Windows Server Troubleshooting - File System

Click here to start saving with ING DIRECT!

Home | Methodology | Architecture | Tools | Memory | Processor | Registry | File System | Network | Active Directory | Contents

Get the Book

Major Topics
Other Topics
File System
Active Directory
More Detail
Boot Records
Junction Point
Dynamic Disk
MFT Metadata

eXpert Genealogy

Memory from

2003-2006 Team Approach Limited
All rights reserved

Disks are mechanical devices that operate up to a million times slower than memory.

Good disk performance is important for

  • Virtual memory access - The page file is stored on disk.
  • Program load time - Programs load from disk.
  • Print spooling - Print jobs are spooled to disk.
  •   File access - Files are stored on the disk.

Disk Performance recommendations

  • Put the page file on multiple physical disks - Additional disks provide additional access paths and better performance.
  • Remove the page file from busy disks so as to balance the load.
  • Use hardware RAID to reduce the CPU utilization
  • Use separate controllers for each physical disk to provide more data paths.
  • Stripe sets provide the best performance so use them for frequently accessed files
  • Fault tolerant drives have an overhead of slower performance.

Disk Maintenance Recommendations

  • Run CHKDSK periodically
  • Document and test backup and restore procedures
  • Store backups offsite in a secure location


Recoverable File System

NTFS is a recoverable file system. NTFS logs I/O transactions to the file system. If the system crashes when the file system is in an inconsistent state, the file system is repaired automatically at the next system startup. The repair is done by a special version of CHKDSK called AUTOCHK. This does not mean that file content will not get corrupted. File content must be protected by application programs fault tolerance, like SQL Server transaction logging. NTFS protects the file system infrastructure, so that there are no problems like lost clusters in the FAT system. This means that there is less troubleshooting with NTFS than with the FAT file system.

File Attributes

NTFS maintains all of the regular FAT file attributes plus additional extended attributes. Alternate data streams can store volumes of data in the same way as regular file content.

Alternate data streams can be created and accessed with the syntax  shown in the following example


This example produces the output:   HELLO

Some alternate data streams are accessible in the explorer file properties dialog.


Data backup is critical to recovering from system problems. The use of the Windows Backup program, NTBackup, to backup and restore data files is easy to understand. 

System State

The system state requires special consideration. The Windows Backup program backs up the system state as a complete unit.  The system state consists of

  • Boot files
  • System files, e.g.. C:\WINDOWS
    • Registry files
  • Active Directory on domain controllers
  • Sysvol on domain controllers
  • Certificate Services on a certification authority
  • Cluster database on a cluster node
  • Component Services configuration

Selective restoration of system state information is not possible because of dependencies. For example, programs depend on configuration in the Registry. If Registry files were restored to a system that had older versions of system file DLLs, the Registry contents may not be interpreted correctly.

Keyboard Exercise

Run the Windows Backup program and backup the System State.