Message

Started checking data integrity.

Example Event

system:
  provider: Microsoft-Windows-DataIntegrityScan
  guid: 13BC4371-4E21-4E46-A84F-8C0FFB548CED
  event_source_name: ''
  event_id: 1
  version: 0
  level: 4
  task: 0
  opcode: 1
  keywords: 9223372036854775808
  time_created: '2022-04-04T07:41:12.522605+00:00'
  event_record_id: 1
  correlation: {}
  execution:
    process_id: 2140
    thread_id: 5340
  channel: Microsoft-Windows-DataIntegrityScan/Admin
  computer: WIN-TKC15D7KHUR
  security:
    user_id: S-1-5-18
event_data: {}
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Completed data integrity checks.

Example Event

system:
  provider: Microsoft-Windows-DataIntegrityScan
  guid: 13BC4371-4E21-4E46-A84F-8C0FFB548CED
  event_source_name: ''
  event_id: 4
  version: 0
  level: 4
  task: 0
  opcode: 2
  keywords: 9223372036854775808
  time_created: '2022-04-04T07:41:17.424144+00:00'
  event_record_id: 2
  correlation: {}
  execution:
    process_id: 2140
    thread_id: 5340
  channel: Microsoft-Windows-DataIntegrityScan/Admin
  computer: WIN-TKC15D7KHUR
  security:
    user_id: S-1-5-18
event_data: {}
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Disk scan started on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields

Message

Disk scan completed on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields

Message

Volume scan started on %4 (%2) in \\?\PhysicalDrive%5 (\\?\Disk%6)

Fields

Message

Volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Files were skipped during the volume scan.
Files skipped: %6
Volume name: %4 (%2)
First skipped file name: %8
HResult: %5

Fields

Message

Volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Volume scan completion at %25% on %4 (%2)
Bytes repaired: %10
Bytes not repaired: %11

Fields

Message

File data inconsistency was detected and was repaired successfully.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

File data scrub operation failed.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields

Message

Volume metadata inconsistency was detected and was repaired successfully.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

Volume metadata scrub operation failed.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields

Message

File metadata inconsistency was detected and was repaired successfully.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

File metadata scrub operation failed.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields

Message

File data inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

Volume metadata inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

File metadata inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

Started checking data integrity for crash recovery.

Message

Completed data integrity checks for crash recovery.

Message

Crash recovery disk scan started on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields

Message

Crash recovery disk scan completed on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields

Message

Crash recovery volume scan started on %4 (%2) in \\?\PhysicalDrive%5 (\\?\Disk%9)

Fields

Message

Crash recovery volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Files were skipped during the volume scan.
Files skipped: %6
Volume name: %4 (%2)
First skipped file name: %8
HResult: %5

Fields

Message

Crash recovery volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields

Message

Drt clear completed on %4 (%2)
HResult: %5

Fields

Message

Drt clear completed on %4 (%2)
HResult: %5

Fields

Message

Crash recovery volume scan completion at %26% on %4 (%2)
Bytes repaired: %10
Bytes not repaired: %11

Fields

Message

File data inconsistency was detected and was repaired successfully.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

File data scrub operation failed.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields

Message

Volume metadata inconsistency was detected and was repaired successfully.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

Volume metadata scrub operation failed.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields

Message

File metadata inconsistency was detected and was repaired successfully.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields

Message

File metadata scrub operation failed.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields

Message

Parity repair completed.
Volume name: %4 (%2)
Extent count: %5
Length (in bytes): %6

Fields

Message

Parity repair failed.
Volume name: %4 (%2)
Extent count: %5
Length (in bytes): %6
HResult: %7

Fields