Check Disk (chkdsk) - Read Event Viewer Log

Brink said:

pxfragonard said:

Hmm, method two works great for my Windows 7 machine but doesn't for the Vista machine. I get this message in powershell (image included, couldn't copy/paste.

Hello,

I'm afraid that command requires at least PowerShell 4.0, and it doesn't appear to support Vista.

Download Windows Management Framework 4.0 from Official Microsoft Download Center

I, too, discovered that the command did not work for me in Win 7 sp1 64bit, under Powershell 2.0. The problem is that "Desktop" cannot be used as is.

However, it is possible to fix it to work thus:

Code:

PS C:\> get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.
providername -match "wininit"} | fl timecreated, message | out-file $env:UserPro
file\desktop\CHKDSKResults.txt

This of course depends on the env variable existing and one's desktop actually being in the user folder, and not somewhere else.

It is probably also possible to use

Code:

[Environment]::GetFolderPath("Desktop")

which returns the correct path for me, but I haven't figured out how to use it in the Powershell command. That would be a better solution, since it would still work if the desktop had been relocated.

--peter

A couple more comments on the Powershell command method.

1. Why even bother with figuring out where the desktop is? Why not just redirect the output to a file you actually want it in:

Code:

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_. providername -match "wininit"} | fl timecreated, message >> path-of-where-I-want-to-put-it.txt

That way, we don't care how to find the desktop.

2. Usually, one only wants the last chkdsk result, but the command returns multiple ones. It's not clear to me how to have it spit out only the last one?

Oh, and yet another comment. The log file that is produced with the command version is in unicode, which is double the size actually needed, unless there are actual unicode characters, and is not very readable with an editor that does not understand unicode. The easiest way I have found to convert a unicode file to an ascii file is the windows shell command:

Code:

type existing-unicode-filename > new-ascii-filename