sounds) and shut down the machine as I was going on holiday (Machine is an HP Microserver that is used mostly for file sharing).

Had a moment to do some research, reached out and raised a support ticket. Fired the machine up and ran chkdsk /r /f on one of the drives (the smallest one) - this took many hours and I never saw the result as it had to do a reboot to initiate etc..

However, I then reset the status of the affected drive in Stablebit and it was now healthy - just to check  I reset the other drives and they were also now also showing healthly (I hadn't run chkdsk /r/f on those). 

 

I guess I am now looking for advice for next course of action. I have a lot of files with 0bytes on them. I already did some more research and reset all the drive security permissions as they did not match the expected structure shown here 

 

Example - one drive went from this

to this

Have cloud backups (backblaze) so should be able to manually restore but really looking for any thoughts on what may have caused the problem and the best way to properly identify all files and the safest way to replace the damaged ones.

Not knowing the start point I am worried about just restoring files at random/manually. I also think there are a lot of random files that were affected so not really sure on how best to go about finding them all/replacing 

Appreciate any advice

Thanks

 

 

 

[Slamdunk]

Thanks for this Shane

I just went digging in the eventviewer and found 4 logs 

3 all generated at the same time (1 for each of my pool disks) - this is likely when the first scan on new OS was started, although I can't be certain. In there it shows several thousand files all with this style of error

The sparse flag in standard information attribute in file 0x123
should not be set.
Correcting sparse file record segment 291.
corruption found and fixed.

It was after this date I noticed the 0 byte files and lots of harddisk activity.

I can then see the chkdsk /f/s log that I started and during that process it states "Windows has made corrections to the file system.
No further action is required."

This was only for one drive but all three now pass the Stablebit file system check. I will find the appropriate slot to start the full sweep just in case

 

[Shane]

Hi, your example screenshots have broken links.

You can normally find the results of a chkdsk, that required a reboot, in the Windows Event Viewer. If the 0 byte files are appearing on other drives I would suggest running chkdsk on those as well (or just every drive).

File table structures can be damaged without necessarily involving bad sectors; it can also be due to malware, loose/dirty connectors, bad RAM, dodgy controllers, Windows Update SNAFUs, power supply issues, etc.