{"id":75211,"date":"2024-05-16T18:21:38","date_gmt":"2024-05-16T12:51:38","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=75211"},"modified":"2024-05-16T18:32:57","modified_gmt":"2024-05-16T13:02:57","slug":"how-to-read-chkdsk-log-event-viewer","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/how-to-read-chkdsk-log-event-viewer\/","title":{"rendered":"How to Read Chkdsk Log in the Event Viewer"},"content":{"rendered":"

The Chkdsk utility checks the file system and file system metadata of a volume for logical and physical errors<\/a> and repairs them. When you run Chkdsk c: \/r<\/strong><\/code> and schedule it for the next boot, Chkdsk runs the scan during the next boot.<\/p>\n

\"chkdsk<\/p>\n

\"chkdsk<\/p>\n

The results of the Chkdsk operation is logged into the Application event log under the event ID 1001 and event sources “Wininit” and “Chkdsk”.<\/p>\n

Read Chkdsk Log in the Event Viewer<\/h2>\n

Method 1: Using the Event Viewer<\/h3>\n

To view the results of the last Chkdsk operation, launch the Event Viewer (eventvwr.msc<\/code>).<\/p>\n

    \n
  1. Right-click Start, and click Event Viewer.<\/li>\n
  2. Expand “Windows logs”, and select “Application”.<\/li>\n
  3. Look for the most recent “Wininit” entry (event source) with the event ID: 1001.
    \n\"Application<\/li>\n
  4. Also, look for the recent “Chkdsk” entry (event source).<\/li>\n
  5. Right-click on the entry, click “Copy” and select “Copy details as text”.<\/li>\n
  6. Paste the data into Notepad and read the results.<\/li>\n<\/ol>\n
    \n

    Additional Tip: Use the filtering options<\/h4>\n

    To quickly locate the Wininit<\/strong> entries, you can use the filtering options in the Event Viewer.<\/p>\n

    After selecting the Application<\/strong> log, click “Filter Current Log..<\/strong>” in the right pane.<\/p>\n

    Click on the “Event sources” dropdown box, scroll down the listing, and select Wininit<\/strong> and Chkdsk<\/strong>.<\/p>\n

    Click OK.
    \n\"windows<\/p>\n

    Doing so displays only the Wininit<\/strong> and Chkdsk<\/strong> entries in the Application event log listing.<\/p>\n

    Note:<\/strong> Once you’re done reading the event logs, use the “Clear Filter” option that appears in the right pane.<\/em><\/p>\n<\/div>\n

    \n

    Method 2: Using wevtutil.exe command-line tool<\/h3>\n

    You can also use the Windows Events Command Line Utility (wevtutil.exe) to query event log entries. For example, to query the three most recent<\/strong> Wininit<\/strong> entries from the Application<\/strong> event log, open a Command Prompt window and run the following command:<\/p>\n

    wevtutil qe \"Application\" \/q:\"*[System[Provider[@Name='Microsoft-Windows-Wininit']]]\" \/c:3 \/f:text \/rd:true<\/pre>\n
    \"wevtutil<\/p>\n
    To copy the output to the clipboard, pipe the output<\/a> to Clip.exe, as mentioned below:<\/p>\n
    wevtutil qe \"Application\" \/q:\"*[System[Provider[@Name='Microsoft-Windows-Wininit']]]\" \/c:3 \/f:text \/rd:true  | clip<\/pre>\n
    You can now paste the output into Notepad and analyze the results.<\/p>\n
    Chkdsk results – Example<\/h4>\n
    The following is sample data:<\/p>\n
    Log Name:      Application\nSource:        Microsoft-Windows-Wininit\nDate:          5\/16\/2024 5:38:16 PM\nEvent ID:      1001\nTask Category: None\nLevel:         Information\nKeywords:      Classic\nUser:          N\/A\nComputer:      OptiPlex-7010\nDescription:\n\nChecking file system on C:\nThe type of the file system is NTFS.\nVolume label is OS.\n\nA disk check has been scheduled.\nWindows will now check the disk.                         \n\nStage 1: Examining basic file system structure ...\n  822016 file records processed.                                                        \n\nFile verification completed.\n Phase duration (File record verification): 3.95 seconds.\n  23978 large file records processed.                                   \n\n Phase duration (Orphan file record recovery): 0.00 milliseconds.\n  0 bad file records processed.                                     \n\n Phase duration (Bad file record checking): 0.93 milliseconds.\n\nStage 2: Examining file name linkage ...\n  653 reparse records processed.                                      \n\n  1195530 index entries processed.                                                       \n\nIndex verification completed.\n Phase duration (Index verification): 14.26 seconds.\n  0 unindexed files scanned.                                        \n\n\n Phase duration (Orphan reconnection): 1.19 seconds.\n  0 unindexed files recovered to lost and found.                    \n\n Phase duration (Orphan recovery to lost and found): 3.65 seconds.\n  653 reparse records processed.                                      \n\n Phase duration (Reparse point and Object ID verification): 4.00 milliseconds.\n\nStage 3: Examining security descriptors ...\nCleaning up 2622 unused index entries from index $SII of file 0x9.\nCleaning up 2622 unused index entries from index $SDH of file 0x9.\nCleaning up 2622 unused security descriptors.\nSecurity descriptor verification completed.\n Phase duration (Security descriptor verification): 37.69 milliseconds.\n  186758 data files processed.                                           \n\n Phase duration (Data attribute verification): 0.95 milliseconds.\nCHKDSK is verifying Usn Journal...\n  41758984 USN bytes processed.                                                           \n\nUsn Journal verification completed.\n Phase duration (USN journal verification): 128.10 milliseconds.\n\nStage 4: Looking for bad clusters in user file data ...\n  822000 files processed.                                                               \n\nFile data verification completed.\n Phase duration (User file recovery): 3.99 minutes.\n\nStage 5: Looking for bad, free clusters ...\n  52911268 free clusters processed.              \n\nFree space verification is complete.\n Phase duration (Free space recovery): 0.00 milliseconds.\n\nWindows has scanned the file system and found no problems.\nNo further action is required.\n\n 289502207 KB total disk space.\n  76556960 KB in 434021 files.\n    355420 KB in 186759 indexes.\n         0 KB in bad sectors.\n    944751 KB in use by the system.\n     65536 KB occupied by the log file.\n 211645076 KB available on disk.\n\n      4096 bytes in each allocation unit.\n  72375551 total allocation units on disk.\n  52911269 allocation units available on disk.\nTotal duration: 4.38 minutes (262945 ms).\n\nChecking file system on C:\nThe type of the file system is NTFS.\nVolume label is OS.\n\nA disk check has been scheduled.\nWindows will now check the disk.                         \n\nStage 1: Examining basic file system structure ...\n  822016 file records processed.                                                        \n\nFile verification completed.\n Phase duration (File record verification): 3.95 seconds.\n  23978 large file records processed.                                   \n\n Phase duration (Orphan file record recovery): 0.00 milliseconds.\n  0 bad file records processed.                                     \n\n Phase duration (Bad file record checking): 0.93 milliseconds.\n\nStage 2: Examining file name linkage ...\n  653 reparse records processed.                                      \n\n  1195530 index entries processed.                                                       \n\nIndex verification completed.\n Phase duration (Index verification): 14.26 seconds.\n  0 unindexed files scanned.                                        \n\n Phase duration (Orphan reconnection): 1.19 seconds.\n  0 unindexed files recovered to lost and found.                    \n\n Phase duration (Orphan recovery to lost and found): 3.65 seconds.\n  653 reparse records processed.                                      \n\n Phase duration (Reparse point and Object ID verification): 4.00 milliseconds.\n\nStage 3: Examining security descriptors ...\nCleaning up 2622 unused index entries from index $SII of file 0x9.\nCleaning up 2622 unused index entries from index $SDH of file 0x9.\nCleaning up 2622 unused security descriptors.\nSecurity descriptor verification completed.\n Phase duration (Security descriptor verification): 37.69 milliseconds.\n  186758 data files processed.                                           \n\n Phase duration (Data attribute verification): 0.95 milliseconds.\nCHKDSK is verifying Usn Journal...\n  41758984 USN bytes processed.                                                           \n\nUsn Journal verification completed.\n Phase duration (USN journal verification): 128.10 milliseconds.\n\nStage 4: Looking for bad clusters in user file data ...\n  822000 files processed.                                                               \n\nFile data verification completed.\n Phase duration (User file recovery): 3.99 minutes.\n\nStage 5: Looking for bad, free clusters ...\n  52911268 free clusters processed.                                                       \n\nFree space verification is complete.\n Phase duration (Free space recovery): 0.00 milliseconds.\n\nWindows has scanned the file system and found no problems.\nNo further action is required.\n\n 289502207 KB total disk space.\n  76556960 KB in 434021 files.\n    355420 KB in 186759 indexes.\n         0 KB in bad sectors.\n    944751 KB in use by the system.\n     65536 KB occupied by the log file.\n 211645076 KB available on disk.\n\n      4096 bytes in each allocation unit.\n  72375551 total allocation units on disk.\n  52911269 allocation units available on disk.\nTotal duration: 4.38 minutes (262945 ms).\n<\/pre>\n
    I hope you found this article helpful.<\/p>\n
    RELATED:<\/strong> How to Export Windows Event Logs from Event Viewer<\/a>.<\/div>\n","protected":false},"excerpt":{"rendered":"
    The Chkdsk utility checks the file system and file system metadata of a volume for logical and physical errors and repairs them. When you run Chkdsk c: \/r and schedule it for the next boot, Chkdsk runs the scan during the next boot.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[7],"tags":[779,968],"class_list":["post-75211","post","type-post","status-publish","format-standard","hentry","category-windows","tag-event-viewer","tag-wevtutil"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":5521,"url":"https:\/\/www.winhelponline.com\/blog\/error-0x80070091-directory-not-empty-deleting-folder-copying-chkdsk\/","url_meta":{"origin":75211,"position":0},"title":"Error 0x80070091 “The directory is not empty” When Deleting or Copying a Folder","author":"Ramesh","date":"October 15, 2017","format":false,"excerpt":"When you attempt to delete a folder or copy it to another location or drive, the following error may pop up: Interrupted Action. An unexpected error is keeping you from deleting the folder. If you continue to receive this error, you can use the error code to search for help\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"0x80070091 directory not empty","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/0x80070091_dir_not_empty.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":10709,"url":"https:\/\/www.winhelponline.com\/blog\/fix-device-harddisk-dr0-has-a-bad-block-error-in-event-viewer\/","url_meta":{"origin":75211,"position":1},"title":"Fix: Device Harddisk DR0 has a “bad block” Error in Event Viewer","author":"Ramesh","date":"August 16, 2019","format":false,"excerpt":"Of late, one of my Windows 10 computers has been running sluggishly, hangs frequently or shuts down abruptly. The malware scans turned out to be normal and there are no processes consuming huge CPU time or memory. The disk usage remained at 100% though, regardless of the app I open.\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"disk management hard drive number","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/08\/diskmgmt-drive-numbers-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":54286,"url":"https:\/\/www.winhelponline.com\/blog\/error-0x80070570-file-directory-corrupted\/","url_meta":{"origin":75211,"position":2},"title":"Error 0x80070570: The file or directory is corrupted and unreadable","author":"Ramesh","date":"June 17, 2023","format":false,"excerpt":"When you install a program or delete a file or folder, error 0x80070570 may appear. The following is the error message verbatim: An unexpected error is keeping you from deleting the folder. If you continue to receive this error, you can use this error code to search for help with\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"0x80070570 file or directory corrupted","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/0x80070570-error.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":3794,"url":"https:\/\/www.winhelponline.com\/blog\/stordiag-file-system-diagnostic-windows-10\/","url_meta":{"origin":75211,"position":3},"title":"File System and Storage Diagnostic Tool StorDiag.exe in Windows 10","author":"Ramesh","date":"August 12, 2016","format":false,"excerpt":"The Windows 10 Redstone 1 update silently adds a new console tool (StorDiag.exe) which can be used to collect storage and file system diagnostic logs. This is a useful tool for identifying problems with your hard drive or the file system, and the collected data can be helpful for troubleshooting\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":78594,"url":"https:\/\/www.winhelponline.com\/blog\/macrium-reflect-backup-error-0x01\/","url_meta":{"origin":75211,"position":4},"title":"[Fix] Macrium Reflect Backup Error 0x01","author":"Ramesh","date":"May 18, 2025","format":false,"excerpt":"When you backup your system image using Macrium Reflect, the backup may fail with the error code 0x01. The Macrium documentation mentions the following: 0x01 - An error occurred during the backup or the backup was canceled. See the backup log for more information. Cause Check the Macrium Reflect backup\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"macrium reflect error 0x01 - mft corrupt","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/05\/macrium_logs_mft_error_0x01.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/05\/macrium_logs_mft_error_0x01.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/05\/macrium_logs_mft_error_0x01.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/05\/macrium_logs_mft_error_0x01.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":32018,"url":"https:\/\/www.winhelponline.com\/blog\/dism-error-1392-file-corrupted-unreadable\/","url_meta":{"origin":75211,"position":5},"title":"DISM Error 1392 – File or directory is corrupted","author":"Ramesh","date":"January 17, 2023","format":false,"excerpt":"When you run a DISM command to scan or repair the component store, the error code 1392 appears, and DISM quits. The full error message is mentioned below. Deployment Image Servicing and Management tool [== 3.8% ] Error: 1392 The file or directory is corrupted and unreadable. The DISM log\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"run chkdsk on system drive","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/01\/run-chkdsk-c-drive.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/01\/run-chkdsk-c-drive.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/01\/run-chkdsk-c-drive.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/75211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=75211"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/75211\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=75211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=75211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=75211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}