How to delete "ghost" dir entries in NTFS partition?

[FredThompson]

I'm running Win2K with NTFS drives. There are 2 "ghost" entries in a directory which I'm tyring to delete. They're long filenames but, appaprently, still valid. The problem is any access of these files reutrns a "file not found" error. I've tried Norton Systemworks and OnTrack Easy Recovery Pro to no avail.

Does anyone know of a tool that will more aggresively get rid of these "ghost" entries?

If the drive was FAT ro FAT32, this would be trivial. NTFS' directory structure is a royal pain to trace.

[SeeMoreDigital]

Fred, are you running a single boot partition system. And do you have the most up to date SP3 installed?

I only ask because if you create (or have) a sepatate partition, you can often 'cut and paste' these sorts of ghost files into a different partition... and then delete them!

[FredThompson]

single boot, single partition. I've tried safeboot with command prompt and gotten nowhere. The drive is actually from another computer and I thought maybe moving it would make the entries available. They have a length of zero and, I assume, that's part of the problem. They're true ghost entries.

Even rename doesn't work. Take a look at this dir dump:

Directory of H:\Working\Ongoing Projects\AV Editing\Additional Files\Dead Sites\AVI - VirtualDub\Valentim Batista\timsara.freeservers.com\cgi-bin

06/28/2003 06:09p <DIR> .
06/28/2003 06:09p <DIR> ..
06/28/2003 06:09p 0 list.txt
08/31/2002 03:40a 43 sitestats.gif@p=http_253A_252F_252Ftimsara.freeservers.com_252Findex.html;r=http_253A_252F_252Ftimsara.freeservers.com_252F;t=692;
09/08/2002 01:13a 43 sitestats.gif@p=http_253A_252F_252Ftimsara.freeservers.com_252Findex.html;r=http_253A_252F_252Ftimsara.freeservers.com_252F;t=7255;
3 File(s) 86 bytes
2 Dir(s) 5,050,707,968 bytes free

Norton no longer has true low-level utils and I'm a little leery of directly editing the sectors anyhow because of the NTFS directory structure. I'm reasonably certain I could search for these strings and replace all the cahracters with, say, "A" and "B" but what if there's some kind of dir checksum and I hose everything up?

Compounding the challenge is the fact this is a boot drive. Otherwise, it would be lengthy but very duable to just copy the files elsewhere, reformat, then restore. Imaging the drive will replicate the problem.

[b0b0b0b]

did you try from the dos prompt a rd/s/q of the owning directory?

do they have short names (visible through dir/x)?

[FredThompson]

rd /s /q returns "The syntax of the command is incorrect."

dir /x returns the same long filenames. (edit: no, it returns the short names but those aren't accepting an erase command, either.)

I'm digging around ntfs.com hoping to find something useful. Didn't see much at DataRescue and I'm a little nervous about screwing around with DFSee.

Thanks for the ideas.

[FredThompson]

Hmmm...these ideas might help:

http://www.jsifaq.com/subl/tip5500/rh5533.htm

(yeah, well, the utils have to be purchased. Grrr...rebuilding this drive is REALLY going to suck.)

[b0b0b0b]

sysinternals.com has free, cool very low-level utilities.

Here's one that does deleting:
http://www.sysinternals.com/ntw2k/source/sdelete.shtml

[FredThompson]

That looks pretty cool.

SDelete is reporting the filenames are too long. Don't suppose you know of a low-level routine to fix that problem, do you?

[b0b0b0b]

Have you already run run chkdsk /f ?

[FredThompson]

Yes, Systemworks' Disk Doctor forces it during a successive reboot.

Hmmm...should I do it manually from safeboot command prompt?

[mrbass]

http://arstechnica.infopop.net/OpenTopic/page?a=tpc&s=50009562&f=12009443&m=1460952275