What could cause the files to be replaced with null bytes, size and timestamp not modified?
Something has malformed a bunch of files on my hard drive. The malformed files:
- have theirs content replaced with NULL bytes,
- are exactly the same size as before the malform happen,
- modification time was not altered
I have at least 40 of those malformed files and are looking for other victims. Most of the files are part of Netbeans php project. Some were text files, some were images. None of them was modified lately. HDD Smart does not show anything worrying and AV software did not detect any viruses. My OS is Windows 7.
Any ideas what could cause this strange behaviour?
[EDIT]
I have scanned the disk to find other malformed files, and the wierd thing is, there are no other "NULLed" files than those 40 I have found earlier. All the files belonged to the same Netbeans project. I have never seen something similar before.
windows hard-drive filesystems
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
|
show 1 more comment
Something has malformed a bunch of files on my hard drive. The malformed files:
- have theirs content replaced with NULL bytes,
- are exactly the same size as before the malform happen,
- modification time was not altered
I have at least 40 of those malformed files and are looking for other victims. Most of the files are part of Netbeans php project. Some were text files, some were images. None of them was modified lately. HDD Smart does not show anything worrying and AV software did not detect any viruses. My OS is Windows 7.
Any ideas what could cause this strange behaviour?
[EDIT]
I have scanned the disk to find other malformed files, and the wierd thing is, there are no other "NULLed" files than those 40 I have found earlier. All the files belonged to the same Netbeans project. I have never seen something similar before.
windows hard-drive filesystems
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
Although you got the all clear from HDD Smart this really sounds like HDD corruption. Make sure you have a backup regardless.
– rob
Nov 26 '14 at 15:08
I do make daily backup with Duplicati, but those 40 files was used so rarely, that they made it unnoticed for at least two months, so they are malformed in my oldest backups. Fortunatelly, they also have remote copy on my development server (via upload on save in netbeans), and those copies were correct, so I have all the files.
– SWilk
Nov 26 '14 at 15:26
Apart from the reason, I am looking for a way to find all the files which are similarily malformed
– SWilk
Nov 26 '14 at 15:29
I think you need to create a new question to find a tool that will identify any file containing nothing but null bytes.
– rob
Nov 26 '14 at 15:39
This sounds like a crash during defragmentation.
– David Schwartz
Nov 27 '14 at 7:40
|
show 1 more comment
Something has malformed a bunch of files on my hard drive. The malformed files:
- have theirs content replaced with NULL bytes,
- are exactly the same size as before the malform happen,
- modification time was not altered
I have at least 40 of those malformed files and are looking for other victims. Most of the files are part of Netbeans php project. Some were text files, some were images. None of them was modified lately. HDD Smart does not show anything worrying and AV software did not detect any viruses. My OS is Windows 7.
Any ideas what could cause this strange behaviour?
[EDIT]
I have scanned the disk to find other malformed files, and the wierd thing is, there are no other "NULLed" files than those 40 I have found earlier. All the files belonged to the same Netbeans project. I have never seen something similar before.
windows hard-drive filesystems
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
Something has malformed a bunch of files on my hard drive. The malformed files:
- have theirs content replaced with NULL bytes,
- are exactly the same size as before the malform happen,
- modification time was not altered
I have at least 40 of those malformed files and are looking for other victims. Most of the files are part of Netbeans php project. Some were text files, some were images. None of them was modified lately. HDD Smart does not show anything worrying and AV software did not detect any viruses. My OS is Windows 7.
Any ideas what could cause this strange behaviour?
[EDIT]
I have scanned the disk to find other malformed files, and the wierd thing is, there are no other "NULLed" files than those 40 I have found earlier. All the files belonged to the same Netbeans project. I have never seen something similar before.
windows hard-drive filesystems
windows hard-drive filesystems
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
edited Nov 27 '14 at 7:29
SWilk
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
asked Nov 26 '14 at 13:19
SWilkSWilk
215312
215312
Although you got the all clear from HDD Smart this really sounds like HDD corruption. Make sure you have a backup regardless.
– rob
Nov 26 '14 at 15:08
I do make daily backup with Duplicati, but those 40 files was used so rarely, that they made it unnoticed for at least two months, so they are malformed in my oldest backups. Fortunatelly, they also have remote copy on my development server (via upload on save in netbeans), and those copies were correct, so I have all the files.
– SWilk
Nov 26 '14 at 15:26
Apart from the reason, I am looking for a way to find all the files which are similarily malformed
– SWilk
Nov 26 '14 at 15:29
I think you need to create a new question to find a tool that will identify any file containing nothing but null bytes.
– rob
Nov 26 '14 at 15:39
This sounds like a crash during defragmentation.
– David Schwartz
Nov 27 '14 at 7:40
|
show 1 more comment
Although you got the all clear from HDD Smart this really sounds like HDD corruption. Make sure you have a backup regardless.
– rob
Nov 26 '14 at 15:08
I do make daily backup with Duplicati, but those 40 files was used so rarely, that they made it unnoticed for at least two months, so they are malformed in my oldest backups. Fortunatelly, they also have remote copy on my development server (via upload on save in netbeans), and those copies were correct, so I have all the files.
– SWilk
Nov 26 '14 at 15:26
Apart from the reason, I am looking for a way to find all the files which are similarily malformed
– SWilk
Nov 26 '14 at 15:29
I think you need to create a new question to find a tool that will identify any file containing nothing but null bytes.
– rob
Nov 26 '14 at 15:39
This sounds like a crash during defragmentation.
– David Schwartz
Nov 27 '14 at 7:40
Although you got the all clear from HDD Smart this really sounds like HDD corruption. Make sure you have a backup regardless.
– rob
Nov 26 '14 at 15:08
Although you got the all clear from HDD Smart this really sounds like HDD corruption. Make sure you have a backup regardless.
– rob
Nov 26 '14 at 15:08
I do make daily backup with Duplicati, but those 40 files was used so rarely, that they made it unnoticed for at least two months, so they are malformed in my oldest backups. Fortunatelly, they also have remote copy on my development server (via upload on save in netbeans), and those copies were correct, so I have all the files.
– SWilk
Nov 26 '14 at 15:26
I do make daily backup with Duplicati, but those 40 files was used so rarely, that they made it unnoticed for at least two months, so they are malformed in my oldest backups. Fortunatelly, they also have remote copy on my development server (via upload on save in netbeans), and those copies were correct, so I have all the files.
– SWilk
Nov 26 '14 at 15:26
Apart from the reason, I am looking for a way to find all the files which are similarily malformed
– SWilk
Nov 26 '14 at 15:29
Apart from the reason, I am looking for a way to find all the files which are similarily malformed
– SWilk
Nov 26 '14 at 15:29
I think you need to create a new question to find a tool that will identify any file containing nothing but null bytes.
– rob
Nov 26 '14 at 15:39
I think you need to create a new question to find a tool that will identify any file containing nothing but null bytes.
– rob
Nov 26 '14 at 15:39
This sounds like a crash during defragmentation.
– David Schwartz
Nov 27 '14 at 7:40
This sounds like a crash during defragmentation.
– David Schwartz
Nov 27 '14 at 7:40
|
show 1 more comment
1 Answer
1
active
oldest
votes
A discussion on the SyncTrayzor github shows that it might be related to windows update.
It has happened to me twice that the config.xml from SyncTrayzor was filled with null-bytes after a windows update and at least one other user had the same problem. Also some Firefox cache files were null-filled at about the same moment.
Searching for files with just null-bytes seem to indicate that they are mostly things like 'configuration' files, or cache files or something. My hypothesis is that these were kept open when the computer was forced to reboot as part of the windows update and were not synced correctly to the drive.
Edit:
Checking restart history and update history indicates that
- Almost all 100% null-byte files are created on the same day as a reboot. Only a few specific ones are not.
- The majority of them were create on, or the day after, a 'Cumulative Update for Windows 10 Version 1803'. Maybe the reboot is occasionally postponed to the day after the install?
So it seems clear that the creation of null-bytes is triggered by reboots.
Most reboots where probably because of an update, so unclear whether it can happen with any reboot or whether update-reboots are special in this regard.
I have not yet figured out how to get all the information in a machine readable form, so it's an inefficient manual investigation so far. Most of these screens I can't even copy-paste from, so this is very inefficient. I would be grateful if someone knows how to get this information into files:
- File names and creation/modification dates of files with all bytes null.
- Windows shutdown/startup dates. Edit:
get-eventlog system | Where source -eq EventLog | Where InstanceID -like 214748965*
- Windows update dates (specifically the ones requiring a reboot).
Edit: Reboot-hypothesis corroborated by https://stackoverflow.com/a/52751216/2097 . That answer only refers to unexpected reboots though.
Edit: Reboot-hypothesis corroborated by N++ team: https://notepad-plus-plus.org/community/topic/13302/fix-corrupted-txt-file-null
Possible recovery mechanism using Recuva: Recover file corrupted due to power cut off
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f845270%2fwhat-could-cause-the-files-to-be-replaced-with-null-bytes-size-and-timestamp-no%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
A discussion on the SyncTrayzor github shows that it might be related to windows update.
It has happened to me twice that the config.xml from SyncTrayzor was filled with null-bytes after a windows update and at least one other user had the same problem. Also some Firefox cache files were null-filled at about the same moment.
Searching for files with just null-bytes seem to indicate that they are mostly things like 'configuration' files, or cache files or something. My hypothesis is that these were kept open when the computer was forced to reboot as part of the windows update and were not synced correctly to the drive.
Edit:
Checking restart history and update history indicates that
- Almost all 100% null-byte files are created on the same day as a reboot. Only a few specific ones are not.
- The majority of them were create on, or the day after, a 'Cumulative Update for Windows 10 Version 1803'. Maybe the reboot is occasionally postponed to the day after the install?
So it seems clear that the creation of null-bytes is triggered by reboots.
Most reboots where probably because of an update, so unclear whether it can happen with any reboot or whether update-reboots are special in this regard.
I have not yet figured out how to get all the information in a machine readable form, so it's an inefficient manual investigation so far. Most of these screens I can't even copy-paste from, so this is very inefficient. I would be grateful if someone knows how to get this information into files:
- File names and creation/modification dates of files with all bytes null.
- Windows shutdown/startup dates. Edit:
get-eventlog system | Where source -eq EventLog | Where InstanceID -like 214748965*
- Windows update dates (specifically the ones requiring a reboot).
Edit: Reboot-hypothesis corroborated by https://stackoverflow.com/a/52751216/2097 . That answer only refers to unexpected reboots though.
Edit: Reboot-hypothesis corroborated by N++ team: https://notepad-plus-plus.org/community/topic/13302/fix-corrupted-txt-file-null
Possible recovery mechanism using Recuva: Recover file corrupted due to power cut off
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
add a comment |
A discussion on the SyncTrayzor github shows that it might be related to windows update.
It has happened to me twice that the config.xml from SyncTrayzor was filled with null-bytes after a windows update and at least one other user had the same problem. Also some Firefox cache files were null-filled at about the same moment.
Searching for files with just null-bytes seem to indicate that they are mostly things like 'configuration' files, or cache files or something. My hypothesis is that these were kept open when the computer was forced to reboot as part of the windows update and were not synced correctly to the drive.
Edit:
Checking restart history and update history indicates that
- Almost all 100% null-byte files are created on the same day as a reboot. Only a few specific ones are not.
- The majority of them were create on, or the day after, a 'Cumulative Update for Windows 10 Version 1803'. Maybe the reboot is occasionally postponed to the day after the install?
So it seems clear that the creation of null-bytes is triggered by reboots.
Most reboots where probably because of an update, so unclear whether it can happen with any reboot or whether update-reboots are special in this regard.
I have not yet figured out how to get all the information in a machine readable form, so it's an inefficient manual investigation so far. Most of these screens I can't even copy-paste from, so this is very inefficient. I would be grateful if someone knows how to get this information into files:
- File names and creation/modification dates of files with all bytes null.
- Windows shutdown/startup dates. Edit:
get-eventlog system | Where source -eq EventLog | Where InstanceID -like 214748965*
- Windows update dates (specifically the ones requiring a reboot).
Edit: Reboot-hypothesis corroborated by https://stackoverflow.com/a/52751216/2097 . That answer only refers to unexpected reboots though.
Edit: Reboot-hypothesis corroborated by N++ team: https://notepad-plus-plus.org/community/topic/13302/fix-corrupted-txt-file-null
Possible recovery mechanism using Recuva: Recover file corrupted due to power cut off
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
add a comment |
A discussion on the SyncTrayzor github shows that it might be related to windows update.
It has happened to me twice that the config.xml from SyncTrayzor was filled with null-bytes after a windows update and at least one other user had the same problem. Also some Firefox cache files were null-filled at about the same moment.
Searching for files with just null-bytes seem to indicate that they are mostly things like 'configuration' files, or cache files or something. My hypothesis is that these were kept open when the computer was forced to reboot as part of the windows update and were not synced correctly to the drive.
Edit:
Checking restart history and update history indicates that
- Almost all 100% null-byte files are created on the same day as a reboot. Only a few specific ones are not.
- The majority of them were create on, or the day after, a 'Cumulative Update for Windows 10 Version 1803'. Maybe the reboot is occasionally postponed to the day after the install?
So it seems clear that the creation of null-bytes is triggered by reboots.
Most reboots where probably because of an update, so unclear whether it can happen with any reboot or whether update-reboots are special in this regard.
I have not yet figured out how to get all the information in a machine readable form, so it's an inefficient manual investigation so far. Most of these screens I can't even copy-paste from, so this is very inefficient. I would be grateful if someone knows how to get this information into files:
- File names and creation/modification dates of files with all bytes null.
- Windows shutdown/startup dates. Edit:
get-eventlog system | Where source -eq EventLog | Where InstanceID -like 214748965*
- Windows update dates (specifically the ones requiring a reboot).
Edit: Reboot-hypothesis corroborated by https://stackoverflow.com/a/52751216/2097 . That answer only refers to unexpected reboots though.
Edit: Reboot-hypothesis corroborated by N++ team: https://notepad-plus-plus.org/community/topic/13302/fix-corrupted-txt-file-null
Possible recovery mechanism using Recuva: Recover file corrupted due to power cut off
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
A discussion on the SyncTrayzor github shows that it might be related to windows update.
It has happened to me twice that the config.xml from SyncTrayzor was filled with null-bytes after a windows update and at least one other user had the same problem. Also some Firefox cache files were null-filled at about the same moment.
Searching for files with just null-bytes seem to indicate that they are mostly things like 'configuration' files, or cache files or something. My hypothesis is that these were kept open when the computer was forced to reboot as part of the windows update and were not synced correctly to the drive.
Edit:
Checking restart history and update history indicates that
- Almost all 100% null-byte files are created on the same day as a reboot. Only a few specific ones are not.
- The majority of them were create on, or the day after, a 'Cumulative Update for Windows 10 Version 1803'. Maybe the reboot is occasionally postponed to the day after the install?
So it seems clear that the creation of null-bytes is triggered by reboots.
Most reboots where probably because of an update, so unclear whether it can happen with any reboot or whether update-reboots are special in this regard.
I have not yet figured out how to get all the information in a machine readable form, so it's an inefficient manual investigation so far. Most of these screens I can't even copy-paste from, so this is very inefficient. I would be grateful if someone knows how to get this information into files:
- File names and creation/modification dates of files with all bytes null.
- Windows shutdown/startup dates. Edit:
get-eventlog system | Where source -eq EventLog | Where InstanceID -like 214748965*
- Windows update dates (specifically the ones requiring a reboot).
Edit: Reboot-hypothesis corroborated by https://stackoverflow.com/a/52751216/2097 . That answer only refers to unexpected reboots though.
Edit: Reboot-hypothesis corroborated by N++ team: https://notepad-plus-plus.org/community/topic/13302/fix-corrupted-txt-file-null
Possible recovery mechanism using Recuva: Recover file corrupted due to power cut off
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
edited Feb 5 at 21:21
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
answered Feb 5 at 20:10
BlackShiftBlackShift
241210
241210
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f845270%2fwhat-could-cause-the-files-to-be-replaced-with-null-bytes-size-and-timestamp-no%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Although you got the all clear from HDD Smart this really sounds like HDD corruption. Make sure you have a backup regardless.
– rob
Nov 26 '14 at 15:08
I do make daily backup with Duplicati, but those 40 files was used so rarely, that they made it unnoticed for at least two months, so they are malformed in my oldest backups. Fortunatelly, they also have remote copy on my development server (via upload on save in netbeans), and those copies were correct, so I have all the files.
– SWilk
Nov 26 '14 at 15:26
Apart from the reason, I am looking for a way to find all the files which are similarily malformed
– SWilk
Nov 26 '14 at 15:29
I think you need to create a new question to find a tool that will identify any file containing nothing but null bytes.
– rob
Nov 26 '14 at 15:39
This sounds like a crash during defragmentation.
– David Schwartz
Nov 27 '14 at 7:40