All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 19th, 2021, 19:47 
Offline

Joined: October 17th, 2015, 8:58
Posts: 36
Location: Bulgaria
Hi guys, when I restarted my PC recently it automatically started chkdsk, it finished fast successfully and it saved a bootex.log in C:\ .
I don't know what caused this chkdsk on boot, PC never had any problems, PC still works OK now, maybe it's something normal, not sure.

Here is the bootex.log:
Code:
Checking file system on C:
The type of the file system is NTFS.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                         
Cleaning up instance tags for file 0x848b.
Cleaning up instance tags for file 0x849d.
Cleaning up instance tags for file 0x858d.
Cleaning up minor inconsistencies on the drive.
Cleaning up 17 unused index entries from index $SII of file 0x9.
Cleaning up 17 unused index entries from index $SDH of file 0x9.
Cleaning up 17 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Windows has made corrections to the file system.

  52436128 KB total disk space.
  24034924 KB in 61111 files.
     23136 KB in 9734 indexes.
         0 KB in bad sectors.
    288944 KB in use by the system.
     65536 KB occupied by the log file.
  28089124 KB available on disk.

      4096 bytes in each allocation unit.
  13109032 total allocation units on disk.
   7022281 allocation units available on disk.

Internal Info:
c0 d9 02 00 c8 14 01 00 d2 9d 01 00 00 00 00 00  ................
9b 02 00 00 01 00 00 00 b8 00 00 00 00 00 00 00  ................
1c 2f 04 06 00 00 00 00 9a 8e 44 06 00 00 00 00  ./........D.....
26 23 b3 0d 00 00 00 00 00 00 00 00 00 00 00 00  &#..............
00 00 00 00 00 00 00 00 92 ea 7f 21 00 00 00 00  ...........!....
f0 bd e9 76 00 00 00 00 80 36 07 00 b7 ee 00 00  ...v.....6......
00 00 00 00 00 b0 f9 ba 05 00 00 00 06 26 00 00  .............&..

Windows has finished checking your disk.
Please wait while your computer restarts.


Can you please take a look and tell me if my bootex.log is OK?
Thanks for your time.


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 20th, 2021, 8:47 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1418
Location: Portugal
Or the system was not well shutdown, or you might have a HDD issue. Try to do a scan on the drive to see if you have bad sectors for instance..

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 20th, 2021, 15:06 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
we3fan wrote:
Here is the bootex.log:
[code]One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
Cleaning up instance tags for file 0x848b.
Cleaning up instance tags for file 0x849d.
Cleaning up instance tags for file 0x858d.
Cleaning up minor inconsistencies on the drive.
Cleaning up 17 unused index entries from index $SII of file 0x9.
Cleaning up 17 unused index entries from index $SDH of file 0x9.
Cleaning up 17 unused security descriptors.

You can use DMDE to determine which of your files triggered the clean ups.

https://dmde.com/

Launch DMDE, select disk, check the "Show partitions" box and then OK.

In the Partitions window, d-click the NTFS volume. You should now see your files and folders under the $Root.

Select Editor -> File Record, type the file number (eg 848b) into the hex box, and then OK.

In the lower right pane you should see the MFT record corresponding to that file (its decimal file number will be displayed). You will see the long and 8.3 file names under $FILE_NAME.

File #9 is an NTFS metafile, namely $Secure.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 21st, 2021, 10:49 
Offline

Joined: October 17th, 2015, 8:58
Posts: 36
Location: Bulgaria
Thanks fzabkar, I really appreciate it.
It is my first time using DMDE, I followed your instructions, and I made few Screenshots. Editor > File Record > hex: 848b > OK:
Attachment:
1.png
1.png [ 26.28 KiB | Viewed 5415 times ]

Attachment:
2.png
2.png [ 41.85 KiB | Viewed 5415 times ]

Attachment:
3.png
3.png [ 31.98 KiB | Viewed 5415 times ]

Attachment:
4.png
4.png [ 31.95 KiB | Viewed 5415 times ]

Attachment:
5.png
5.png [ 38.73 KiB | Viewed 5415 times ]

Under $FILE_NAME I see a long number: 943080... - is that the real name of the file?
Can I see the file extension? Example: Car.jpg or Notes.txt .
Can I see the file size? 5 KB or 3 MB?
Can I see the file location? Example: C:\Program Files\Windows Media Player\wmplayer.exe

I am sorry for all these questions, I am a novice at using DMDE and I don't know what it can/can't do.


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 21st, 2021, 13:27 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
#1 is the 8.3 (short) file name. That's what DOS would see (if it could understand NTFS). The name of the file is condensed to 8 characters, and the extension is condensed to 3 characters.

#2 is the full name of the file.

The file's extension is always displayed. If no extension is displayed, it's because the file has no extension.

The file size is reported as "Data Size" under the $DATA attribute.

In your example for MFT #33931, the file name is "94308059b57b3142e455b38a6eb92015", no extension.

The file size is 216 bytes.

Since the file is very small, the whole content of the file fits within the spare space inside the MFT record. Larger files store their content in clusters elsewhere on the drive.

The $MFT is the master file table, an NTFS metafile which stores the information about each file.

To see the full path of the file, you need to walk up the directory tree. I'll try to provide an example in my next post.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 21st, 2021, 14:17 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
If you expand the $FILE_NAME attribute, you will see a directory parameter under "Data Offset". That is the file number (33945 decimal) of the preceding folder/directory.

As before, select Editor -> File Record, type the file number (33945) into the decimal box, and then OK. You will now see the MFT record for the preceding folder. Repeat this procedure to walk up the tree until you arrive at the root.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 22nd, 2021, 10:23 
Offline

Joined: October 17th, 2015, 8:58
Posts: 36
Location: Bulgaria
Thanks again fzabkar, I will see what I can do.


These values from the bootex.log:
Code:
Internal Info:
c0 d9 02 00 c8 14 01 00 d2 9d 01 00 00 00 00 00  ................
9b 02 00 00 01 00 00 00 b8 00 00 00 00 00 00 00  ................
1c 2f 04 06 00 00 00 00 9a 8e 44 06 00 00 00 00  ./........D.....
26 23 b3 0d 00 00 00 00 00 00 00 00 00 00 00 00  &#..............
00 00 00 00 00 00 00 00 92 ea 7f 21 00 00 00 00  ...........!....
f0 bd e9 76 00 00 00 00 80 36 07 00 b7 ee 00 00  ...v.....6......
00 00 00 00 00 b0 f9 ba 05 00 00 00 06 26 00 00  .............&..

Is there any special reason why they are listed here in the log? Do they give some additional info?


And I want to ask about file #9, you said it's an NTFS metafile, namely $Secure.
Is this $Secure metafile a part of the NTFS file system?
I can't find a file or folder called $Secure on my C: Partition correct?


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 22nd, 2021, 13:08 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Metafiles are part of the NTFS file system and are not displayed by the OS. You can see them in DMDE, though.

I don't understand the hex dump in the bootex.log. Sorry.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Random chkdsk on boot created bootex.log in C:\
PostPosted: November 23rd, 2021, 9:37 
Offline

Joined: October 17th, 2015, 8:58
Posts: 36
Location: Bulgaria
No problem. Thank you so much for all your help fzabkar.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: DeVlL, Google [Bot] and 87 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group