2007-11-15

dig and view CHKDSK result after reboot

Once you have restarted and CHKDSK has carried out the surface scan, Windows will boot normally. For a log of the results, right-click 'my computer' and select 'manage,' then open up 'event viewer\applications'.





Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 2007-11-05
Time: 10:46:38 PM
User: N/A
Computer: CZ
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 127 unused index entries from index $SII of file 0x9.
Cleaning up 127 unused index entries from index $SDH of file 0x9.
Cleaning up 127 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc000009c at offset 0x891a9d000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x891aa9000 for 0x1000 bytes.
Windows replaced bad clusters in file 10539
of name \DOCUME~1\billson.CZ\Desktop\NTUSER~1.BAK.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
Adding 1 bad clusters to the Bad Clusters File.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

52428095 KB total disk space.
23384276 KB in 102093 files.
45132 KB in 16197 indexes.
4 KB in bad sectors.
306139 KB in use by the system.
65536 KB occupied by the log file.
28692544 KB available on disk.

4096 bytes in each allocation unit.
13107023 total allocation units on disk.
7173136 allocation units available on disk.

Internal Info:
90 12 02 00 1c ce 01 00 1f fa 02 00 00 00 00 00 ................
d7 00 00 00 00 00 00 00 5f 01 00 00 00 00 00 00 ........_.......
08 36 c3 03 00 00 00 00 9c 35 d5 3f 00 00 00 00 .6.......5.?....
68 10 9d 03 00 00 00 00 5c 2e 6f 6d 02 00 00 00 h.......\.om....
08 b8 90 f4 00 00 00 00 fc 5e 2d ba 03 00 00 00 .........^-.....
99 9e 36 00 00 00 00 00 d8 3c 07 00 cd 8e 01 00 ..6......<...... 00 00 00 00 00 50 43 93 05 00 00 00 45 3f 00 00 .....PC.....E?.. Windows has finished checking your disk. Please wait while your computer restarts. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.





Details
Product:Windows Operating System
ID:1001
Source:Winlogon
Version:5.0
Symbolic Name:EVENT_AUTOCHK_DATA
Explanation

Chkdsk ran on one of the volumes when the computer restarted. A log file, bootex.log, was created and stored in the root of the volume. This file states whether Chkdsk encountered any errors and, if so, whether they were fixed.

User Action

No user action is required.

Version:5.2
Symbolic Name:EVENT_AUTOCHK_DATA
Explanation

Chkdsk ran on one of the volumes when the computer restarted. A log file, bootex.log, was created and stored in the root of the volume. This file states whether Chkdsk encountered any errors and, if so, whether they were fixed.

User Action

No user action is required.

Version:5.2.3790.1830
Message:NTFS - Autochk: file system check occurred on startup
Explanation

Microsoft® Windows® encountered corrupted file-system metadata during the last Windows session, so Windows marked the file system as “dirty” (corrupt). Windows ran the chkdsk /f command during startup in an attempt to repair the corrupted file system metadata.

Related Events

Chkdsk: Event ID 26180
Chkdsk: Event ID 1066

Cause

The file system might have been marked as “dirty” (corrupt) for one of the following reasons:

  • I/O requests that were issued by the file system to the disk subsystem might not have been completed successfully.
  • The operating system was shut down incorrectly.

    If the volume is formatted with the FAT file system, an incorrect shutdown of Windows will always cause this event (Event ID 1001). FAT is not a journaling file system. In order to maintain metadata consistency, FAT requires the operating system to be shut down properly. An incorrect shutdown (for example, a power failure) forces Windows to run chkdsk in order to ensure that the file-system metadata is consistent.

    If the volume is formatted with the NTFS file system, running chkdsk is not normally necessary. NTFS is a journaling file system and does not usually require chkdsk to ensure metadata consistency. However, NTFS depends upon the media to guarantee its write-through semantics. If the media does not accept write-through semantics, inconsistencies in the file-system metadata might occur when there is a sudden loss of power or a system failure.
  • The media (hard disk) might have developed bad sectors.
User Action

This message is provided to inform you that thechkdsk command was run on the file system. No actions are required, but the corrupted disk might indicate other disk problems. You should do the following:

  • Review the application log and the system log in Event Viewer for additional errors. Event ID 1066 contains the detailed chkdsk log. You should review the chkdsk log to see what problems (if any)chkdsk found on the volume and what fixes (if any) were made.
  • Check related hardware and devices on the shared bus to ensure that the cables are connected and that the hardware and devices are properly terminated.
  • Avoid improper shutdowns. If the volume is formatted with the FAT file system, you can usually avoid Event ID 1001 by properly shutting down Windows.

    If Event ID 1001 occurs frequently for an NTFS volume (or for a FAT volume, despite proper shutdowns), it is likely that the disk has developed bad sectors. Run chkdsk /r to locate bad sectors on the hard disk.

Related Resources

For more information about chkdsk, see Knowledge Base article 187941, “An Explanation of CHKDSK and the New /C and /I Switches,” at http://go.microsoft.com/fwlink/?LinkId=25770.

No comments:

Post a Comment