How SCANDISK Repairs Lost Clusters in MS-DOS 6.22

This article explains how the MS-DOS 6.22 SCANDISK utility detects, processes, and resolves lost cluster chains on FAT-formatted drives. It covers the underlying File Allocation Table (FAT) structure, the origin of orphaned data, and the precise steps the utility takes to either recover these clusters into readable files or clear them to free disk space.

Understanding Lost Cluster Chains

In the MS-DOS FAT16 file system, files are stored across discrete disk blocks called clusters. The File Allocation Table acts as a roadmap: a directory entry stores the file name, metadata, and the address of the first cluster. That cluster's entry in the FAT then points to the next cluster in the sequence, continuing until an End-of-File (EOF) marker (typically 0xFFFF) is reached.

A lost cluster chain occurs when clusters are marked as allocated (in use) in the FAT, but no directory entry anywhere in the file system points to the start of the chain. These orphaned chains typically result from abrupt power losses, system crashes, or programs terminating before closing open file handles and updating the directory table.

Detection by SCANDISK

When executed, SCANDISK performs an integrity check of the file system structure by executing the following process:

  1. Memory Mapping: SCANDISK reads the entire directory structure (the root directory and all subdirectories) into memory, tracing all valid cluster chains from their starting pointers to their EOF markers.
  2. Cross-Referencing the FAT: It compares these active references against the entries in the File Allocation Table.
  3. Isolating Orphans: Any cluster marked as active in the FAT that is not claimed by an existing directory entry is flagged. SCANDISK then follows the pointer links within the FAT to map the full length of the orphaned chain.

The Repair Process

Once SCANDISK identifies a lost cluster chain, it pauses and prompts the user to either save the chain or delete it. The repair proceeds based on the user's choice:

Option 1: Converting to Files (Save)

If the user chooses to save the lost clusters, SCANDISK recovers the data by reconnecting it to the directory hierarchy:

  • Creating Directory Entries: SCANDISK generates a new entry in the root directory using the naming convention FILEnnnn.CHK (starting with FILE0000.CHK and incrementing sequentially).
  • Linking the Chain: It writes the address of the chain's first cluster into the new directory entry's starting cluster field.
  • Preserving FAT Pointers: The existing cluster chain links inside the FAT remain intact, ending at the original EOF marker.
  • Calculating File Size: SCANDISK calculates the file size by multiplying the number of clusters in the chain by the drive's cluster size (bytes per cluster) and records this value in the directory entry.

Users can then examine these .CHK files using text editors or binary viewers to recover salvageable text or application data.

Option 2: Freeing Disk Space (Delete)

If the user chooses to delete the lost clusters, SCANDISK purges the allocation records to restore drive capacity:

  • Zeroing Entries: SCANDISK traverses the orphaned chain within the FAT and overwrites each entry with 0x0000, the standard marker indicating an unallocated, free cluster.
  • No File Creation: No directory entries are created in the root directory.

Finalizing Changes to Disk

MS-DOS maintains two identical copies of the FAT for redundancy. After modifying the in-memory representation according to the user's repair selections, SCANDISK writes the updated tables to both FAT copies on the disk. If files were saved, it also writes the updated root directory sectors. This synchronizes the physical allocation tables with the actual directory structure, eliminating the file system discrepancies.