6

After I got the BSOD on my Windows 7 computer, I restarted my computer to find it asking me to do a disk check. I did other things in the meantime but it seemed like it took a few minutes.

If the filesystem is journalled (I left it to the default which is NTFS) why does it need to check the disk after my crash?

studiohack
  • 13,477

5 Answers5

6

Because journalling is not a magic wand.

Coping with power outages and system crashes during I/O transactions doesn't become a non-issue just because a journal of transactions is kept. The part-completed transactions that were in progress when the system crashed/the power went out don't get magically rolled forward or rolled back by themselves. The rolling forward/back has to be done before/as the volume is remounted when the system comes back up again. That happens as part of the disc checking process.

Filesystem journalling makes it simple to restore a self-consistent state. It doesn't magically cause the disc volume to never be in an inconsistent state when the dirty shutdowns occur in the first place.

JdeBP
  • 27,556
  • 1
  • 77
  • 106
3

Journal allows to bring filesystem quickly to consistent state after unclean shutdown but not when corruption occurs due to hardware failure or system error. In such case a full check is required.

x22
  • 441
  • 3
  • 6
1

Because a write or writes are not completed to the drive, The OS (not in existance now) has no way of knowing that the drive completed writes. . The dirty bit is set on the drive (itself) until it is cleared, by a proper finish. . Data from a Journal write itself can be a half written corruption point, negating the whole idea that the journaling actually helps on non-critical things. (I am somewhat biased) I would prefer that it finish in one move, and let me worry about what is lost.

The journaling could save/recover the data that was on its way, and maintain the pointers to the data , keeping one aspect of it straight. It cannot fix any bad/incomplete writes to the hard drive.


The USN change journal is enabled and used by the Indexing Service, File Replication service (FRS), Remote Installation Services (RIS), and Remote Storage. http://technet.microsoft.com/en-us/library/cc788042(WS.10).aspx

Change journals are also needed to recover file system indexing—for example after a computer or volume failure. The ability to recover indexing means the file system can avoid the time-consuming process of reindexing the entire volume in such cases. http://technet.microsoft.com/en-us/query/aa363798

Psycogeek
  • 9,139
1

Journalling comes in different levels, which have different trade-offs. NTFS journals only meta-data, not the actual file contents itself. That means that you can corrupt single files while writing, but you can't corrupt the other files in the same directory.

Similarly, when a crash does happen, the exact type of jornalling determines how much time is needed to actually fix the disk. Again, there's a tradeoff: if you structure the jornal so fixing is easy, you'll spend more time in regular disk writes. Since BSODs are fairly rare, NTFS is optimized for the non-crash case, which means that recovering from a journal is slower.

MSalters
  • 8,283
0

In a journal-based file system, all changes to your files are recorded and held together. This allows the separation of file contents from the metadata (filename, modified dates, etc...). The implications of this, however, are that if a file is not indexed in the journal, it literally doesn't exist - even if the 0's and 1's physically exist on the platter.

This is where chkdsk comes in handy, as well as the "dirty bit" of the drive. When performing various file system operations, the dirty bit is set until the operation is completed, at which point it is cleared. From the Microsoft fsutil documentation:

If a volume's dirty bit is set, this indicates that the file system may be in an inconsistent state. The dirty bit can be set because the volume is online and has outstanding changes, because changes were made to the volume and the computer shutdown before the changes were committed to disk, or because corruption was detected on the volume. If the dirty bit is set when the computer restarts, chkdsk runs to verify the consistency of the volume.

Since your computer had the dirty bit set, you need to ensure that the filesystem is consistent to prevent volume corruption, or data loss. Running a file system checker can also allow the drive to recover non-indexed files which haven't yet been recorded in the journal.

Breakthrough
  • 34,847