Recently ran chkdsk, and looked at results in Event Viewer. It says it made corrections to a few files.
How do I know which files it made corrections to ?
(also, how do I locate and upload the relevant log file please?)
(Windows Home, 64-bit, Version 1909)
The chkdsk command has multiple switches.
Using /v or verbose displays the most detailed results.
These switches would perform the deepest and longest test and display the most detailed results:
chkdsk /b /v C: (fix, recover, reallocates bad clusters, and verbose)
Use the information in this link to find the chkdsk report in the event viewer:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
Read Chkdsk Log in Event Viewer in Windows 10
https://docs.microsoft.com/en-us/win...ommands/chkdsk
OK, managed to obtain the results. Here:
TimeCreated : 05/01/2020 10:45:16
Message :
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
Stage 1: Examining basic file system structure ...
Cleaning up instance tags for file 0x177b8.
Cleaning up instance tags for file 0x251e4.
Cleaning up instance tags for file 0x407ba.
853504 file records processed.
File verification completed.
4747 large file records processed.
0 bad file records processed.
Stage 2: Examining file name linkage ...
19137 reparse records processed.
1014214 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
19137 reparse records processed.
Stage 3: Examining security descriptors ...
Cleaning up 404 unused index entries from index $SII of file 0x9.
Cleaning up 404 unused index entries from index $SDH of file 0x9.
Cleaning up 404 unused security descriptors.
Security descriptor verification completed.
80356 data files processed.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Stage 4: Looking for bad clusters in user file data ...
853488 files processed.
File data verification completed.
Stage 5: Looking for bad, free clusters ...
21555330 free clusters processed.
Free space verification is complete.
Windows has made corrections to the file system.
No further action is required.
235878399 KB total disk space.
148416588 KB in 551582 files.
307164 KB in 80357 indexes.
0 KB in bad sectors.
933327 KB in use by the system.
65536 KB occupied by the log file.
86221320 KB available on disk.
4096 bytes in each allocation unit.
58969599 total allocation units on disk.
21555330 allocation units available on disk.
Internal Info:
00 06 0d 00 8f a4 09 00 be 33 11 00 00 00 00 00 .........3......
7d 4a 00 00 44 00 00 00 00 00 00 00 00 00 00 00 }J..D...........
Windows has finished checking your disk.
Please wait while your computer restarts.
There was some cleaning.
Looks good.
Additional tests of the drive can be made by:
SMART
Surface tests
Benchmarks
There are various free software that perform these tests.
For the chkdsk scans you can run on line: chkdsk /scan
All of the tests / switches etc. have different capabilities/purposes.
I don't know what files though it said it repaired (instance tags in Stage 1) ?
According to what I read online, those hexadecimal numbers (e.g. 0x177b8) are pointers into the $MFT NTFS file table. Likewise, it's no trivial matter to correlate those internal identifiers to human-readable filenames (see this Google search for lots of discussion). But because the repairs succeeded, it may not be necessary for you to figure this out. I'm not getting very far trying to establish such correlations myself.
HTH,
--Ed--
This is not directly related to finding the "error file" as such ( as the disk error has been corrected, the solution may no onger apply ), but if using a modern equivalent of the old MS "DiskEdit", it would be possible to locate the MFT hex instance tags to gain more insight for example where chkdsk /f is unable to progress further, as described here:
Locating a file on an NTFS partition via the file number given by chkdsk... - Ars Technica OpenForum
( I tried DiskEdit on an XP Virtual Machine, but it did not run properly and in consideration of the fact that the copy of DiskEdit I have is nearly 20 years old, its not surprising.
However, the trial version of "DiskExplorer by Runtime Software" is able to locate files by using the hex tag value to search the MFT. I was unable to explore this further, as despite forcibly closing the Virtual Machine, chdsk did not auto run on a restart and a further manual chkdsk run produced no errors !).
Quote