Originally published in INSIGHT on Windows NT/2000 eLetter the Diskeeper newsletter.

Which version of NTFS am I running?
by John Joseph
Diskeeper Development Section

Recently, one of our Tech Support representatives came to me with an interesting problem. A user who had recently installed Diskeeper called in to Tech Support claiming that Diskeeper had done something to his Windows NT4 system that rendered CHKDSK unusable on his NTFS drives.

The rep had reviewed with this user that installing Windows 2000 would have just this effect: Windows 2000 does a "conversion" of NT4-type NTFS volumes to Windows 2000-type NTFS volumes.

The user remained unconvinced, however. He'd never installed Windows 2000 on this machine, or even brought Windows 2000 near the machine. He was insistent on this and basically refused to believe the rep. Now baffled, the rep wanted a way to find out what version of NTFS was running on this system, and came to me for help.

So I dragged out the Windows NT4 Resource Kit, and found the tool DSKPROBE. Here's the procedure we came up with to examine a volume's NTFS version:

1. Drag out your Resource Kit and put DSKPROBE somewhere you can run it. A diskette is fine if it'll fit. There's no "installation procedure". All you need is the .exe.
2. Make sure you're logged on as an Administrator and that the drive you want to examine is local (not networked).
3. Make sure you know what volume you're going to examine. (X:)
4. Run DSKPROBE.EXE.
5. Select DRIVE->LOGICAL VOLUME
6. Double-click on the volume you're examining. This will open handle zero to that drive.
7. Click on SET ACTIVE in the HANDLE 0 area. LEAVE THE READ-ONLY BOX CHECKED.
8. Click "OK".
9. Select SECTORS->READ and read in sector 0 for length 1.
10. Select VIEW->NTFS BOOT SECTOR
11. Click the "GO" button next to "Clusters to MFT"
12. Select VIEW->BYTES.
13. Select SECTORS->READ
14. Leave the "STARTING SECTOR" value alone.
15. Make "Number of Sectors" be 8, and click on READ.
16. You have just read in the first 4 MFT records. We're looking for MFT record number 3, so we must click on the right arrow in the tool bar six times.
17. You will end up looking at the first half of MFT record 3, the MFT record for $Volume. You will see the text "$Volume" in the display.
18. There are 16 columns of hex digits. Looking down column 0 or 8, you will find a hex "70". Here's where I found it on my machine:

        1B0 70 00 00 00 28 00 00 00 00 00 18 00 00 00 05 00
        1C0 0C 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00
        1D0 03 00 00 00 00 00 00 00 00 00 00 00 18 00 00 00
    
        (You may have to go to the next sector to see the "70".)
    

19. At the line starting with 1D0 is a "03 00". This value is 32 bytes past the "70". "03 00" means this volume is running NTFS version 3.0.
20. If you're running NT4 you'll usually see "01 02". This is NTFS version 1.2.
21. If, perchance, you're running an XP beta, you'll most likely see the value "03 01", meaning this volume is running NTFS version 3.1.

A few days later, the user called back in and, embarrassed, told us that his kid had tried to install Windows 2000 on the machine one Saturday morning when he was in bed fast asleep. The kid apparently didn't finish the installation but did leave the evidence behind....

Sorry, kid. You've been busted

(C) 2001 Executive Software International, Inc. All Rights Reserved. Executive Software and Diskeeper are trademarks owned by Executive Software International, Inc.

covers analysis, tuning, optimization, automation, enhancement, maintenance, and troubleshooting of Windows

<

defines problems and follows up with concise, detailed solutions