How to unmark an NTFS cluster as bad?

Question

How do I unmark clusters as bad in NTFS?

Background

I mistakenly ran

>chkdsk /R

on my SSD, where

/R: Locates bad sectors and recovers readable information (implies /F)
/F: Fixes errors on the disk

And now i have a cluster marked as bad on my drive. I need to un-mark that cluster as bad.

Note: chkdsk has an option to re-evalute a cluster and return it to use:

/B: NTFS only: Re-evaluates bad clusters on the volume (implies /R)

Unfortunately that option will only un-mark the cluster if it is no longer bad. I need the cluster to be un-marked regardless.

How do i un-mark an NTFS cluster as bad?

Why are you doing this?

It doesn't matter why i, and hundreds of others, are asking the question. But the problem is that there's a bad sector on my drive. It's time to replace the drive with a new one. The way to do that is to mirror the SSD onto another SSD using Windows software mirroring.

Unfortunately, a known bug in Windows NTFS mirroring prevents the mirror from completing, as documented in KB325615:

Cannot Create Software Mirror If Disk Contains Bad Blocks

DMIO operates below the file system, and if it finds I/O errors while reading from a sector on the source disk or while trying to write the data to the destination disk, it aborts the mirroring operation.

The obvious workaround was to shrink the OS volume, so that the bad sector is past the end of the volume. In Windows 7, when you attempt to Shrink a volume it will automatically move files out of the way.

This is a good thing. In the olden days if you wanted to shrink a volume, you had to use a defragmentation tool that would push all the files towards the front of the drive; leaving slack space at the end.

Unfortunately there is now an unmovable file in the way: $BadClus. The Shrink defrag operation notes the unmovable file in the Event Log:

A volume shrink analysis was initiated on volume OS (C:). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.

Diagnostic details:

• The last unmovable file appears to be: \$BadClus:$Bad:$DATA
• The last cluster of the file is: 0xdc1ded
• Shrink potential target (LCN address): 0xa91bd9
• The NTFS file flags are: -S--D
• Shrink phase: <analysis>

So:

• i can't mirror the volume until the bad sectors are removed
• shrinking the volume will remove the bad sectors
• i can't shrink the volume until the sparse $BadClus file is moved
• i can't move $BadClus while it physically occupies bad clusters
• $BadClus will physically occupy bad clusters while NTFS thinks the cluster is bad

How do i un-mark a cluster as bad?

For people ghosting drives, too

The solution for my problem would also work for the most common case:

Someone ghosts a drive containing bad sectors to a new drive, and then the good drive still has those clusters marked as bad, even though they are good. It so happens that they have a workaround available to them:

>chkdsk /B

Except that doesn't work in my case. (And even if it did work in my case, it's not the question i am asking.)

Bonus Chatter

Of course the Kingson SSD doesn't maintain spare sectors. If it did, it could transparently remap the spare sector for me, and i wouldn't have NTFS trying to over-think thinkgs.

SpinRite

i tried SpinRite'ing the SS drive. It comes across the defective sector, but is unable to get any values from the drive:

══════════════════╤═══════════════════════════╤═════════════════════════════════
cylinder : 7,183  │     data samples : 1,999  │  first uncertain bit : · · · · ·
  sector :    17  │   unique samples :     0  │   last uncertain bit : · · · · ·
    head :   187  │  discarded sples :     0  │   uncertain bit span : · · · · ·

The number of data samples counts up to 2,000, then cycles back to zero, and keeps going.

After about 20 loops (i.e. 40,000 data samples) i gave up.

Cloning

Again; lets not confuse the question with the example. The question is how to un-mark clusters as bad in NTFS. Long after i give up, and throw away the SSD, the question will still remain. Don't confuse my problem for the question. That doesn't mean that i might try to actually solve my problem:

DriveImageXML reaches the bad sector, and aborts.

GParted fails to load. A graphical boot screen appears, then a console window scrolls text by, followed by black screen nothing

Clonezilla refuses to clone my SSD:

This disk contains mismatched GPT and MGR partition: /dev/sdb
It will confuse Clonezill and might make the saved image useless or fail to clone the disk.

Please fix htis issue then restart Clonezilla again.
Program terminated.

How do i unmark a cluster as bad in NTFS?

Answer 1

I'll answer the title question nothing more.¹

First, do note that, if the sector is truly bad, unmarking it won't make it readable. So your cloning software is likely to choke on reading it instead.

In NTFS, a cluster is marked as bad by assigning it to a special stream, $BadClus:$Bad, a sparse file.

What you need is to

• edit its runlist to remove the corresponding allocated block(s)
• mark the corresponding cluster(s) as free in $Bitmap.

---

• To unmark all bad blocks, there's ntfsfix -b -d (-b=clear bad block list, -d=clear/don't set "dirty" flag) (another method with ntfstruncate does exactly the same²).

  • It might introduce minor inconsistencies into metadata (in my case, a few indices apparently became unsorted), I'm not sure why, so either run chkdsk -f by hand or omit -d to trigger it at Windows startup if / in case you get FS errors.

• To clear a specific block is much more difficult since I didn't find any existing software that can do this out of the box³. NTFS Bad Sectors Resolution: The $BadClus metafile - Katy's code describes the way - basically, it's editing the runlist and bitmap by hand.

---

¹ _{Only because handling bad sectors + NTFS + cloning is too broad a topic. I'll gladly answer ones directly related to the matter at hand.}
² _{checked the source code of ntfsfix v2015.3.14.}
³ _{for the insistent ones, these can't do it: ntfscat(can't read unreadable sectors),ntfscp(can't write to offset), ntfstruncate,ntfsfallocate,dd(can't open $BadClus:$Bad for writing)}

Answer 2

I had a hard drive that developed some bad clusters. I replaced it with a known good drive. The restore process restored the bad cluster data as well as the other data. This was on a Windows 7 Enterprise computer.

My solution was to run "chkdsk d: /b" (as has been suggested previously). The /b tells it (for NTFS only) to rescan previously marked bad clusters. At least in my case (and I would suspect all versions that support /b), it clears the bad cluster list immediately before beginning the read scan. Once you see the message "Removing X clusters from the Bad Clusters File" you should be able to kill the chkdsk process (as it is only reading data).

Note: The potential does exist for chkdsk to be updating the bad clusters file at the instant you kill the process if it happened to find a bad sector at the beginning of the drive. I took the risk and it successfully reset the bad clusters file without the need to download a bunch of other programs that require a full chkdsk afterward anyway. YMMV.

Answer 3

First the best way to go is to clone the drive. Then use chkdsk /B on the new working drive.

Now as far as unmarking a real bad sector that is tricky. You could use:

• SpinRite, or
• mhdd (turn remap ON)

Either product should remap the bad sector then CHKDSK /B should unmark it.

Download gparted or partedmagic ISO. Boot from it, and shrink the partition.

This will work because windows is NOT running so this software shrink the partition no matter what. Then chkdsk /B will handle the rest.

If all this fails you are now in for an ugly road of pain. You need to get a sector editor and manually edit the file system. Unfortunately, it is beyond the scope of my knowledge for NTFS. For FAT or FAT32 it is super simple.

Answer 4

Since you are trying to mirror your disk (and it appears you are using Windows 7), there is another approach:

Use the built-in tool to create a backup to be restored on a good disk. Go to Control Panel, System and Security, Backup. There, create a system image and also a system repair disk.

After that, you can replace the old faulty disk with a good one, then retore the system to its state using the system repair disk and the backup made.

Answer 5

It looks like your goal is to shrink the size of the partition, and that Windows will not shrink it because of the $BadClus file, which exists due bad clusters.

I have an alternate solution for you which should shrink the drive without having to directly deal with the $BadClus file. Use Partition Wizard to shrink the partition. Partition Wizard is easy to use, is free for non-commercial use, can be run from inside Windows with a GUI, or from a CD or USB boot which runs a small Linux then gives you the same GUI. This program can also recover erased partitions, and convert between MBR and GPT partition tables.

I have run into problems with Windows not shrinking a partition past a certain point, then I will try Partition Wizard on the same partition which does it with no problem. I suppose the Partition Wizard is willing to ignore the $BadClus file. I have been using this program for over 8 years and finally bought the Pro version, because they earned it. I found this program as a replacement for PQMagic that I bought in 1996, which was a fabulous DOS partitioning program for smaller drives.

Answer 6

The GNU ddrescue data recovery tool should do the job for you.

Grab a SystemRescueCD ISO, put it on a USB (or CD), boot the USB, then clone the SSD by issuing this command in the terminal:

ddrescue --force /dev/sda /dev/sdb ./ddrescue.log

where /dev/sda is the source and /dev/sdb is the target SSD. You can run lsblk -f to help you identify the drives. Double-check the drive names or you risk losing all your data.

ddrescue will try to recover the bad block and if unable skip it.

When finished, running chkdsk /f /b on the partition in Windows should complete the job.