Disk imaging error code 1

Printed from: Macrium Support Forum
Topic URL: http://support.macrium.com/topic.asp?TOPIC_ID=2493
Printed on: April 01 2025

Topic:

Topic author: beetlejuice
Subject: Disk imaging error code 1
Posted on: June 28 2010 14:26:38
Message:

Hello!

I've noticed that I occasionally receive the following error during disk imaging operations (either full or differential) which aborts the procedure (Macrium is running on a Win 7 Pro computer):

"Error reading volume bitmap - Error code = 1. Please run 'chkdsk /f'"

I perform file backup operations to the same destination hard drive (1 TB external eSATA drive) without any errors whatsoever. When I first noticed this error, I was using an older 500 GB external eSATA drive...so I switched to the newer 1 TB drive, to no avail.

When I execute "chkdsk /f" on the drive after the error is received, I'm able to run through a few iterations of imaging operations before the same error returns.

Do you have any recommendations as to how I can properly address this error?

Thank you!

Replies:

Reply author: Nick
Replied on: June 28 2010 14:53:15
Message:

Hi

Sorry you are having problems. The error means that the NTFS Master File Table (MFT) cannot be read on the drive you are imaging (It isn't related to the backup drive).

This means that it is corrupt, in which case it can usually be corrected by running 'chkdsk' or Reflect is being blocked by other software on your PC from reading the disk.

When you ran 'chkdsk' were any errors found and corrected?

Kind Regards

Nick - Macrium Support

Reply author: beetlejuice
Replied on: June 28 2010 15:03:43
Message:

Hi Nick!

Here's the result of my chkdsk execution:

Checking file system on F:
The type of the file system is NTFS.
Volume label is BackupDrive.

CHKDSK is verifying files (stage 1 of 3)...
Attribute record of type 0x80 and instance tag 0x4 is cross linked
starting at 0xbeec5 for possibly 0x100 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x4
in file 0x12 is already in use.

Deleting corrupt attribute record (128, $T)
from file record segment 18.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x2f for possibly 0x1 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x15 is already in use.
Deleting corrupt attribute record (128, """")
from file record segment 21.
Attribute record of type 0x80 and instance tag 0x4 is cross linked
starting at 0xbe2e5 for possibly 0xbe0 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x4
in file 0x16 is already in use.
Deleting corrupt attribute record (128, """")
from file record segment 22.
Attribute record of type 0x80 and instance tag 0x1 is cross linked
starting at 0xbb09b for possibly 0x126 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x1
in file 0x3c7 is already in use.

Deleting corrupt attribute record (128, """")
from file record segment 967.
Attribute record of type 0x80 and instance tag 0x1 is cross linked
starting at 0xbb1c1 for possibly 0x126 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x1
in file 0x3c8 is already in use.
Deleting corrupt attribute record (128, """")
from file record segment 968.
Attribute record of type 0x80 and instance tag 0x4 is cross linked
starting at 0x9312f2 for possibly 0x2ed47e4 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x4
in file 0x7ab is already in use.

Deleting corrupt attribute record (128, """")
from file record segment 1963.
Attribute record of type 0x80 and instance tag 0x1 is cross linked
starting at 0x4e76a15 for possibly 0x15ce754 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x1
in file 0x7b2 is already in use.
Deleting corrupt attribute record (128, """")
from file record segment 1970.
2048 file records processed.

File verification completed.
0 large file records processed.

0 bad file records processed.

0 EA records processed.

0 rep************* records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
The multi-sector header signature for VCN 0x0 of index $I30
in file 0x11 is incorrect.
c6 2a 6b 28 22 bb c3 de db 42 2e 61 69 59 1a 43 .*k(""....B.aiY.C
c3 10 99 12 46 07 dd 1d c8 61 d7 38 e2 b3 e3 8e ..#153;.F....a.8â.ã#142;

Correcting error in index $I30 for file 17.
The index bitmap $I30 in file 0x11 is incorrect.
Correcting error in index $I30 for file 17.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 ÿÿÿÿÿÿÿÿ........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Sorting index $I30 in file 17.
2104 index entries processed.

Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
Recovering orphaned file $Tops (18) into directory file 29.
Recovering orphaned file Chkdsk20100617070004.log (19) into directory file 17.
Recovering orphaned file $TxfLog.blf (20) into directory file 29.
Recovering orphaned file Chkdsk20100608070003.log (21) into directory file 17.
8 unindexed files scanned.

Recovering orphaned file $TXFLO~1 (23) into directory file 29.
Recovering orphaned file $TxfLogContainer00000000000000000001 (23) into directory file 29.
CHKDSK is recovering remaining unindexed files.
3 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
Replacing invalid security id with default security id for file 18.
Replacing invalid security id with default security id for file 20.
2048 file SDs/SIDs processed.

Cleaning up 3 unused index entries from index $SII of file 0x9.
Cleaning up 3 unused index entries from index $SDH of file 0x9.
Cleaning up 3 unused security descriptors.
Security descriptor verification completed.
Inserting data attribute into file 21.
Inserting data attribute into file 22.
Inserting data attribute into file 967.
Inserting data attribute into file 968.
Inserting data attribute into file 1963.
Inserting data attribute into file 1970.
34 data files processed.

Correcting errors in the master file table's (MFT) BITMAP attribute.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

976760000 KB total disk space.
146654244 KB in 1935 files.
984 KB in 32 indexes.
0 KB in bad sectors.
97808 KB in use by the system.
65536 KB occupied by the log file.
830006964 KB available on disk.

4096 bytes in each allocation unit.
244190000 total allocation units on disk.
207501741 allocation units available on disk.

I've bolded the area in which I believe you were referring to. Does this table get corrupted over time as a result of disk image operations? This particular drive is only used as a destination drive for Macrium operations. Should I create a scheduled task which runs "chkdsk /f" on a regular basis?

Thanks!

Reply author: Nick
Replied on: June 28 2010 15:18:59
Message:

Hi

Thanks for that information.

quote:

---

This particular drive is only used as a destination drive for Macrium operations

---

Reply author: beetlejuice
Replied on: June 28 2010 16:07:19
Message:

Ah-hah! Understood. I'll give that a shot.

Thanks!

Reply author: beetlejuice
Replied on: June 28 2010 17:09:27
Message:

I looked at a previous Macrium log which showed a successful execution of the disk image procedure; here's the tail end of it:

Starting Image - Sunday, June 20, 2010 06:00:27
Initializing
Analysing file system on volume D:
Analysing file system on volume
Analysing file system on volume C:
--------------------------------------------------------------------------------
Saving Partition - DRV4_VOL1 (D:)
Creating Volume Snapshot
Reading File System Bitmap
Looking for changes
Saving Partition
-------------------------------------------------------------------------------
Saving Partition - System Reserved
Reading File System Bitmap
Looking for changes
Saving Partition
--------------------------------------------------------------------------------
Saving Partition - DRV1_VOL1 (C:)
Creating Volume Snapshot
Reading File System Bitmap
Looking for changes
Saving Partition
--------------------------------------------------------------------------------
Saving Index
--------------------------------------------------------------------------------
Image Completed Successfully in 00:07:17


As you'll note, there are three volumes being imaged: a D: volume (data-only drive), a 100 MB "system reserved" volume with no drive letter assigned (it's a part of the C: drive), and a C: volume (the boot drive).


Now, here's the tail end of the log showing the error:


Starting Image - Monday, June 28, 2010 06:00:26
Initializing
Analysing file system on volume D:
Analysing file system on volume
--------------------------------------------------------------------------------
Error reading volume bitmap - Error code = 1. Please run 'chkdsk /f'


Now, I wasn't sure if the chkdsk should have been run on just the "system reserved" volume or on the C: drive; since the "system reserved" volume is resident on the C: drive, I determined that a chkdsk on C: would kill two birds with one stone. The chkdsk executed during system boot; here's the result:

Checking file system on C:
The type of the file system is NTFS.
Volume label is DRV1_VOL1.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
93184 file records processed.
File verification completed.
96 large file records processed.
0 bad file records processed.
2 EA records processed.
60 rep************* records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
131856 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
93184 file SDs/SIDs processed.
Cleaning up 751 unused index entries from index $SII of file 0x9.
Cleaning up 751 unused index entries from index $SDH of file 0x9.
Cleaning up 751 unused security descriptors.
Security descriptor verification completed.
19337 data files processed.
CHKDSK is verifying Usn Journal...
36406624 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
93168 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
11728253 free clusters processed.
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

72508415 KB total disk space.
25351012 KB in 71272 files.
46372 KB in 19338 indexes.
0 KB in bad sectors.
198015 KB in use by the system.
65536 KB occupied by the log file.
46913016 KB available on disk.

4096 bytes in each allocation unit.
18127103 total allocation units on disk.
11728254 allocation units available on disk.

Internal Info:
00 6c 01 00 fd 61 01 00 6e 91 02 00 00 00 00 00 .l...a..n.......
47 01 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 G...<...........
18 90 43 00 50 01 42 00 20 1b 42 00 00 00 42 00 ..C.P.B. .B...B.

Windows has finished checking your disk.
Please wait while your computer restarts.


It appears as though chkdsk found "free space marked as allocated" in the MFT and volume bitmaps, and made an appropriate correction; should this be sufficient?

Thanks!

Reply author: Nick
Replied on: June 28 2010 17:14:52
Message:

Hi

The issue appears to be with the Microsoft System Reserved partition (MSR). It isn't necessary to image the MSR partition every time as this partition doesn't change. Once you have a successful image that includes the MSR you can exclude it from future images by de-selecting it.

Hope this helps

Nick - Macrium Support

Reply author: beetlejuice
Replied on: June 30 2010 00:16:51
Message:

Thanks, Nick, for your ongoing help in this matter. I currently perform a full disk image of all drives once a week, with differential images sprinkled in every two days; I have a retention time of 14 days built in. Based on this schedule, I only have a full image available to me for two weeks before it is deleted by Macrium...meaning that my System Reserved partition would disappear as well.

Can I perform a single full image of the System Reserved partition, then stick it away some place for safekeeping if I ever needed to restore my C: drive? From what I understand, the System Reserved partition only houses the boot manager, the Windows Recovery Environment and BitLocker (if active). Since I don't use BitLocker, it would seem (as you suggested) that everything else on that partition is static. So...my assumption is that a full disk image of the System Reserved partition tomorrow could be restored successfully six months from now. Does that sound about right?

Thanks!

Reply author: Nick
Replied on: June 30 2010 09:04:20
Message:

Hi

Thanks for getting back.

quote:

---

So...my assumption is that a full disk image of the System Reserved partition tomorrow could be restored successfully six months from now. Does that sound about right?

---

Macrium Support Forum : http://support.macrium.com/