2 ESENT warning entries, ID 636 ReadHdrFailed and 640 in Event Viewer

parsonm · 28 Jan 2017

I upgraded from Windows 7 to 10 and like a number of uses I have had to resolve a number of permission problems. However the two warnings below have me stumped. They do not always occur but when they do, both occur together and only for the one user on a multi user system. The system appears to be running OK with no obvious problems other then built-in MS errors (Random Hardware Failure etc). If someone could advise and point me in the right direction, it will be appreciated.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="ESENT" />
<EventID Qualifiers="0">636</EventID>
<Level>3</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-01-28T17:55:06.776907700Z" />
<EventRecordID>15632</EventRecordID>
<Channel>Application</Channel>
<Computer>Home-PC</Computer>
<Security />
</System>
- <EventData>
<Data>wlmail</Data>
<Data>7176</Data>
<Data>WindowsLiveMail1:</Data>
<Data>C:\Users\XXXXXX\AppData\Local\Microsoft\Windows Live Mail\Compact\Mail.jfm</Data>
<Data>ReadHdrFailed</Data>
</EventData>
</Event>

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="ESENT" />
<EventID Qualifiers="0">640</EventID>
<Level>3</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-01-28T17:55:06.745655000Z" />
<EventRecordID>15631</EventRecordID>
<Channel>Application</Channel>
<Computer>Home-PC</Computer>
<Security />
</System>
- <EventData>
<Data>wlmail</Data>
<Data>7176</Data>
<Data>WindowsLiveMail1:</Data>
<Data>-1919</Data>
<Data>C:\Users\XXXXXX\AppData\Local\Microsoft\Windows Live Mail\Compact\Mail.jfm</Data>
<Data>[SignDbHdrFromDb:Create time:00/00/1900 00:00:00.000 Rand:0 Computer:] [SignFmHdrFromDb:Create time:00/00/1900 00:00:00.000 Rand:0 Computer:] [SignDbHdrFromFm:Create time:01/23/2017 17:49:38.055 Rand:1933781501 Computer:] [SignFmHdrFromFm:Create time:01/23/2017 17:49:40.469 Rand:3054171775 Computer:]</Data>
</EventData>
</Event>

Caledon Ken · 29 Jan 2017

First thing I should mention is Windows Live mail has been shelved. It will still work but access to different mail suppliers will be impacted differently. I don't think this is related to your issue but thought I would raise to your attention so you can explore different mail clients.

I may be jumping to conclusions but your first event has the words ReadHdrFailed.

I would ensure you have data from all users backed up to a physical unique drive.

I would then run chkdsk against the drive without any repair / fix parameters to see what it reports.

parsonm · 31 Jan 2017

Thank you for the response.
Yes, I am aware of the status of Windows Live Mail, but other than this problem, it is running OK.
I have previously run SFC/Scannow, all three DISM commands and check disk and all returned no errors.
I have since realised that it only occurs when WLM runs the "Recovering Unused Disk Space" routine, so help on what is running here may help me to clear the problem.

Caledon Ken · 31 Jan 2017

You can search Live Mail Recovering Unused Disk Space and it will give you a list of hits. This seems to be the process of releasing space after mail is deleted.

You need to run chkdsk

as per my first post.

parsonm · 02 Feb 2017

I am carrying out the search as you suggested and yes there are a number of sites, but I have yet to find one specific to the problem that is present.

As per check disk, if you see my original post you will see that I have run it with no problems.

Caledon Ken · 02 Feb 2017

Not sure where that image comes from. It is mind but I didn't mean to post it. Now I can't delete it. Let me see if I can't find what I meant to post.

I will edit this posting if I find. Sorry I missed chkdsk in your original post.

So looking at this differently the ReadHdrFailed appears to be, I can't be absolutely sure, an error reading a Header.

I search this and the error 1919 but came back to Windows Update db not Windows Live mail.

I also concentrated on the file name mail.jfm. No explanation of what this file is but saw references to Jetform. Did you have any kind of form software installed either on this device or a previous version of Windows?

Where I was heading, can we delete this without you losing data? I wouldn't delete anyway, I'm big on rename, and delete days or weeks after.

If you (or forum members) could determine what the mail.jfm file is or does it may help solve.