Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Check Disk (chkdsk) - Read Event Viewer Log

15 Aug 2013   #60
Brink

64-bit Windows 10 Pro
 
 

Quote   Quote: Originally Posted by JTSH View Post
Hi Brink

I'm a total noob with regards to tech stuff and I really hope you can explain some things.
When I ran a chkdsk e: /f /r on my external hard disk, one of things which came up was "Deleting index entry ABC.DOC in index $I30 of file 5.'

Does this mean that chkdsk has deleted the file ABC.doc? If so how can i recover it?
If it was not deleted, then what does that mean essentially?

Sorry if the qn seems dumb but I only have the most basic computer related knowledge.
Hello JTSH, and welcome to Seven Forums.

No worries. That entry just means it only deleted the reference of the ABC.DOC file in the index. Most likely because that file had been previously deleted, so there's no need to have it in the index for search results.


My System SpecsSystem Spec
.
15 Aug 2013   #61
JTSH

Windows Home 7
 
 

Hi Brink,

Thank you for your reply!

I have a few more questions to ask which might (or not) benefit from a summary of events leading up to this moment:

1. I could not access my external hard drive and the message citing "cyclic redundancy check" kept appearing every time I double clicked on the drive.

2. Got the idea after much googling around to run chkdsk e: /f /r.
At stage 4 of 5 <12203 of 12992 files processed>, an unspecified error occurred <6e74667363686b2e b34>.

3. So I ran chkdsk e: /f (this time without the /r), and was able to complete the command and finally access the external drive. However I could not determine what files (if any) had been deleted during chkdsk and couldn't understand the log. On seeing "Deleting index entry ABC.DOC in index $I30 of file 5', I thought some files might have been deleted during chkdsk. But after your earlier explanation to me that index entry is not the file and just the reference, I have a better understanding.

A few other questions I have looking through the log:
1. "16 bad file records processed" - Does that mean that the 16 bad files have been fixed and I'm able to access them? No further details were given like which files etc.
2. 80KB in bad sectors - This just means that 80 KB of my external hard drive is corrupted right?
3. What does it mean when it says "Recovering orphaned file CBA.DOC <1917> into directory file 1914"? What is an orphaned file? Does it mean that the location of these files were not recorded properly previously due to improper shutdown etc and are now being placed back in the correct place?
4. Last and most importantly, how can I know if chkdsk has deleted any of my files? Or what files have been recovered or not?

I hope I'm making sense to you haha

I've attached a printscreen of the last phase of chkdsk e: /f for your reference.


Attached Images
Check Disk (chkdsk) - Read Event Viewer Log-filerecovery-1.1.png 
My System SpecsSystem Spec
15 Aug 2013   #62
Brink

64-bit Windows 10 Pro
 
 

I don't know all of the specific technicalities of all of it, but answers inline for what I do know.

The link below is a good explanation of chkdsk that will help understand chkdsk more. It's for XP and a long read, but the principal is the same.
An explanation of the new /C and /I Switches that are available to use with Chkdsk.exe
Quote   Quote: Originally Posted by JTSH View Post
A few other questions I have looking through the log:
1. "16 bad file records processed" - Does that mean that the 16 bad files have been fixed and I'm able to access them? No further details were given like which files etc.
That means that there was 16 bad file references in the file system found.
Quote   Quote: Originally Posted by JTSH View Post
2. 80KB in bad sectors - This just means that 80 KB of my external hard drive is corrupted right?
This means that you had 80KB of bad (corrupted) sectors on the hard drive that have been marked to no longer be used by the file system.
Quote   Quote: Originally Posted by JTSH View Post
3. What does it mean when it says "Recovering orphaned file CBA.DOC <1917> into directory file 1914"? What is an orphaned file? Does it mean that the location of these files were not recorded properly previously due to improper shutdown etc and are now being placed back in the correct place?
An orphaned file is one for which a legitimate FRS (file record segment) exists, but which is not listed in any directory. When an orphaned file is found, it can often be restored to its rightful directory, provided that directory is still around. If the directory that should hold the file no longer exists, CHKDSK will create a directory in the root directory and place the file there. If directory listings are found that reference FRSs that are no longer in use or that are in use but do not correspond to the file listed in the directory, the directory entry is simply removed.

The improper shutdown message means that the files were orphaned because you improperly shut down the computer (ex: pressed the case power button to turn off) while it was still writing files to the hard drive.

It looks like chkdsk corrected this for you though.
Quote   Quote: Originally Posted by JTSH View Post
4. Last and most importantly, how can I know if chkdsk has deleted any of my files? Or what files have been recovered or not?
The only way to know is to look through the event log for chkdsk to see if there are any unrecovered listings. From what I see in your screenshot, I wouldn't worry about any files being deleted.
My System SpecsSystem Spec
15 Aug 2013   #63
JTSH

Windows Home 7
 
 

Hi Brink.

Thank you very much for your explanation!

I've also read your link which in combination is a lot to digest for a noob and I can't pretend to fully comprehend everything but it's certainly made things a lot clearer!

Quote   Quote: Originally Posted by Brink View Post

Quote   Quote: Originally Posted by JTSH View Post
4. Last and most importantly, how can I know if chkdsk has deleted any of my files? Or what files have been recovered or not?
The only way to know is to look through the event log for chkdsk to see if there are any unrecovered listings. From what I see in your screenshot, I would worry about any files being deleted.
OMG, did you say you "would worry" about any files being deleted? Or was that a typing error and you meant to type "wouldn't" lol?
My System SpecsSystem Spec
.

15 Aug 2013   #64
Brink

64-bit Windows 10 Pro
 
 

Sorry, that should be "wouldn't" instead. Autocorrect got me again. LOL

I'd recommend to keep an eye on the drive to make sure that it doesn't continue to keep getting bad sectors. If it does, then the HDD may be going bad. The main thing is to not do a hard shut down using the case power button, and use the proper shut down in Windows instead.
My System SpecsSystem Spec
15 Aug 2013   #65
Layback Bear

Windows 10 Pro. 64/ version 1709
 
 

Post #62 was very informative.
This was also great.
An explanation of the new /C and /I Switches that are available to use with Chkdsk.exe
-------------------
Do they make anything that great for a SSD?
My System SpecsSystem Spec
15 Aug 2013   #66
JTSH

Windows Home 7
 
 

*breathes a sigh of relief* Haha. That's alright. Autocorrect gets me all the time too!

Thanks for your help and recommendations!

Your last comment about proper shut down reminds me of another separate problem I have which would probably cause the hard drive in my laptop to go bad soon. I will probably post it on the correct thread and you'll soon enough hear from me again!

Quote   Quote: Originally Posted by Brink View Post
Sorry, that should be "wouldn't" instead. Autocorrect got me again. LOL

I'd recommend to keep an eye on the drive to make sure that it doesn't continue to keep getting bad sectors. If it does, then the HDD may be going bad. The main thing is to not do a hard shut down using the case power button, and use the proper shut down in Windows instead.
My System SpecsSystem Spec
15 Aug 2013   #67
Brink

64-bit Windows 10 Pro
 
 

You're most welcome JTSH.
My System SpecsSystem Spec
15 Aug 2013   #68
Brink

64-bit Windows 10 Pro
 
 

Quote   Quote: Originally Posted by Layback Bear View Post
Post #62 was very informative.
This was also great.
An explanation of the new /C and /I Switches that are available to use with Chkdsk.exe
-------------------
Do they make anything that great for a SSD?
Hey Jack,

SSD's are different than hard disk drives. SSD's automatically remap worn bits using wear leveling technology, so it's not recommended to run chkdsk on a SSD.
My System SpecsSystem Spec
16 Aug 2013   #69
Layback Bear

Windows 10 Pro. 64/ version 1709
 
 

Thanks Shawn.
I knew they didn't want one to defrag a ssd but I didn't know not to run chkdsk. It does make sense once I get all 3 of my brain cells activated.
My System SpecsSystem Spec
Reply

 Check Disk (chkdsk) - Read Event Viewer Log




Thread Tools




Similar help and support threads
Thread Forum
Wake Source - Read Event Viewer Log
How to Read the Wake Source Log in Event Viewer for Vista, Windows 7, and Windows 8 This will show you how to read the wake source log in the Event Viewer to see what device, task, or etc... has woke up your computer from sleep or hibernation at listed dates and times. You must be logged in...
Tutorials
Memory Diagnostics Tool - Read Event Viewer Log
How to Read Event Viewer Log for Windows Memory Diagnostics Tool This will show you how to read the Event Viewer log to see the results of the Windows Memory Diagnostics Tool in Vista, Windows 7, and Windows 8. If you just ran the Windows Memory Diagnostics Tool, then it may take a bit...
Tutorials
In Event Viewer, Where is event log for cleanmgr.exe (Disk Cleanup)?
I tried a lot, but couldn't find the event log for the cleanmgr.exe (Disk Cleanup) in the Event Viewer. Actually, I need the source & event id of cleanmgr.exe to schedule a task in the Task Scheduler. :confused:
Performance & Maintenance
CHKDSK - Event Viewer Doesn't Display Full Log
Checking file system on C: The type of the file system is NTFS. Volume label is CrossHair. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 5)... 364288 file records processed. ...
Performance & Maintenance
Locating chkdsk log in Event Viewer
Hi experts! :) If I were looking for the resultant log from chkdsk in the Event viewer on W7, which would I look for? Wininit or Winlogon? I thought Wininit was/is associated with XP and Winlogon for Vista and above? Thank you, Donna :geek:
Performance & Maintenance


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 16:07.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App