Windows 2000 NTFS Bad Sector Remapping

Microsoft Windows 2000 automatically resolves disk degradation on NTFS volumes through a built-in fault-tolerance mechanism known as dynamic bad cluster remapping. This article explains how NTFS detects failing sectors during standard I/O operations, isolates defective storage blocks using metadata tracking, and reallocates data transparently without requiring immediate manual intervention or disk formatting.

The Detection Process

NTFS monitors all read and write requests processed through the Windows 2000 storage stack. When the disk controller returns a hardware error indicating an unreadable or unwritable sector (such as STATUS_DEVICE_DATA_ERROR), the NTFS driver initiates its automated recovery procedure based on the type of operation and the volume architecture.

Write Error Handling

When a write operation fails on any NTFS volume (whether basic, mirrored, or striped):

  1. The NTFS driver detects the physical sector failure reported by the disk subsystem.
  2. It immediately allocates a new, healthy cluster elsewhere on the volume.
  3. The data is written to the newly allocated cluster.
  4. The file system updates the file’s allocation map in the Master File Table (MFT) to point to the new cluster.
  5. The address of the defective cluster is added to the $BadClust metadata file (MFT record 8) to prevent Windows 2000 from ever allocating it again.
  6. The operation completes successfully from the perspective of the application, avoiding data loss.

Read Error Handling

How NTFS handles read errors depends directly on whether the volume possesses software fault tolerance:

  • Fault-Tolerant Volumes (RAID-1 Mirrors and RAID-5 Sets): If a read request fails, Windows 2000 uses the redundant data (the alternate mirror plex or reconstructed parity) to retrieve the missing information. Once retrieved, NTFS writes the recovered data to a newly allocated cluster, updates the file's MFT record, copies the bad cluster to $BadClust, and marks the original sector as unusable. This dynamic recovery occurs entirely in the background.

  • Non-Fault-Tolerant Volumes (Basic Disks): If a read fails on a standard volume with no redundancy, the data contained within that cluster is lost, and Windows 2000 returns an I/O read error to the requesting application. NTFS cannot reconstruct unreadable data on a non-redundant disk. However, if that same cluster is subsequently targeted by a write operation, NTFS performs dynamic remapping at that moment, retiring the cluster into $BadClust.

The Role of the $BadClust Metadata File

NTFS tracks storage integrity using $BadClust, a hidden system file present on every NTFS volume. When dynamic remapping flags a sector as unusable:

  • The cluster offset is logged into $BadClust.
  • The volume bitmap ($Bitmap) marks the bad cluster as allocated so no standard file allocation routines can claim it.
  • Future integrity checks executed by CHKDSK reference this table to verify known damaged areas without re-testing them unnecessarily.

Drive Firmware vs. NTFS Remapping

Windows 2000 operates above the physical hardware layer. Modern IDE/ATA and SCSI drives utilize internal firmware to automatically reallocate bad sectors to reserved spare sectors (known as the Grown Defect List). NTFS dynamic remapping serves as an additional file-system-level safeguard. If the hard drive's internal reallocation fails, runs out of spare sectors, or passes an unrecoverable error code up to Windows 2000, NTFS isolates the block at the cluster level to maintain file system integrity.