Check Disk (chkdsk) - Read Event Viewer Log

dbdb · 08 Dec 2011

Found the fix it is not easy but it works (after a couple of chkdsk runs) Chkdsk logs won't go away - Microsoft Answers

"I have finally found the answer:

Cannot Delete or Repair Corrupted File on NTFS Volume
KB246026

"This behavior can occur if the NTFS volumes' Master File Table (MFT) is corrupted. The short and long file name pairs that are stored in the directory index record and the file names that are stored in the associated File Record Segment (FRS) contain case-sensitive characters that do not match.

NTFS supports case-sensitive (POSIX) file names, but Chkdsk does not check file names in case-sensitive mode.

For example, assume that the directory index record has a BADFILe.TXT entry but the FRS has a BADFILE.TXT entry
for the file name."

So I temporarily took ownership of "System Volume Information"
then turned off the hidden and system attributes for the Chkdsk folder and deleted the files there.
The bad files looked like this:
CHKDSK~2.LOG

Then I changed the attributes back and re-ran Chkdsk.

Problem solved.

It was not a drive error - I ran a surface scan - twice; and the Seagate long self-test - twice.

This is a 2 TB drive so that takes a LONG time.

I have no idea how the file case got mangled by Chkdsk originally, but anyway - if this ever happens to someone else, now you know what to do."

Tim91 · 09 Dec 2011

When Chkdsk runs at bootup are these logs saved somewhere?

Brink · 09 Dec 2011

Hello Tim,

They're saved at the same location. It may take a few minutes after it runs before it shows up though. :)

dbdb · 09 Dec 2011

they're in C:\System Volume Information\Chkdsk (replace C with whichever drive letter you are having problems with). You may find those directories hidden and you may not have permission to access them either, see my previous thread.

sle3pingz · 19 May 2012

Brink, i copy my chkdsk from Event Viewer can you check for me , anything wrong with my system / OS or my HDD?

Code:

 
Log Name: Application
Source: Chkdsk
Date: 5/20/2012 7:59:02 AM
Event ID: 26212
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Frankz-PC
Description:
Chkdsk was executed in read-only mode on a volume snapshot. 
 
Checking file system on C:
The type of the file system is NTFS.
 
WARNING! F parameter not specified.
Running CHKDSK in read-only mode.
 
CHKDSK is verifying files (stage 1 of 3)...
221184 file records processed. 
 
File verification completed.
769 large file records processed. 
 
0 bad file records processed. 
 
0 EA records processed. 
 
60 reparse records processed. 
 
CHKDSK is verifying indexes (stage 2 of 3)...
277100 index entries processed. 
 
Index verification completed.
0 unindexed files scanned. 
 
0 unindexed files recovered. 
 
CHKDSK is verifying security descriptors (stage 3 of 3)...
221184 file SDs/SIDs processed. 
 
Cleaning up 8 unused index entries from index $SII of file 0x9.
Cleaning up 8 unused index entries from index $SDH of file 0x9.
Cleaning up 8 unused security descriptors.
Security descriptor verification completed.
27959 data files processed. 
 
CHKDSK is verifying Usn Journal...
34368664 USN bytes processed. 
 
Usn Journal verification completed.
Windows has checked the file system and found no problems.
 
686489599 KB total disk space.
151838580 KB in 113183 files.
84920 KB in 27960 indexes.
0 KB in bad sectors.
342699 KB in use by the system.
65536 KB occupied by the log file.
534223400 KB available on disk.
 
4096 bytes in each allocation unit.
171622399 total allocation units on disk.
133555850 allocation units available on disk.
 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Chkdsk" />
<EventID Qualifiers="0">26212</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-05-20T00:59:02.000000000Z" />
<EventRecordID>4766</EventRecordID>
<Channel>Application</Channel>
<Computer>Frankz-PC</Computer>
<Security />
</System>
<EventData>
<Data>
 
Checking file system on C:
The type of the file system is NTFS.
 
WARNING! F parameter not specified.
Running CHKDSK in read-only mode.
 
CHKDSK is verifying files (stage 1 of 3)...
221184 file records processed. 
 
File verification completed.
769 large file records processed. 
 
0 bad file records processed. 
 
0 EA records processed. 
 
60 reparse records processed. 
 
CHKDSK is verifying indexes (stage 2 of 3)...
277100 index entries processed. 
 
Index verification completed.
0 unindexed files scanned. 
 
0 unindexed files recovered. 
 
CHKDSK is verifying security descriptors (stage 3 of 3)...
221184 file SDs/SIDs processed. 
 
Cleaning up 8 unused index entries from index $SII of file 0x9.
Cleaning up 8 unused index entries from index $SDH of file 0x9.
Cleaning up 8 unused security descriptors.
Security descriptor verification completed.
27959 data files processed. 
 
CHKDSK is verifying Usn Journal...
34368664 USN bytes processed. 
 
Usn Journal verification completed.
Windows has checked the file system and found no problems.
 
686489599 KB total disk space.
151838580 KB in 113183 files.
84920 KB in 27960 indexes.
0 KB in bad sectors.
342699 KB in use by the system.
65536 KB occupied by the log file.
534223400 KB available on disk.
 
4096 bytes in each allocation unit.
171622399 total allocation units on disk.
133555850 allocation units available on disk.
</Data>
<Binary>0060030062270200AE0A040000000000D70000003C0000000000000000000000</Binary>
</EventData>
</Event>

and i want ask too , what's

Cleaning up 8 unused index entries from index $SII of file 0x9.
Cleaning up 8 unused index entries from index $SDH of file 0x9.
Cleaning up 8 unused security descriptors.

what's that mean?

Brink · 19 May 2012

Hello sle3pingz,

I don't remember their exact definition, but they are just unused items that were cleaned up and are not important. The most important entries for chkdsk are: 0 KB in bad sectors and 0 bad file records processed.

It indicates that you do not have any bad sectors or file system errors on your C: drive. You got a clean bill of health on the C: drive. :)

sle3pingz · 19 May 2012

i see, but still don't know what's that cleaning , even after cleaning , next chkdsk still cleaning, that's not important? just ignored it?

Brink · 19 May 2012

Yep, it's nothing to worry about since it only cleans those when they are not needed.

sle3pingz · 20 May 2012

ok , Thanks ~

sle3pingz · 21 Jun 2012

brink, i want ask, if we run chkdsk /f , can detect the Bad Sector? or we must run chkdsk /r to detect the bad sector, if we only run fix, that can detect the bad sector?

I mean chkdsk /f can detect the bad sector or not ? And what happend if our notebook harddisk have bad sector, what's the problem?