A good thing with Windows 10

You can thank NTFS for that.

NTFS is a journaling file system so it keeps a log of any proposed disk changes before it actually makes them. If an operation is successful it is marked as complete and gets removed from the log.

Every time Windows starts it runs a mini version of CHKDSK but it only has to scan the log file for incomplete operations, not the entire disk.

If an incomplete entry is found then NTFS rolls back the whole operation. This protects the disk structure but sadly not the data.

Im just going to describe one of NTFS’s self healing features here because I can’t help myself ?

With the FAT system an entry in the file allocation table points to the first cluster of a file and then that cluster points to the next cluster in a linked chain. The last cluster in the chain is marked as end of file instead of pointing to another cluster.

If a cluster goes bad then you will loose all of the file past the bad cluster at the very least because there is now no way to find the next cluster in the chain.

NTFS stores file records in the Master File Table and it works in a different way. NTFS stores file data as contiguous RUNS of sectors and the file record contains the runs starting cluster and its length. If data is appended to a file then a new run is created and added to the file record.

You can probably see how this prevents lost clusters and cross linked clusters but its better than that because of virtual cluster numbers (VCN). The file record actually stores a run’s starting cluster as a Logical Cluster Number (LCN), VCN pair. The LCN represent the physical clusters on the disk, starting at 0 and continuing to the end of the disk. The VCN represents a clusters position within a file, starting at 0 and continuing to the end of the file.

If a cluster goes bad then NTFS can map in a new one and here’s how its done.

Say a file has just one run with a starting VCN of 0, a LCN of 100 and a length of 10 clusters. If a cluster, lets say 105, goes bad then NTFS will amend the length of the original run to 5 and then create a new run with just one cluster in it, starting with VCN 6 and pointing to a new good cluster. NTFS will then create a third run starting with VCN 7 and a length of 4 containing the rest of the LCN’s.

So you now have three run’s instead of one but the file is still valid with the VCN’s sill running from 0 to 9.

If you happen to be running software raid then the Windows Volume manager will fill the new cluster with data from the copy but even if you are not then loosing just one cluster may not matter much in say a jpeg file.

Wheels-Of-Fire wrote:

Im just going to describe one of NTFS’s self healing features here because I can’t help myself ?

That changed over the Win8/10 period and is the main reason that dual booting Win10 with earlier versions of Windows is fraught with issues if you have and use config (or similar) files in the earlier version. Windows seems to treat these like Win10 owned system files and keeps a hash or something of their contents. If the earlier version changes this config file, Windows 10 will ‘helpfully’ repair it as soon as it is booted. This causes issues and can even result in corrupted files in the earlier version.

Best not to use dual boot, and frankly with the speed of modern VMs there is no real excuse to do so.

I will also mention that if you have a BIOS system you do not “Have” to have a System partition.  If you let Windows 10 setup partition your drive you will get one but if you have an existing version of XP installed you won’t. In this case the boot manager and config files are put in a Windows partition.

I must admit I have not seen the Windows did not shut down properly screen in a while but I don’t know what’s changed exactly. I do know if you shut down Windows 10 improperly 3 times in a row it presents you with recovery options so maybe they just added a counter ?

If you start any version of Windows in safe mode it will list the drivers it is loading as in your screen shot.