The only time I have EVER seen a disk-checking event recorded in event
viewer is if the computer has to restart and it does a boot-time chkdsk on
the system partition C:
If you use chkdsk in read-only mode, with no switches, a log does not get
created in the Event Viewer. If you're doing it from a command prompt you
can copy and paste the info that's printed to the command window. Running
chkdsk in read-only mode without rebooting is a waste of time, you may as
well not it at all if you are not going to reboot. If chkdsk cannot get
exclusive use of the volume, it is prone to reporting erroneous information
and it cannot repair anything. To allow chkdsk exclusive use of the volume,
you have reboot.
If you look at the sample output, way below in this message, you will see
that chkdsk only made three passes and quit using read-only mode. If you
use the f or r switches it makes a fourth pass.
See...
Understanding what CHKDSK does
here...
An explanation of the new /C and /I Switches that are available to use with
Chkdsk.exe
http://support.microsoft.com/kb/314835
So I guess the leading question to find the answer is this: how do I force
my computer to do a boot-time chkdsk of my D: drive?
In a command prompt, type: chkdsk d: /r hit Enter.
When you get this message:
Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)
Hit your Y key and reboot.
Or...
Scandisk has been retired. Use Error Checking (chkdsk.exe) in XP.
1. In My Computer or Windows Explorer, right-click the drive you want to
check and then click Properties.
2. On the Tools tab, click Check Now.
3. Check both boxes:
* Automatically fix file system errors
Runs Chkdsk by using the /f parameter.
[[Specifies whether Windows repairs file-system errors found during disk
checking. All files must be closed for this program to run. If the drive is
currently in use, a message asks if you want to reschedule
the disk checking for the next time you restart your computer. Your drive is
not available to run other tasks while the disk is being checked.]]
* Scan for and attempt recovery of bad sectors
Runs Chkdsk by using the /r parameter.
[[Specifies whether Windows repairs file-system errors found during disk
checking, locates bad sectors, and recovers readable information. All files
must be closed for this program to run. If the drive is currently in use, a
message asks if you want to reschedule the disk checking for the next time
you restart your computer. Your drive is not available to run other tasks
while the disk is being checked. If you select this option, you do not need
to select Automatically fix file system errors. Windows fixes any errors on
the disk.]]
A message will popup.
[[The disk check could not be performed because the disk check utility needs
exclusive access to some Windows files on the disk. These files can be
accessed only by restarting Windows. Do you want to schedule this disk check
to occur the next time you restart the computer?]]
Click YES.
Then reboot.
For a look at the chkdsk log.
Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Look in Application | Listed as Information |
Event ID: 1001
Source: Winlogon
[[Description: This includes file system type; drive letter or GUID, and
volume name or serial number to help determine what volume Chkdsk ran
against. Also included is whether Chkdsk ran because a user scheduled it or
because the dirty bit was set.]]
[[When Autochk runs against a volume at boot time it records its output to a
file called Bootex.log in the root of the volume being checked. The Winlogon
service then moves the contents of each Bootex.log file to the Application
Event log.]]
[[This file states whether Chkdsk encountered any errors and, if so,
whether they were fixed.]]
Bootex.log is then deleted. The Application Event log is AppEvent.Evt and
is viewed in the Event Viewer, under Application.
Bootex.log can be acessed with recovery software such as Restoration.
Example of the command window output of running CHKDSK in read-only mode on
C:.
-------------
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\>chkdsk
The type of the file system is NTFS.
Volume label is Local Disk.
WARNING! F parameter not specified.
Running CHKDSK in read-only mode.
CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.
9952235 KB total disk space.
8033848 KB in 51270 files.
22804 KB in 2422 indexes.
0 KB in bad sectors.
108159 KB in use by the system.
51824 KB occupied by the log file.
1787424 KB available on disk.
4096 bytes in each allocation unit.
2488058 total allocation units on disk.
446856 allocation units available on disk.
C:\>
------------------
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In
msinfoseeker said:
Thanks for the reply but I have done this on at least three different
occasions with three different hard drives (customer laptop hard drives
attached to my XP Pro workstation with a USB-to-IDE adapter) and there has
never been an event recorded after the error-checking process completes.
I find it hard to believe that XP doesn't create a logfile somewhere but I
can't find it. It's not in the Event Viewer anywhere. I looked at all four
logs.
Do I have to use Recovery Console?
I'd like to avoid rebooting my computer and waiting for half an hour to
do a chkdsk on a questionable D: drive when I could be using my perfect
C: drive.
Thanks again
