File corruption mistery

[miloske]

I consider myself an experienced user. I've worked as computer repairman and I have experience administering Windows and Linux OSs, I also have MCSA certificate. Still, there are some issues I simply don't understand.

Some time ago on my laptop - Acer E1-531, Win 7, 64 bit; I moved some files from one folder to another on the same partition. I used Total Commander for that task. Files were encrypted with EFS. After I've moved the files (mostly JPEGs) I was no longer able to open them. Approx. 90% of the files appeared corrupt. I copied a sample of those files, punched chkdsk /f and rebooted computer. After this operation almost all of the files were again readable. I scanned my computer after this with DDS and OTL and everything was clean, as it was a few days before the incident when I had performed another such scan. There doesn't seem to be any issues with HDD either. I took the copy of the corrupt files to my other computer where I had backup of the same files. Files from my laptop were indeed corrupt, I couldn't open them on another computer and when I ran md5 sums on them, the corrupt files produced different hashes.

I use Avast 8 Free Edition with File System shield stopped, I know this is somewhat unsafe, but it speeds up hdd operations a bit and I haven't had a virus infection in 6 years.

I had backup, so no files were lost, but I can't understand what happened here and why it happened and this bothers me. As far as I know when files are being moved on the same partition the files themselves are not read/written to, only MFT is changed. How could then files be changed? Could this be Total Commander issue. I know that it can mangle up ACLs on XP because it doesn't use default routines for copying/moving files, but could this apply on moving on the same partition?

Any ideas?

[miloske]

I forgot to say that CHKDSK didn't report anything out of the order.

[Allan]

Please run checkdisk the following way:  right-click on a command prompt icon and open as administrator. In the command prompt window type: chkdsk /r  (then press ENTER). You'll be told the disk is in use and asked if you want to run checkdisk on the next boot. Say yes, exit the command prompt window, and reboot.

[miloske]

This is exactly what I did after the problem occurred, chkdsk finished the scan and no bad sectors were found. There were only some unused index entries/security descriptors.

After that I ran CHKDSK on other partition on my hard drive and everything was OK too. I've been using the same laptop for more than a month now and I didn't have any more problems.

[Allan]

Your first post says you ran chkdsk /f. Did you run it with the /f switch or the /r switch?

Tell you what, please go to the website of your hd manufacturer, download their diagnostic utility, burn it to cd, boot to it and run it. Let's make certain the hd is okay.

Also, please run full system scans with BOTH your installed AV and with MalwareBytes.

[miloske]

Your first post says you ran chkdsk /f. Did you run it with the /f switch or the /r switch?

I ran chkdsk /r. I've made an error in my first post.

I followed your suggestion and scanned the HDD with bootable Drive Fitness Test from Hitachi (ran the Advanced test), drive is OK.

Did the full system scan with Avast and MBAM, no infections.

I guess this will remain a mystery.

[Allan]

Yeah, if the hd is good and there's no malware I'm at a bit of a loss, sorry. Maybe someone else will have a thought.

[Geek-9pm]

I don't have the answer.
Do not expect to fin d a definitive answer.

... worst type of errors are those that go unnoticed, and are not even detected by the disk firmware or the host operating system. This is known as silent corruption.

There are many error sources beyond the disk storage subsystem itself. For instance, cables might be slightly loose, the power supply might be unreliable,[2] external vibrations such as a loud sound,[3] the network might introduce undetected corruption,[4] cosmic radiation and many other causes of soft memory errors, etc. In 39,000 storage systems that were analyzed, firmware bugs accounted for 5–10% of storage failures.[5] All in all, the error rates as observed by a CERN study on silent corruption are far higher than one in every 1016 bits.[6] ....[7]

http://en.wikipedia.org/wiki/Data_corruption#Silent_data_corruption
Yeah, wikipedia articles can be hard to understand. But the point made is valid. We store more data now that ever, but the error rates and not gone done enough.
To put it is simple words ; If you have a hard error rate of one in a billion, you will hardly ever see the error when you have a mullion bits of data.  But when you have hundreds of millions of bits, it begins to happen.

The idea also applies to other hardware components. And the OS can not recover the error if it is not found.

[patio]

I suspect EFS...and/or Total commander...that is if the HDD checked out OK.
It could also be caused by power fluctuations...