File Corruption Occurs on an NTFS Volume with More Than 4 Million Files

ID: Q229607

The information in this article applies to:

Microsoft Windows NT Server version 4.0
Microsoft Windows NT Workstation version 4.0

SYMPTOMS

When you create and delete files on an NTFS volume that holds more than 4 million files, you see file corruption that may show up in one of the following ways:

Deleted files continue to be displayed on the drive.

Files that you have not deleted are no longer accessible.

A pop-up message is displayed reporting that corruption has been detected on the drive and requesting that you run CHKDSK.

CAUSE

This problem occurs when the Master File Table (MFT) has grown larger than 4 GB, which may happen when you have more than 4 million files on your computer. When you delete a file whose MFT entry is beyond the 4 GB point under these conditions, an error in calculations causes the wrong entry to be marked as available. If this entry contains information for another file, and new files are added to the volume shortly after the deletion occurs, the entry could be re-used causing the file it actually referenced to be lost.

RESOLUTION

A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Windows NT 4.0 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or later:


   Date      Time      Size      File name  Platform
   --------------------------------------------------
   04/15/99   05:44p   363,088   Ntfs.sys   x86
   04/15/99   05:42p   559,248   Ntfs.sys   Alpha

NOTE: If this product was already installed on your computer when you purchased it from the Original Equipment Manufacturer (OEM) and you need this fix, please call the Pay Per Incident number listed on the above Web site. If you contact Microsoft to obtain this fix, and if it is determined that you only require the fix you requested, no fee will be charged. However, if you request additional technical support, and if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support, you may be charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the following article in the Microsoft Knowledge Base:

Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS

Microsoft has confirmed this to be a problem in Windows NT 4.0.

MORE INFORMATION

Information on all files in an NTFS volume is stored in the MFT. The MFT contains one or more an entries for all files on the system. In addition, the MFT maintains empty or unused entries which can be used for newly created files. When a file is deleted, it's entry is marked as being unused so that when a new file is created, the file system can re-use the entry.

Additional query words:


Keywords          : kbbug4.00 kbfix4.00 
Version           : winnt:4.0
Platform          : winnt 
Issue type        : kbbug

Last Reviewed: July 2, 1999