System Restore, Missing Memory

Kaistar · #1 (**permalink**) 13-04-2008, 02:39 PM

Okay this is what happened...

I set up my laptop to use two monitors, showing off with my webcam to my friend halfway PC crashed. Rebooted, and everything ran fine except that my network card had problems. I changed the TCP/IP limit earlier and it might have affected it. Couldn't connect online thru wireless or cable connection.

Using Command prompt to check ipconfig failed. Some error I forgot. But I needed internet urgently, so I used system restore to about 2 days ago.

Now everything works fine, except for this small issue.

I remember having about 84GBs before all this, but after system restore I only have 81GB left. Even after I cleared the memory used by system restore. Any ideas where those memory went?

Digerati · #2 (**permalink**) 13-04-2008, 04:58 PM

Quote:

I remember having about 84GBs before all this, but after system restore I only have 81GB left.

What exactly is "before all this"? Minutes, hours, days? And what else did you do on your computer, starting 2 days ago from the restore point, until now, when you have 84Gb?

I am assuming you are talking about "free disk space", right? Assuming that is so, I am guessing you are wondering where the other 3 Gb of disk space went.

First, I don't see that as a lot. But second, it is very likely when your system crashed, all kinds of open files were left open, resulting in lost clusters on the drive. Some of those files then had to be re-created upon boot (for Windows) and upon loading and/or starting of programs (firewall, AS/AV, and whatever you have starting at boot.

I would run Disk Cleanup on your drive(s). Then chkdsk. Chkdsk is a command-line (DOS prompt) tool within Windows that checks disk volumes for errors. If run with the proper switch, it will also attempt to repair errors it finds. Chkdsk can repair bad sectors, lost clusters, cross-linked files, and directory errors. To use chkdsk, you must be logged on as an administrator, or be in the administrators group.

1. Click Start, and then Run.
2. In the 'Open' text box, enter cmd, then press Enter.
3. At the command prompt, enter chkdsk [drive]: /r (note the space before the "/r" and be sure to replace [drive] with the applicable drive letter). Press Enter to start.

Note: If chkdsk finds files in use (and it probably will), you will receive the following message:
Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)
Press Y then press Enter to allow chkdsk to run at next bootup, then reboot.

Note: You will see many folks suggest using the /f switch instead of /r. The /r switch is often considered better because it also instructs chkdsk to search for and attempt to repair bad sectors. /r includes /f. To see the switch descriptions, enter chkdsk /? at that command prompt, and press Enter.

Kaistar · #3 (**permalink**) 14-04-2008, 08:01 AM

Oh. Sorry I weren't clear enough. "Before all this" meant before the crash and the system restore. I made the post about 30 minutes after I did the system restore.

The only change I remember making within those 2 days is install Bitcomet 1.00 *yesterday*, change the TCP/IP limit and probably some file name changes. Oh, and deleted about 6-12GBs worth of files. After I restored, the files were partly restored as they are not 6-12 anymore and even after removal of those I still missed some HDD space.

I'll do as you suggested but I won't be able to reply soon. Sitting for my finals this week. Have been very busy with college.

Ironically, the paper I'm sitting for tomorrow is Introduction to Computers! LOL. Really basic stuff but interesting to learn all the terms.

Anyways, thanks Dig for the suggestion. One last question before I continue my studies, is it safe to run the chkdsk while I do other things? Can I reboot at a later time instead of immediately?

Digerati · #4 (**permalink**) 14-04-2008, 04:52 PM

What do you mean by TCP/IP Limit? If you mean for the TCP Half Open limit, then understand that is there for security reasons. [Dad-Mode on] And your mention of bitcomet tells me you removed the limit for faster P2P file sharing, something probably not wise to do on a "production" computer - that is, one required for school or work. And certainly, since badguys wallow in sullage, that is, where there exists certain activities, such as the illegal trade of copyrighted materials, porn, gambling, etc., understand that your computer's best defense against malware infestation is compromised - that's you, the user. You might want to check out the Practicing Safe Computing section of my canned text, Cleaning Out Malware. Also, badguys slither and lurk about social and chat sites too - seeking out vulnerable targets; people and machines. dad-mode off]

Quote:

Ironically, the paper I'm sitting for tomorrow is Introduction to Computers! LOL. Really basic stuff but interesting to learn all the terms.

Hmmm, I remember such a paper long ago. Mine was an introduction to multi-media, which at the time meant something totally different than it does today as there was no such thing as external speakers or watching videos on PCs back then. I had to do a "talk" on it too, so I brought in several examples of media and made a multimedia display - a 15" hard disk platter, an 8" floppy disk, 5.25" single-sided floppy and the new kid on the block, the 3.5" floppy.

Kaistar · #5 (**permalink**) 15-04-2008, 06:34 AM

My pc went from simply gaming and enjoyment to vital in a short span of time so I'm still trying to get used to surfing safer lol. Thanks for the page it's quite informative.

Could you perhaps explain a little more on the removing the half-open limit and its risks for me? And also I think you might have missed out my question about chkdisk lol.

Digerati · #6 (**permalink**) 15-04-2008, 04:00 PM

Quote:

One last question before I continue my studies, is it safe to run the chkdsk while I do other things? Can I reboot at a later time instead of immediately?

chkdsk is safe to run with other things - but that is because when it runs with one of the fix switches, e.g. "/r", it pretty much takes over - and it forces the reboot. It runs in the early stages of the boot process, before any critical system files are opened, and with only the bare minimum drivers loaded.

However, if there is something wrong with the drive, or data on the drive, it is best to minimize use of the computer until chkdsk is run. That's the only way to ensure (further?) corruption does not occur. Hard drives are resilient - they can keep running with many errors - the concern is the data stored in the magnetic substrate of the disk platters. How valuable is it to you? There's no PC in the world worth as much as the data stored on my computer. Not that it would be valuable to anyone else, but since I built this computer nearly 15 years ago, even though it has "evolved" through several motherboards, CPUs, hard drives, versions of Windows, PSUs, and even a couple cases, I still have 15 years of letters, papers, taxes, contacts, bookmarks, password safe contents, appointments, etc. that would be very bad if I lost. That's why I use a mirrored RAID 1, and I do frequent backups to networked computers in another part of the house. You do have a current backup, right? You can always reinstall Windows and your programs, a hassle, but it can be done. But restoring all your personal documents is impossible without some backup - or a whole lotta time, and lots of money.

Unfortunately, chkdsk /r can take many hours to run, often appearing stuck for long periods. So in your case, you will need to plan it around your studies - like overnight or a quiet weekend. That said, if you go to Start > Run and enter cmd, then, in the command window, enter chkdsk, without the "/r", chkdsk will simply inspect your disk for errors - but will not make any changes. This "read-only" mode takes just a few minutes (usually less than 5). It is not as thorough an inspection as "/f" or "/r", and it fixes nothing, but if you have errors here, it will tell you about them. If any, don't put off running chkdsk without, at least, the "/f" option for long.

Windows limits the half-open (incomplete/syn packets) connection attempts the system can make each second. The limit is set to 10 for XP SP2 (I think 2 for Vista). The intent is to slow down viruses that attempt to propagate to a large number of random IP numbers, and potentially turn the computer into zombie, drafted into a botnet army. These botnets are then used by badguys to launch distributed denial-of-service (DDoS) attacks against others, typically, against sites and organizations that help users protect themselves from such badguys. These tactics are also used by terrorist organizations to attack in cyberspace, the networks (and communications backbones) of their enemy-of-the-day, in an attempt to disrupt and confuse, or better (worse!) yet, hack in and cause real damage. Serious stuff here. People get hurt, or worse.

The downside of this limit, for a few, is that it affects the performance some users of P2P (Peer 2 Peer) file sharing see. The irony is that many (not all) users of P2P tend to be users that upload and download large amounts of copyrighted materials without the required royalties and licensing/registration fees being paid. Bottom line, this is stealing and EVERYONE knows it is not right. It falls under the exact same categories as counterfeiting and software piracy, which are illegal.

The sites (and often corrupt govenments) that host such file sharing turn a blind-eye to the illegal transfers - claiming they are not responsible for what their posters post. A perfect proving ground for badguys to test their new malicious code.

But to make matters worse, many (not all) of those users tend to be folks who are lax on those practicing safe computing steps I mention in my link above that are required of all users - that is, keeping systems patched, updated, scanned and blocked as necessary, always scanning attachments and downloads before opening, and never going to places where badguys are known to wallow in, that is, porn, chat/social gatherings, gambling, and P2P sites that condone illegal file sharing. It is those users and computers, the easy pickings, that badguys seek out first - to turn in to weapons against the rest us!

Kaistar · #7 (**permalink**) 15-04-2008, 05:21 PM

Ahhh. Very very informative. Thanks for all your help digerati =)

Appreciate it greatly. I'll run the chkdisk as soon as possible and will update soon =)

Kaistar · #8 (**permalink**) 18-04-2008, 02:14 AM

Can't seem to edit my previous post but here's an update.

Done checkdisk but woke up to the login screen so no idea if anything is wrong. about a 400mb increase in HDD space instead of the 4GB I hoped lol. Will really have to reformat soon cause I've been having some glitches on this computer.

Thanks for all the help guys!

Digerati · #9 (**permalink**) 18-04-2008, 04:08 AM

Reformatting is always the last option, as you end up months, or even years behind in updates.