Return

This story was written by Executive Software, the developer of Diskeeper. I thought you'd like it, as sometimes it is really important to know which version of NTFS is running. "A user who had recently installed Diskeeper called in to Tech Support claiming that Diskeeper had done something to his Windows NT4 system that rendered CHKDSK unusable on his NTFS drives. The rep had reviewed with this user that installing Windows 2000 would have just this effect: Windows 2000 does a "conversion" of NT4-type NTFS volumes to Windows 2000-type NTFS volumes. The user remained unconvinced, however. He'd never installed Windows 2000 on this machine, or even brought Windows 2000 near the machine. He was insistent on this and basically refused to believe the rep. Now baffled, the rep wanted a way to find out what version of NTFS was running on this system, and came to me for help. So I dragged out the Windows NT4 Resource Kit, and found the tool DSKPROBE. Here's the procedure we came up with to examine a volume's NTFS version: 1.. Drag out your Resource Kit and put DSKPROBE somewhere you can run it. A diskette is fine if it'll fit. There's no "installation procedure". All you need is the .exe. 2.. Make sure you're logged on as an Administrator and that the drive you want to examine is local (not networked). 3.. Make sure you know what volume you're going to examine. (X:) 4.. Run DSKPROBE.EXE. 5.. Select DRIVE->LOGICAL VOLUME 6.. Double-click on the volume you're examining. This will open handle zero to that drive. 7.. Click on SET ACTIVE in the HANDLE 0 area. LEAVE THE READ-ONLY BOX CHECKED. 8.. Click "OK". 9.. Select SECTORS->READ and read in sector 0 for length 1. 10.. Select VIEW->NTFS BOOT SECTOR 11.. Click the "GO" button next to "Clusters to MFT" 12.. Select VIEW->BYTES. 13.. Select SECTORS->READ 14.. Leave the "STARTING SECTOR" value alone. 15.. Make "Number of Sectors" be 8, and click on READ. 16.. You have just read in the first 4 MFT records. We're looking for MFT record number 3, so we must click on the right arrow in the tool bar six times. 17.. You will end up looking at the first half of MFT record 3, the MFT record for $Volume. You will see the text "$Volume" in the display. 18.. There are 16 columns of hex digits. Looking down column 0 or 8, you will find a hex "70". Here's where I found it on my machine: 1B0 70 00 00 00 28 00 00 00 00 00 18 00 00 00 05 00 1C0 0C 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 1D0 03 00 00 00 00 00 00 00 00 00 00 00 18 00 00 00 (You may have to go to the next sector to see the "70".) 19.. At the line starting with 1D0 is a "03 00". This value is 32 bytes past the "70". "03 00" means this volume is running NTFS version 3.0. 20.. If you're running NT4 you'll usually see "01 02". This is NTFS version 1.2. 21.. If, perchance, you're running an XP beta, you'll most likely see the value "03 01", meaning this volume is running NTFS version 3.1. Anyway, it turned out when we gave the user the procedure, the value he saw was "03 00". Somehow, Windows 2000 *had* seen the machine, but we had no explanation for how it got that way. Neither did the user, but he swore he'd get to the bottom of it. A few days later, the user called back in and, embarrassed, told us that his kid had tried to install Windows 2000 on the machine one Saturday morning when he was in bed fast asleep. The kid apparently didn't finish the installation but did leave the evidence behind.... Sorry, kid. You' have been busted. Well, in our case, that might have been a user with a bit too much self confidence but insufficient knowledge to pull his own upgrade off. And you wondering what the heck happened! ____________________________________________________________________________ An easier way (On XP systems at least) is to use FSUTIL to determine the  filesystem version. Here is an example: ======================================================== Microsoft Windows XP [Version 5.1.2482] (C) Copyright 1985-2001 Microsoft Corp. %userprofile%\fsinfo ntfsinfo c:  NTFS Volume Serial Number : 0x0e00b35e00b34b89 Version : 3.1 Number Sectors : 0x0000000001388afb Total Clusters : 0x000000000027115f Free Clusters : 0x0000000000136eb1 Total Reserved : 0x0000000000000000 Bytes Per Sector : 512 Bytes Per Cluster : 4096 Bytes Per FileRecord Segment : 1024 Clusters Per FileRecord Segment : 0 Mft Valid Data Length : 0x0000000001b13c00 Mft Start Lcn : 0x00000000000c0000 Mft2 Start Lcn : 0x00000000001388af Mft Zone Start : 0x00000000000c1a40 Mft Zone End : 0x000000000010e240 ___________________________________________________________________________________ There is more, but further can not be disclosed at this time..