NTFS Event 55 with no DeviceName or DriveName?

Asurion · Feb 21, 2016

Today I noticed on System logs an entry originating from Ntfs, with id #55 notifying that a corruption was discovered on volume "??" (question marks) and the exact nature of the corruption is unknown. I filtered the logs for event #55 and noticed 34 exactly the same entries starting from Jan 14th. I don't know what triggered them but the last event happened when I was sleeping, my computer was idle and there wasn't any USB flash/external drives plugged in. To this day, as far as I know there wasn't any adverse effects such as a noticable slowdown or BSOD, or any GUI notifications at all.

But still, I'm concerned about this issue and would like to understand underlying cause. Odd thing is "DeviceName" is empty and DriveName is "??", and all of my partitions report there's no need for scan, and that's completely weird to me as if there's no source to be tracked back.

I've already run a SMART check on my all HDDs and SSDs, none of them reporting any misbehavior or bad sector. I have Intel SSD caching enabled on one of my HDDs running for more than a year without any issues.

I'd appreciate any hints on why this entry kept appearing for last 2 months and how to eliminate this issue.

Here's the log itself: (other 34 are similar)

-

Code:

<Event xmlns="[B]http://schemas.microsoft.com/win/2004/08/events/event">[/B]
[B][URL="file:///C:/Users/Yekta/AppData/Local/Temp/tmpF74E.xml#"]-[/URL] <System>
  <Provider Name="[B]Ntfs[/B]" Guid="[B]{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}[/B]" /> 

  <EventID>55</EventID> 

  <Version>0</Version> 

  <Level>2</Level> 

  <Task>0</Task> 

  <Opcode>0</Opcode> 

  <Keywords>0x8000000000000000</Keywords> 

  <TimeCreated SystemTime="[B]2016-01-16T00:24:27.075959200Z[/B]" /> 

  <EventRecordID>29822</EventRecordID> 

  <Correlation /> 

  <Execution ProcessID="[B]4[/B]" ThreadID="[B]6712[/B]" /> 

  <Channel>System</Channel> 

  <Computer>asurion-pc</Computer> 

  <Security UserID="[B]S-1-5-18[/B]" /> 

  </System>


[URL="file:///C:/Users/Yekta/AppData/Local/Temp/tmpF74E.xml#"]-[/URL] <EventData>
  <Data Name="[B]DriveName[/B]">??</Data> 

  <Data Name="[B]DeviceName[/B]" /> 

  <Data Name="[B]CorruptionState[/B]">0x0</Data> 

  <Data Name="[B]HeaderFlags[/B]">0x2</Data> 

  <Data Name="[B]Severity[/B]">Normal</Data> 

  <Data Name="[B]Origin[/B]">File System Driver</Data> 

  <Data Name="[B]Verb[/B]">Force Proactive Scan</Data> 

  <Data Name="[B]Description[/B]">The exact nature of the corruption is unknown. The file system structures need to be scanned online.</Data> 

  <Data Name="[B]Signature[/B]">0xe2b3f0fb</Data> 

  <Data Name="[B]Outcome[/B]">Pseudo Verb</Data> 

  <Data Name="[B]SampleLength[/B]">0</Data> 

  <Data Name="[B]SampleData[/B]" /> 

  <Data Name="[B]SourceFile[/B]">0x12</Data> 

  <Data Name="[B]SourceLine[/B]">3144</Data> 

  <Data Name="[B]SourceTag[/B]">7</Data> 

  <Data Name="[B]CallStack[/B]">Ntfs+0x131c0c, Ntfs+0x82090, Ntfs+0xfe4c, ntoskrnl+0xad6bc, ntoskrnl+0x10036c, ntoskrnl+0x1572c6</Data> 

  </EventData>


  </Event>

[/B]

Itaregid · Feb 22, 2016

I would run Error Checking from the drive's Properties > Tools menu, or open an elevated command prompt and enter: chkdsk /r then follow the prompts to allow checking during the next reboot, then reboot.

If checking finds and is able correct all errors, then fine. This could just be a one-time thing. But you should periodically run checking again to make sure no more errors develop. If checking is not able to repair all error, or re-checking finds more errors, you should not fuss with it, and just replace the drive.

Understand that ALL drives WILL fail - eventually. Some sooner than later. So you need to backup any data you don't want to lose ASAP too.

NTFS Event 55 with no DeviceName or DriveName?

Asurion

New Member

My Computer

System One

Itaregid

Banned

My Computer

System One