Ghost Solution Suite

Hi,

I've been using Norton Ghost 14 since soon after it came out to back up my Windows XP Pro PC onto an external hard drive. A couple of weeks ago, I started getting the following error:

" Norton Ghost

            The type of errors encountered indicate that this hard disk drive is about to fail. It is
            recommended that this drive be replaced soon. To ignore this error and backup this
            drive, select "Ignore bad sectors during copy" from the advanced options in the Drive
             Backup Wizard.
            More Help on the Web


                                                          Show Details >>            OK


-The type of errors encountered indicate that this hard disk drive is about to fail. It is recommended that this drive be replaced soon. To ignore this error and backup this drive, select "Ignore bad sectors during copy" from the advanced options in the Drive Backup Wizard.
--Error E7C3000F: Device \\?\SymantecSnapshot0 cannot read 3064 sectors starting at LBA 360490040.
---Error EBAB03F1: Data error (cyclic redundancy check)."

Since the external hard drive was over two years old, I assumed the hard drive must be faulty and purchased and brand new external hard drive. When I tried to do a backup onto it, however, I just got the same error message again. Please can someone suggest what I can do to get my backup to work?

Thanks,
Joe

Something would appear to be amiss with your system if all was previously working OK, but is now showing errors.

When a hard disk error such as a CRC error occurs, it is recorded in the event log, regardless of any other software utilities that you are running. So before you do anything else, I would suggest scanning through the event logs and checking if there are any read or write errors being reported for your new disk, and also check back and see if there were similar errors for your old disk.

Also, do not lose sight of the fact that the disk system consists of more than just the disk drive. Whether the drive is SATA or IDE, there is a bunch of hardware on the motherboard that interfaces with the hard disk, and this hardware could be starting to fail. There is also the cabling and power supply to consider, although PSU problems tend first to show as boot up failures where there are multiple hard disks, for example.

So before doing anything else, check your logs for evidence of any ongoing issues. If there are none, then the finger starts to point at the Ghost install.

I've searched the event logs and posted the last four events relating to Norton Ghost below, although it doesn't seem to offer any new information. You may be able to spot something though; please take a look. The first error occured when I was using my old hard drive and the second error was with the new one.

 

Event Source:    Norton Ghost

Event Category:                High Priority

Event ID:              100

Date:                     10/10/2009

Time:                     11:57:34

User:                     N/A

Computer:          SG-66607DF05674

Description:

Info 6C8F1F63: The drive-based backup job, Drive Backup of  (C:\), has been started manually.

Details:

Source: Norton Ghost

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

Event Type:        Error

Event Source:    Norton Ghost

Event Category:                High Priority

Event ID:              100

Date:                     10/10/2009

Time:                     13:20:40

User:                     N/A

Computer:          SG-66607DF05674

Description:

Error EC8F17B7: Cannot create recovery points for job: Drive Backup of  (C:\). Warning A7C30019: The type of errors encountered indicate that this hard disk drive is about to fail. It is recommended that this drive be replaced soon. To ignore this error and backup this drive, select "Ignore bad sectors during copy" from the advanced options in the Drive Backup Wizard. Error E7C3000F: Device \\?\SymantecSnapshot0 cannot read 2056 sectors starting at LBA 360491048. Error EBAB03F1: Data error (cyclic redundancy check).

Details: 0xA7C30019

Source: Norton Ghost

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

Event Type:        Information

Event Source:    Norton Ghost

Event Category:                High Priority

Event ID:              100

Date:                     25/10/2009

Time:                     12:49:12

User:                     N/A

Computer:          SG-66607DF05674

Description:

Info 6C8F1F63: The drive-based backup job, Drive Backup of  (C:\), has been started manually.

Details:

Source: Norton Ghost

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

<o p=""> </o>

Event Type:        Error

Event Source:    Norton Ghost

Event Category:                High Priority

Event ID:              100

Date:                     25/10/2009

Time:                     14:04:19

User:                     N/A

Computer:          SG-66607DF05674

Description:

Error EC8F17B7: Cannot create recovery points for job: Drive Backup of  (C:\). Warning A7C30019: The type of errors encountered indicate that this hard disk drive is about to fail. It is recommended that this drive be replaced soon. To ignore this error and backup this drive, select "Ignore bad sectors during copy" from the advanced options in the Drive Backup Wizard. Error E7C3000F: Device \\?\SymantecSnapshot0 cannot read 10904 sectors starting at LBA 360482200. Error EBAB03F1: Data error (cyclic redundancy check).

Details: 0xA7C30019

Source: Norton Ghost

What I am looking for are any events NOT associated with Norton which would indicate that there may be drive related errors such as read or write errors.
If a drive is starting to fail, there are likely to be an increasing number of events where read and/or write errors take place, and these are normally recorded in the event log also. So any true hardware issue is going to cause event logging both within Norton and at other times as well.

If it only occurs when Norton is running, then there are two possibilities. One is that Norton is backing up parts of the disk which are failing, but which are not accessed at other times (ie stale data which is not accessed normally). The other is that Norton is hitting a code bug which is being incorrectly reported as a hard disk issue.

Since you have replaced the hard disk, it is statistically unlikely that the hard disk continues to be the cause, but does not exclude other components in the hardware that connects the hard disk to the CPU main bus on the motherboard.

At this point, running a few cycles of defragmentation, followed by running CHKDSK to show if any errors are encountered, will help to verify whether there are any issues with the hard disk subsystem. If nothing shows up in these tests, then perhaps the next move is to uninstall Ghost, clear out any remaining files under Program Files, and clear out any remaining registry entries, then reinstall.

If there is STILL no improvement, then either there is a hardware issue that only surfaces when Norton is running, or Ghost is at fault.
If you feel inclined, you could refer to my articles "Adventures with WinPE" and create a bootable USB hard disk with which you can try imaging your boot partition using Imagex from the WinPE toolkit. If this image is created OK, you can try restoring it to the other hard disk and see if it restores OK. If all that works correctly, then it pretty much points the finger at Ghost. If any of this process fails, then hardware is implicated. If your hard disk is SATA, you could try sourcing a low cost PCI to SATA interface card and connect your drive to that, after installing any required drivers. This will give you a different path from hard disk to CPU main bus and determine whether the motherboard SATA interface is flaky.

Sorry about that. I had another look at the event logs. There are quite a lot of "Application Hangs" events as well as some "Application Error" one. I've posted the details of someof the "Application Error" ones below.

When I got the message: "The type of errors encountered indicate that this hard disk drive is about to fail", I assumed it was referring to the external drive I was backing up to, but could it be the C drive that I was backing up? And do you want me to run the defrags and CHKDSK on the C drive or the external hard drive?

Event Type:    Error
Event Source:    Application Error
Event Category:    (100)
Event ID:    1000
Date:        23/10/2009
Time:        19:11:13
User:        N/A
Computer:    SG-66607DF05674
Description:
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 64 72 77   ure  drw
0018: 74 73 6e 33 32 2e 65 78   tsn32.ex
0020: 65 20 35 2e 31 2e 32 36   e 5.1.26
0028: 30 30 2e 30 20 69 6e 20   00.0 in
0030: 64 62 67 68 65 6c 70 2e   dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e   dll 5.1.
0040: 32 36 30 30 2e 35 35 31   2600.551
0048: 32 20 61 74 20 6f 66 66   2 at off
0050: 73 65 74 20 30 30 30 31   set 0001
0058: 32 39 35 64               295d   






Event Type:    Error
Event Source:    Application Error
Event Category:    None
Event ID:    1000
Date:        23/10/2009
Time:        19:11:06
User:        N/A
Computer:    SG-66607DF05674
Description:
Faulting application filezilla.exe, version 3.2.8.0, faulting module filezilla.exe, version 3.2.8.0, fault address 0x00025d1f.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 66 69 6c   ure  fil
0018: 65 7a 69 6c 6c 61 2e 65   ezilla.e
0020: 78 65 20 33 2e 32 2e 38   xe 3.2.8
0028: 2e 30 20 69 6e 20 66 69   .0 in fi
0030: 6c 65 7a 69 6c 6c 61 2e   lezilla.
0038: 65 78 65 20 33 2e 32 2e   exe 3.2.
0040: 38 2e 30 20 61 74 20 6f   8.0 at o
0048: 66 66 73 65 74 20 30 30   ffset 00
0050: 30 32 35 64 31 66 0d 0a   025d1f..







Event Type:    Error
Event Source:    Application Error
Event Category:    None
Event ID:    1000
Date:        23/10/2009
Time:        09:33:32
User:        N/A
Computer:    SG-66607DF05674
Description:
Faulting application wmplayer.exe, version 11.0.5721.5145, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x00010a1b.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 77 6d 70   ure  wmp
0018: 6c 61 79 65 72 2e 65 78   layer.ex
0020: 65 20 31 31 2e 30 2e 35   e 11.0.5
0028: 37 32 31 2e 35 31 34 35   721.5145
0030: 20 69 6e 20 6e 74 64 6c    in ntdl
0038: 6c 2e 64 6c 6c 20 35 2e   l.dll 5.
0040: 31 2e 32 36 30 30 2e 35   1.2600.5
0048: 37 35 35 20 61 74 20 6f   755 at o
0050: 66 66 73 65 74 20 30 30   ffset 00
0058: 30 31 30 61 31 62 0d 0a   010a1b..








Event Type:    Error
Event Source:    Application Error
Event Category:    (100)
Event ID:    1000
Date:        22/10/2009
Time:        14:22:18
User:        N/A
Computer:    SG-66607DF05674
Description:
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 64 72 77   ure  drw
0018: 74 73 6e 33 32 2e 65 78   tsn32.ex
0020: 65 20 35 2e 31 2e 32 36   e 5.1.26
0028: 30 30 2e 30 20 69 6e 20   00.0 in
0030: 64 62 67 68 65 6c 70 2e   dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e   dll 5.1.
0040: 32 36 30 30 2e 35 35 31   2600.551
0048: 32 20 61 74 20 6f 66 66   2 at off
0050: 73 65 74 20 30 30 30 31   set 0001
0058: 32 39 35 64               295d   













Event Type:    Error
Event Source:    Application Error
Event Category:    None
Event ID:    1000
Date:        22/10/2009
Time:        14:22:02
User:        N/A
Computer:    SG-66607DF05674
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x0001b21a.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 65 78 70   ure  exp
0018: 6c 6f 72 65 72 2e 65 78   lorer.ex
0020: 65 20 36 2e 30 2e 32 39   e 6.0.29
0028: 30 30 2e 35 35 31 32 20   00.5512
0030: 69 6e 20 6e 74 64 6c 6c   in ntdll
0038: 2e 64 6c 6c 20 35 2e 31   .dll 5.1
0040: 2e 32 36 30 30 2e 35 37   .2600.57
0048: 35 35 20 61 74 20 6f 66   55 at of
0050: 66 73 65 74 20 30 30 30   fset 000
0058: 31 62 32 31 61 0d 0a      1b21a..













Event Type:    Error
Event Source:    Application Error
Event Category:    None
Event ID:    1000
Date:        15/10/2009
Time:        09:40:16
User:        N/A
Computer:    SG-66607DF05674
Description:
Faulting application tl.exe, version 7.3.104.3, faulting module dataobj.dll, version 7.3.105.1, fault address 0x000f0b60.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 74 6c 2e   ure  tl.
0018: 65 78 65 20 37 2e 33 2e   exe 7.3.
0020: 31 30 34 2e 33 20 69 6e   104.3 in
0028: 20 64 61 74 61 6f 62 6a    dataobj
0030: 2e 64 6c 6c 20 37 2e 33   .dll 7.3
0038: 2e 31 30 35 2e 31 20 61   .105.1 a
0040: 74 20 6f 66 66 73 65 74   t offset
0048: 20 30 30 30 66 30 62 36    000f0b6
0050: 30 0d 0a                  0..    

I had spotted this in your original posting:
The type of errors encountered indicate that this hard disk drive is about to fail. It is recommended that this drive be replaced soon. To ignore this error and backup this drive, select "Ignore bad sectors during copy" from the advanced options in the Drive Backup Wizard.
--Error E7C3000F: Device \\?\SymantecSnapshot0 cannot read 3064 sectors starting at LBA 360490040.
---Error EBAB03F1: Data error (cyclic redundancy check)."

and since the error stated "cannot READ 3064 sectors..." - I naturally assumed that you were referring to the internal C: drive of the system as the drive you had replaced. I should have read more carefully and noted that you had replaced the external hard drive and not the internal one.

So let's just recap for a moment. My intention throughout was to identify whether your INTERNAL hard disk subsystem was on the point of failure, and my diagnostic suggestions were intended to try and identify and isolate any errors arising from the internal disk. It is my assessment that the error you saw originally had nothing to do with the external disk but was a report on the condition of your C: drive.

Going further, you should be able to run chkdsk on both the internal and external drives, but on balance, since a different external drive shows the same problem, I would suggest focusing your attention on the C: drive.

As a first step, make sure you copy any data that you wish to protect onto one of you external hard disks - that way should your C: drive stop working, you have a backup of your data to work with. Once the backup is made, try the diagnostic steps I have described, on your C drive - ie run CHKDSK and see if any errors are reported.

The application event log information is not pertinent to this issue. I would suggest looking in the system event log and see if there are any faults associated with your C drive in there.

There is a warning and an error with the Source, "disk" under System.

The warning appears many times. Here it is:

Event Type:    Warning
Event Source:    Disk
Event Category:    None
Event ID:    51
Date:        23/10/2009
Time:        14:30:19
User:        N/A
Computer:    SG-66607DF05674
Description:
An error was detected on device \Device\Harddisk4\D during a paging operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 02 68 00 01 00 b6 00   ..h...¶.
0008: 00 00 00 00 33 00 04 80   ....3..€
0010: 2d 01 00 00 00 00 00 00   -.......
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........
0028: d6 2e 16 00 00 00 00 00   Ö.......
0030: ff ff ff ff 03 00 00 00   ÿÿÿÿ....
0038: 40 00 00 49 00 00 00 00   @..I....
0040: ff 20 0a 12 4c 02 20 40   ÿ ..L. @
0048: 00 10 00 00 0a 00 00 00   ........
0050: 00 00 00 00 d0 ad 83 8a   ....ЭƒŠ
0058: 00 00 00 00 70 3d 02 87   ....p=.‡
0060: 00 00 00 00 f7 e7 9a 1d   ....÷çš.
0068: 28 00 1d 9a e7 f7 00 00   (..šç÷..
0070: 08 00 00 00 00 00 00 00   ........
0078: 00 00 00 00 00 00 00 00   ........
0080: 00 00 00 00 00 00 00 00   ........
0088: 00 00 00 00 00 00 00 00   ........



The error appears 21 times, all on the same day. Here it is:

Event Type:    Error
Event Source:    Disk
Event Category:    None
Event ID:    7
Date:        23/10/2009
Time:        16:38:34
User:        N/A
Computer:    SG-66607DF05674
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00   ..h...¶.
0008: 00 00 00 00 07 00 04 c0   .......À
0010: 00 01 00 00 9c 00 00 c0   ....œ..À
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 9e 56 f9 2a 00 00 00   .žVù*...
0028: d2 ff 06 00 00 00 00 00   Òÿ......
0030: ff ff ff ff 00 00 00 00   ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00   @..„....
0040: 00 20 0a 12 40 03 20 00   . ..@. .
0048: 00 00 00 00 0a 00 00 00   ........
0050: 00 b0 89 8a a8 26 b1 87   .°‰Š¨&±‡
0058: 00 00 00 00 70 ae bc 87   ....p®¼‡
0060: 02 00 00 00 4f ab 7c 15   ....O«|.
0068: 28 00 15 7c ab 4f 00 00   (..|«O..
0070: 58 00 00 00 00 00 00 00   X.......
0078: f0 00 03 00 00 00 00 0b   ð.......
0080: 00 00 00 00 00 00 00 00   ........
0088: 00 00 00 00 00 00 00 00   ........

I've just attempted to run Chkdsk but it was stuck on 87% of stage 4 for ages and I needed to use my computer, so I had to restart. It did say the following whilst checking in stage 4: "Windows replaced bad clusters in file 11318 of name" and then it gave the path to the file.

Your event logs appear to report on two different "disks":

 \Device\Harddisk0\D
 \Device\Harddisk4\D

I'm going to assume that your system drive is on Harddisk0, and bad block errors are indicative of a hard disk that may be about to fail, especially if the number of event log reports suggests that the bad block list is growing.

CHKDSK can indeed take several hours to run through - especially if it encounters bad blocks and tried to recover them. If possible, run CHKDSK /F (which attempts to fix errors as they are found) overnight, so that the system can take as long as needed to go through the checks. Once you have had a full pass, run it again, and see if any NEW errors are fixed. If no new errors show up, run a GHOST backup right away. If new errors are found, then backup any critical data as soon as possible.

I ran CHKDSK twice on Saturday and ran a backup with Norton Ghost yesterday. I wasn't able to find the results of the scans. I thought they were under Event Viewer => Applications with Autochk as the Source, but they didn't seem to be there. I got the same error with Norton Ghost anyway, so it looks like I need to replace the C drive.