Re: Since weekend KB920958 update, small files up to 4096 bytes get corrupted

> While the KB920958 file has not yet been re-released, MS is
> offering a Hot Fix as detailed in
> http://support.microsoft.com/kb/925308

As a FYI - I have written a scanner that will list files that seem to
be corrupted by KB920958. It's available from
http://marc.kupper.googlepages.com/scandf

This utility can't repair your files though it's possible enough
information was written to disk that Microsoft will be able to issue an
update that allows for reading the original file data.

Marc

In microsoft.public.win2000.file_system Marc Kupper wrote:

>> While the KB920958 file has not yet been re-released, MS is
>> offering a Hot Fix as detailed in
>> http://support.microsoft.com/kb/925308
>
> As a FYI - I have written a scanner that will list files that
> seem to be corrupted by KB920958. It's available from
> http://marc.kupper.googlepages.com/scandf

In case it is not otherwise known, that mentioned HotFix was publicly
released (same files) on the 20th as
KB-925308
http://support.microsoft.com/kb/925308/

> This utility can't repair your files though it's possible enough
> information was written to disk that Microsoft will be able to
> issue an update that allows for reading the original file data.

I doubt that is possible. Damaged files were literally stored in
that condition in the file system...data irreparably lost, restore
from clean backup.

Earlier I had written:
> > ... it's possible enough
> > information was written to disk that Microsoft will be able to
> > issue an update that allows for reading the original file data.

Mark V replied:
> I doubt that is possible. Damaged files were literally stored in
> that condition in the file system...data irreparably lost, restore
> from clean backup.

I'd tend to agree and late last night had another thought in that it's
possible a data block for the last block was not allocated/written to
at all. I'm basing this thought on that it's always the last block
that's lost plus a comment on slashdot iirc where someone got a file
size mismatch error when they tried to load up a corrupted file using
some sort of raw disk editor (where they'd see whatever is actually
written to disk).

One of the first things I did though when I realized files were getting
corrupted was to run chkdsk which did not find any problems.

Initially I had been thinking that *something* was written to disk but
that its structure was not recognized by the decompression code which
then spun out the DF bytes in it's place.

Marc