CHKDSK and the "Dirty Bit"

[mschell]

I'm working on a friends WXP/NTFS system that has the problem of running CHKDSK on every boot. The system will also not allow a defrag to run saying the system is scheduled for a CHKDSK /F on reboot or something similar to that.
Some research has shown that CHKDSK is invoked when the "Dirty Bit" is set for a paticular drive, once the drive is checked the bit is set to "Not Dirty". Something is setting the dirty bit on this system. The system in question is running a Quantum/Maxtor 20G HD that was checked for errors with the Maxtor disk check utility. The memory was tested with memcheck and the system is not overclocked or unstable which means the Dirty Bit might be set in error.
My question is, is it possible to disable Dirty Bit checking or setting? When Dirty Bit is being set, does it mean there is always some form of data corruption happening and some hardware is at fault. My friend mentioned one CHKDSK /F run found a number of bad clusters but that was awhile ago. The system seems to run fine with the exception of the WXP disk defragmenter not being able to run.
The motherboard is an Iwill KK-266R /Via KT266A chipset/ Tbird 1.2GHz CPU.

 

[compudog]

Here is more than you ever will need to know about Microsoft's Dirty Bit Fsutil Linky. Hope this helps.

 

[mschell]

Thanks for the link.
After reading the info, I came across this:

If a volume's dirty bit is set, this indicates that the file system may be in an inconsistent state. The dirty bit can be set because the volume is online and has outstanding changes, because changes were made to the volume and the computer shutdown before the changes were committed to disk, or because corruption was detected on the volume. If the dirty bit is set when the computer restarts, chkdsk runs to verify the consistency of the volume.

I know the dirty bit is being set but is there a way to deturmine what is setting it, be it changes to the volume or disk corruption or another factor. Knowing this would make troubleshooting the problem easier.

 

[redbeard1]

There may be hope in one of these articles.

Knowledge base


Another

 

[prosaic]

Besides the usual suspects mentioned in the Microsoft articles you probably should be considering a couple of other possibilities.

One pretty sharp sysadmin I know told me a story about a problem with a corruption or misconfiguration the offline files behavior on one of his users' systems that was causing this problem. Unfortunately, I was bored with the long train trip and wasn't paying any particular attention, so I can't give you any solid details. If I remember correctly he disabled offline files, performed a chkdsk /f/r on the system, then re-enabled offline files but deliberately omitted some kind of data from being used with offline files. Again, if memory serves, he said that he suspect a P2P file sharing program (!?) was the root cause of the problem. (I guess the user was trying to keep his 'Kazaa' or whatever stash synchronized??? I can't imagine why anyone would tolerate that on a network, but...) I'm sorry I didn't pay better attention.

Other possibility -- root kit or some other malicious software? Something trying to circumvent normal OS behavior with respect to the file system. (I don't know that being root kitted would be likely to cause autochk to run, but it seems like a possible outcome to me.)

- prosaic