"Disk error" invisible except to event viewer, when imaging hard drive


  1. Posts : 281
    Win7 Professional 64
       #1

    "Disk error" invisible except to event viewer, when imaging hard drive


    My Windows 7 configuration is relatively bullet proof (ha ha, nervous laughter).

    My OS and programs are on C, which I image using RDriveImage every month after Patch Tuesday.

    My data is on software-mirrored D/F drives.

    So as long as I don't have a catastrophic event affecting my computer, a routine "drive failure" should be recoverable, with the worst-case being I'd be out a month of updates, but with a good recent image of the OS drive.

    Anyway, I was recently looking at my event viewer and I have "Disk errors" that occur whenever I run a full image of C.

    The complete error text is:

    Log Name: System
    Source: Disk
    Date: 7/13/2012 3:38:44 PM
    Event ID: 11
    Task Category: None
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: xxxxxx
    Description:
    The driver detected a controller error on \Device\Harddisk3\DR3.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Disk" />
    <EventID Qualifiers="49156">11</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-07-13T19:38:44.199218700Z" />
    <EventRecordID>136049</EventRecordID>
    <Channel>System</Channel>
    <Computer>xxxxx</Computer>
    <Security />
    </System>
    <EventData>
    <Data>\Device\Harddisk3\DR3</Data>
    <Binary>0E01800001000000000000000B0004C003010000000000000000000000082D0000000000000000000D563C000000 0000FFFFFFFF0600000058000000000000000000061208000010000000003C0000000000000000000000405E7A0780FAFFFF 00000000000000001066250A80FAFFFF00000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000</Binary>
    </EventData>
    </Event>
    There were two errors in February (none before that), three in March, four each in May and July. In April and June I did incremental images, so the "bad" area wasn't imaged, so no error.

    With all the above as background, what's the safest way for me to isolate and/or repair the area(s) of the disk with the errors?

    The errors are always logged within 1-2 seconds of each other, so I suspect it's just one bad area.

    And I have never, ever, seen signs of a disk error. No BSOD, no clicking noises, no impaired performance, even for a moment.
      My Computer


  2. Posts : 2,171
    Windows 7 Ultimate x64
       #2

    Try going into your BIOS to see what it has to say about the drive. Some BIOS's can read the drive's SMART status and can run tests on it. You could also download the disk manufacturer's drive diagnostics to check it out. Or see what Seatools (from Seagate) has to say about it:

    SeaTools | Seagate
    Last edited by F5ing; 14 Jul 2012 at 17:58. Reason: spelling.
      My Computer


  3. Posts : 10,796
    Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
       #3

    Any other errors just before that in eventlog? Most likely atapi, and volsnap. Please post as well.

    Is Harddisk3 the source or destination disk of backup? Look in disk managemnt. Is disk3 sata or usb?

    Did the backup operation succeed successfuly? In most of this cases it can't read or write so crashes
      My Computer


  4. Posts : 281
    Win7 Professional 64
    Thread Starter
       #4

    Kaktussoft said:
    Any other errors just before that in eventlog? Most likely atapi, and volsnap. Please post as well.

    Is Harddisk3 the source or destination disk of backup? Look in disk managemnt. Is disk3 sata or usb?

    Did the backup operation succeed successfuly? In most of this cases it can't read or write so crashes
    Some great questions I'd not considered.

    Immediate prior errors in eventlog, like volsnap or atapi?
    Sort of. There's one information (not error) event immediately before the disk error, and here it is:

    Log Name: System
    Source: volsnap
    Date: 7/13/2012 3:38:42 PM
    Event ID: 33
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: xxxxxx
    Description:
    The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="volsnap" />
    <EventID Qualifiers="16390">33</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-07-13T19:38:42.886718700Z" />
    <EventRecordID>136047</EventRecordID>
    <Channel>System</Channel>
    <Computer>xxxxxx</Computer>
    <Security />
    </System>
    <EventData>
    <Data>\Device\HarddiskVolumeShadowCopy1</Data>
    <Data>C:</Data>
    <Binary>00000000020030000000000021000640020000000000000000000000000000000000000000000000</Binary>
    </EventData>
    </Event>
    There are lots of volsnap information events going back to 11/15/2011, some associated with drive imaging, but most not. Some happened with the computer in use, others when it was asleep or unattended.

    There are no atapi events - none - in a log with 56,000 entries in it.
    Is Harddisk3 the source or destination disk of backup?
    Wow, I'd never considered this. It's the destination, not the source. It's a USB external drive.
    Did the backup operation succeed successfuly? In most of this cases it can't read or write so crashes.
    Every backup (image) I've done, including the full image, has successfully concluded. I get the normal R-DriveImage successful completion message. And I'm sitting right at the computer as the imaging goes on, and I never hear or see signs of struggle. DriveImage, on this computer, has always been able to image my hard drive (currently about 50 gigs of used space) in about 10-15 minutes.
    This is definitely a weird pattern though. I've had this computer since December 2010 and imaged it when new, then monthly after Patch Tuesday. Since the errors started in February, they have only occurred in months I've done a full (new) backup, and never in months I've done an incremental backup. And I don't delete old backups from the external HD until after successfully completing the backup, and I keep 2-4 old backups on the drive, and there's still plenty of room.

    Knowing that it's the external drive makes me feel better, but still, suggestions of next steps?
      My Computer


  5. Posts : 10,796
    Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
       #5

    Volsnap information is quite normal. Reserved space on C for snapshots (restore points) is full and the oldest snahot will be removed. System restore points are still there, I assume?

    If you are sure harddisk 3 is your external then there is problem with that.
    Defrag the external disk or perform a chkdsk/f/r (in windows) on it so it has a lot to do. After that look in event log for errors.
      My Computer


  6. Posts : 10,796
    Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
       #6

    Please report back if external drive is really the problem disk!
      My Computer


  7. Posts : 281
    Win7 Professional 64
    Thread Starter
       #7

    Kaktussoft said:
    Volsnap information is quite normal. Reserved space on C for snapshots (restore points) is full and the oldest snahot will be removed. System restore points are still there, I assume?

    If you are sure harddisk 3 is your external then there is problem with that.
    Defrag the external disk or perform a chkdsk/f/r (in windows) on it so it has a lot to do. After that look in event log for errors.
    System restore points, still there, yes.

    I did a defrag analysis on it and it said it wasn't fragmented, so I skipped the actual defrag (I know, I know, point was to exercise the disk!).

    Running chkdsk /f/r on it now and it blazed through the first three steps in a minute or two; it's been stuck for an hour or so now at 10% done on step 4, with (currently) 63 of 60512 files processed.

    Relevant to this thread, I keep refreshing the event viewer and there have been no errors of any kind since yesterday's disk error that caused me to post.

    Not as relevant, but curious, how long should a chkdsk /f/r take on a USB 2 500 gig external drive with 60,000 files and 25% free space?
      My Computer


  8. Posts : 281
    Win7 Professional 64
    Thread Starter
       #8

    Okay, I have run chkdsk /f/r on it and no problems:
    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Users\xxx>chkdsk g: /f/r
    The type of the file system is NTFS.
    Volume label is Elements.

    CHKDSK is verifying files (stage 1 of 5)...
    60528 file records processed.
    File verification completed.
    5 large file records processed.
    0 bad file records processed.
    0 EA records processed.
    0 reparse records processed.
    CHKDSK is verifying indexes (stage 2 of 5)...
    65456 index entries processed.
    Index verification completed.
    0 unindexed files scanned.
    0 unindexed files recovered.
    CHKDSK is verifying security descriptors (stage 3 of 5)...
    60528 file SDs/SIDs processed.
    Security descriptor verification completed.
    2465 data files processed.
    CHKDSK is verifying Usn Journal...
    8682376 USN bytes processed.
    Usn Journal verification completed.
    CHKDSK is verifying file data (stage 4 of 5)...
    60512 files processed.
    File data verification completed.
    CHKDSK is verifying free space (stage 5 of 5)...
    30726123 free clusters processed.
    Free space verification is complete.
    Windows has checked the file system and found no problems.

    488386551 KB total disk space.
    365318160 KB in 26897 files.
    13800 KB in 2466 indexes.
    0 KB in bad sectors.
    150099 KB in use by the system.
    65536 KB occupied by the log file.
    122904492 KB available on disk.

    4096 bytes in each allocation unit.
    122096637 total allocation units on disk.
    30726123 allocation units available on disk.
    And I checked the event viewer before and after disconnecting the external HD and there were no errors.

    So what does this all mean? I gave the external HD a pretty good workover - 3+ hours running chkdsk - and nothing generated a disk error.

    One final, maybe useful, piece of food for thought - I filtered the event log for just "disk error" and "volsnap" and each disk error was immediately preceded, by one second or less, by a volsnap. That would be a volsnap on C (drive being imaged), followed by 2-4 successive disk errors on the external HD.

    I guess the good news is that I don't have much or any problem, and the bad news is that I do have a minor head-scratcher here.
      My Computer


  9. Posts : 10,796
    Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
       #9

    So only disk error AFTER volsnap error? Difference in time is 1 or 2 seconds? No other disk error in event log? any other volsnap errrors?

    Volsnap error is not an error btw. It's just informational as explained before. Really strange!
      My Computer


  10. Posts : 10,200
    MS Windows 7 Ultimate SP1 64-bit
       #10

    A couple of pieces of info:
    chkdsk /r automatically includes /f
    specifing /r /f does not harm but is unnecessary.
    Back in the old days, you had to specify both.
    To satisfy your curiosity, you can go to a command prompt and type
    chkdsk /?

    Defrag-- you can be heavily fragmented and MS reports a very low percentage.

    Let's say you are only using 5 % of a 2 TB disk. You might have many fragmented files, but the MS % is based upon total disk size.

    Personally, I use CONTIG from the SysInternals people at Microsoft.
    Go to an elevated command prompt and type
    contig c:\* /s /q

    Contig

    And finally, here are instructions on how to run a simple PowerShell script that will list the most recent 100 critical and error events. You will notice that by making a single change you can change the number of events reported.

    # **********************INSTRUCTIONS**************************
    # STEP 1 *****************************************************
    # RUN PowerShell as administrator
    # WIN key | type POWERSHELL | do NOT hit ENTER |
    # in the resulting PROGRAMS list, right-click on WINDOWS POWERSHELL |
    # choose "Run as administrator" from the resulting list
    # Click on the YES button (if such appears)
    #
    # WIN key = key with Microsoft log on top
    # for the guru:
    # WIN key | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
    # ************************************************************
    # STEP 2 *****************************************************
    # COPY, using CTRL+C, every line of script down thru both EXIT statements
    # PASTE into Powershell
    #----Right-Click at the PowerShell Prompt
    #----(Ctrl+V does not work)
    # Start copying with first line without a # at start of the line
    # Note: Actually, you can paste the entire file if you rather
    #-------Lines starting with a # are ignored by PowerShell
    # ************************************************************
    # ***************** NOTE - POWERSHELL VERSION*****************
    # if you receive this error msg:
    #--Get-WinEvent: The system can not find the path specified
    # you need to update your PowerShell
    # you must be using Powershell 2.0 or later.
    #
    # To determine your Powershell version:
    #---Run PowerShell
    #---enter $host.version
    #---you should see at least:
    # Major Minor Build Revision
    # ----- ----- ----- --------
    # 2......0......-1.....-1
    #
    # If you do not see the above, update your Vista/Win 7.
    # ************************************************************
    # *************** NOTE - EXECUTION POLICY*********************
    # If you haven't set the execution policy, you may need to:
    #---Run PowerShell
    #---enter Set-ExecutionPolicy -executionpolicy remotesigned
    # ************************************************************

    ===============================================
    now for the script:
    Script:
    # ************************************************************
    # Places CRITICALandERROREVENTS.TXT on your DESKTOP
    #
    # Displays 100 most recent critical and error events in a Grid View
    # Writes 100 most recent critical and error events to CriticalAndErrorEvents.txt
    #
    # Change the $MAX value for more or fewer events
    # Change the $Lwidth value to 254 for example for longer lines
    # **********************************************************

    $MAX 100
    $LWidth 
    132
    $a 
    Get-WinEvent -FilterHashtable @{logname='*';  level=1,2} `
    -max 
    $MAX  -verbose:$false -erroraction:silentlycontinue |
    sort-object -property 
    `
    @{
    expression="level";Descending=$false}, `
    @{expression="timecreated";Descending=
    $true} |
    select-object -property leveldisplayname, timecreated, ID,  Message 
    $a | out-gridview -Title "Critical and Error Events"
    $a | format-table  @{Label = "Level"; Expression =  {$_.leveldisplayname} }, timecreated, ID, Message -wrap -auto |
    out-file 
    $env:userprofile\Desktop\CRITICALandERROREVENTS.TXT -width $Lwidth

    EXIT
    EXIT

    # ************************************************************ 
    ====================
    have fun,
    karl
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:19.
Find Us