Can someone please tell me the name of the worker thread that this process uses to constantly check for corruption?

Hi, I'm not clear about the question. Are you trying to find this article? Self-Healing NTFS http://technet.microsoft.com/en-us/library/cc771388(WS.10).aspx If not, please provide more explanation about the question. ThanksShaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com

All of the documentation I found mentions "...a worker thread is spawned that repairs file corruption...", but nowhere does it state the name of the thread. If I wanted to see this thread via Process Explorer, what would I look for?

Hi, Whether this is the article you found? Self-healing NTFS http://blogs.technet.com/b/doxley/archive/2008/10/29/self-healing-ntfs.aspx In article it mentioned "All this is performed in the background without anyone actually noticing that it happened, unless you have something (such as MOM or SCOM) keeping an eye on the Eventlog for the relevant events as they are logged." I tried to search for the name but not found. Is there any specific issue on your side so you would like to find out the name? Shaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com

There isnt any issue; fsutil repair query c: reveals that its running with default flag. I was just reading about it and since the information is vague, I thought i may find deeper dive info on this forum. Maybe I have to ask this question on Mark Russinovich's site :)

Hi, I tried to find the developer of the self-healing NTFS and will post back if got a reply.Shaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com

Much appreciated. Would it have killed them to list the thread name in all that documentation? :)

Okay your question is making me doubt what i "think" i know. Do thread have names?? This is what i "know": A process has a name, and a process may have many, many threads. Using Perfmon you can monitor the individual threads associated with each process, but nowhere that i know of can you monitor a thread by name, as far as i know you can't even be guaranteed that any numbered thread (as shown in perfmon) will be the same thread each and every time the process is started.

I got reply and here it is: There is no guarantee of a specific thread handle self healing will run on. Currently it runs under the system process. It’s launched thru the worker thread model on a on demand basis. From the question, self healing doesn’t actively check for corruption. It reacts to corruption detected by the ntfs driver. That detection can be in any thread any process.Shaon Shan| TechNet Subscriber Support in forum| If you have any feedback on our support, please contact tngfb@microsoft.com

After reading the blog post Shaon Shan references “If a corruption is detected, an NTFS worker thread is spawned which will go off and perform a localized fix-up of those data structures..." An NTFS worker thread will most likely be part of the NTFS.sys file system driver. Again NTFS.sys will be the process, not the thread. A thread is simply the mechanism processes use to do multiple activities in parrallel.

I still don't get the self-healing deal. 3 times over the course of almost a year now using Windows 7 (x64), I had 2 self-heals actually DELETE a file that I would have not known about had I not gotten into the habit of checking out Event Viewer now and then; and 1 time it tried to heal but logged it couldn't, and then running chkdsk it deleted a file. I find it a little disturbing that in fixing whatever it fixes a file is actually deleted, and if I did not know this an ran an app that requires it it would probably crash or not work right (in these cases the files happened to be from games and luckily not system files). Otherwise, NTFS is extremely reliable. I just don't like the fact the few times I got a self-heal activated, it actually deleted files.