Yesterday while hibernating my Windows 7 computer, I got BSOD which complained about Creative sound card driver (ctoss2k.sys). I have been using this system for two years already and I haven't had any issues before. After a full hard drive scan with Windows built-in utility. I saw many corrupted files.
The multi-sector header signature for VCN 0x5 of index $I30 in file 0x36c28 is incorrect.
Correcting error in index $I30 for file 224296.
The index bitmap $I30 in file 0x36c28 is incorrect.
The down pointer of current index entry with length 0x18 is invalid.
Recovering orphaned file .... (many of those)
The USN Journal entry at offset 0x44fa40000 and length 0x80000004 crosses
the page boundary.
The USN Journal entry length 0x1 at offset 0x44fa51000 in file
0xe0fc is not aligned (many of those).
The remaining of an USN page at offset 0x44fa5d000 in file 0xe0fc
should be filled with zeros.
Why did the audio driver BSOD corrupt the files which were not in use at the moment of the BSOD?
I'm sure Windows was not rewriting system files (I have turned automatic updates off, I'm updating manually), and also I see many orphaned files from some other software which was not running at the moment of the BSOD. The lines "Recovering orphaned file [filename here)" contained file names of programs which were not open at the moment of BSOD (some Visual Studio files, some Corel Video Studio files …).
How can NTFS allow for such major corruption to happen for files which are completely unrelated to the BSOD? I have read that NTFS has a backup copy of metadata. Why NTFS does not detect that the main metadata table is corrupted and it should recover from the backup metadata (which should store the state right before the BSOD)? Isn't NTFS transactional at all?
Best Answer
The files could have been "in-use" by Windows, or other processes at the time of the BSoD.
Also the unrelated files could be physically next to the files "in-use" on the hard drive. You should probably do a
chkdsk /R c:to check for bad sectors.