📎 AI Summary:
The thread discusses issues with reading raw snapshot volumes using CreateFile and ReadFile, where a large read attempt failed due to a CRC error—raising questions about whether bad sectors are properly managed at the volume level. Neemobeer explains that Windows tracks bad sectors in the MFT, specifically in the $BadClus file, and that bypassing the file system requires implementing manual bad sector checks, which necessitate SYSTEM privileges. Overall, the conversation highlights the importance of understanding how Windows handles bad sectors and the implications of working outside the regular file system.

Gregg H

New Member
Joined
May 3, 2017
Messages
1
Thread Author #1
I am using CreateFile to open a snapshot volume, and ReadFile to read from it. On one system I had an attempt to read 1 mb fail with a CRC error. As I understand it, the drive should be doing its own bad sector mapping, but apparently it's not. I know that NTFS has bad sector handling, does that apply only to reading/writing at the file level? In other words, by reading at the volume level am I bypassing anything the OS might do to "hide" bad sectors?
 

Solution
Windows maintains bad sector information in the MFT so if you're bypassing the file system, then you'd need to do your own bad sector checking.

Neemobeer

Windows Forum Team
Staff member
Joined
Jul 4, 2015
Messages
8,995
Windows maintains bad sector information in the MFT so if you're bypassing the file system, then you'd need to do your own bad sector checking.
 

Solution

Neemobeer

Windows Forum Team
Staff member
Joined
Jul 4, 2015
Messages
8,995
The 9th entry in the MFT so index 8 points to a file called $BadClus this file contains a list of all bad sectors. You would need SYSTEM access in order to read the MFT though.