VMware Cloud Community

NTFS: deleting corrupt attribute record (128, $J)

I'm trying to do a really simple conversion from Windows Server 2008 R2 SP1 to ESXi machine version 8. It seems to copy okay, but on the first VM boot it does an NTFS disk check and finds a bunch of errors.

All major services are stopped (APC Powerchute, Windows Deployment Services, Backup Exec Agent) and the antivirus uninstalled. chkdsk has been run on the source hardware and found no problems.

And yet after the migration I see this on first boot:

Checking file system on C:

The type of the file system is NTFS.

One of your disks needs to be checked for consistency. You may cancel the disk check, but it is strongly recommended that you continue.

Windows will now check the disk.                       

CHKDSK is verifying files (stage 1 of 3)...

The attribute of type 0x80 and instance tag 0x3 in file 0xe08c has allocated length of 0x1fec00000 instead of 0x1fecc0000.

Deleting corrupt attribute record (128, $J) from file record segment 57484.

Attribute record of type 0x80 and instance tag 0x3 is cross linked starting at 0x11a for possibly 0x1 clusters.

Some clusters occupied by attribute of type 0x80 and instance tag 0x3 in file 0xe120 is already in use.

Deleting corrupt attribute record (128, "") from file record segment 57632.

  199936 file records processed.

File verification completed.

  885 large file records processed.

  0 bad file records processed.

  0 EA records processed.

  104 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...

  262480 index entries processed.

  Index verification completed.

  0 unindexed files scanned.

  0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...

  199936 file SDs/SIDs processed.

Cleaning up 8 unused index entries from index $SII of file 0x9.

Cleaning up 8 unused index entries from index $SDH of file 0x9.

Cleaning up 8 unused security descriptors.

Security descriptor verification completed.

Inserting data attribute into file 57632.

  31274 data files processed.

CHKDSK is verifying Usn Journal...

Creating Usn Journal $J data stream

Usn Journal verification completed.

CHKDSK discovered free space marked as allocated in the volume bitmap.

Windows has made corrections to the file system.

  70936575 KB total disk space.

  50582732 KB in 152611 files.

    97136 KB in 31274 indexes.

        0 KB in bad sectors.

    269927 KB in use by the system.

    65536 KB occupied by the log file.

  19986780 KB available on disk.

      4096 bytes in each allocation unit.

  17734143 total allocation units on disk.

  4996695 allocation units available on disk.

Internal Info:

00 0d 03 00 59 ce 02 00 ac 1e 05 00 00 00 00 00  ....Y...........

d1 00 00 00 68 00 00 00 00 00 00 00 00 00 00 00  ....h...........

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.

Please wait while your computer restarts.

There is absolutely NO WAY that I am going to use this resulting conversion as our primary organization file server. Such corruption of the NTFS partition data is completely unacceptable. I have no way of knowing what "file record 57484 / 57632" are and if they are critical to the operation of the server.

Though I expect I already know what the problem is, and I cannot solve it by using VMWare Converter running on the Windows I'm trying to migrate.

Trying to copy a file system while it is in use is just inviting disaster because as you're copying data, something before or after wherever the copy is occurring may change so that the final copy result ends up being corrupted.

The only way to really prevent this mid-copy data corruption is to copy the partitions when they are not in use.

0 Kudos
5 Replies
VMware Employee
VMware Employee

Could you upload log bundle?

0 Kudos

POCEH, is there a way to directly send the logs to you? I don't know if they contain any sensitive information that could be used by remote hackers, but I'd hate to accidentally share that.

The source converter logs which I am putting all in a single ZIP, contain I believe three attempts to convert the source 2008 R2.

The first time the converter showed corruption, I hadn't run chkdsk on the source before conversion. I then ran chkdsk and it did find some stuff but nothing major on the source. The conversion attempts after that were done with chkdsk saying the source drives were okay, but still finding corruption on the target VM after conversion. Also did synchronize after convert with all attempts.

The last convert attempt I did not resize the volumes via converter during conversion, but was planning to do that later myself using PXE / WinPE and diskpart, if the conversion had no errors after completion.


0 Kudos
VMware Employee
VMware Employee

Yes, you can send me your logs in PM, check the converter-worker logs are included, they are most important in this case.

0 Kudos

Sorry I've looked all over this VMWare Communities web interface, nowhere is there a "Send personal message" ability.

Clicking on your profile image does not reveal such an option to me.

0 Kudos
VMware Employee
VMware Employee

The interface has been changed, After selecting his profile, select 'documents' on the top menu bar, then 'uploaded file' on the left. Select the 'hidden' radio button to make it private (I haven't actually tested it)

0 Kudos