Microsoft-Windows-DataIntegrityScan

41 events across 2 channels

Event ID	Title	Channel
1	Started checking data integrity.	Admin
4	Completed data integrity checks.	Admin
11	Disk scan started on \\?	Admin
12	Disk scan completed on \\?	Admin
21	Volume scan started on FriendlyVolumeName (VolumeName) in \\?	Admin
22	Volume scan completed on FriendlyVolumeName (VolumeName).	Admin
23	Volume scan was partially completed on FriendlyVolumeName (VolumeName).	Admin
24	Files were skipped during the volume scan.	Admin
25	Volume scan completed on FriendlyVolumeName (VolumeName).	Admin
26	Volume scan was partially completed on FriendlyVolumeName (VolumeName).	Admin
27	Volume scan completion at PercentComplete% on FriendlyVolumeName (VolumeName).	Admin
54	File data inconsistency was detected and was repaired successfully.	Admin
55	File data scrub operation failed.	Admin
56	Volume metadata inconsistency was detected and was repaired successfully.	Admin
57	Volume metadata scrub operation failed.	Admin
58	File metadata inconsistency was detected and was repaired successfully.	Admin
59	File metadata scrub operation failed.	Admin
60	File data inconsistency was detected and the parity repair was scheduled at the …	Admin
61	Volume metadata inconsistency was detected and the parity repair was scheduled …	Admin
62	File metadata inconsistency was detected and the parity repair was scheduled at …	Admin
101	Started checking data integrity for crash recovery.	CrashRecovery
104	Completed data integrity checks for crash recovery.	CrashRecovery
111	Crash recovery disk scan started on \\?	CrashRecovery
112	Crash recovery disk scan completed on \\?	CrashRecovery
121	Crash recovery volume scan started on FriendlyVolumeName (VolumeName) in \\?	CrashRecovery
122	Crash recovery volume scan completed on FriendlyVolumeName (VolumeName).	CrashRecovery
123	Volume scan was partially completed on FriendlyVolumeName (VolumeName).	CrashRecovery
124	Files were skipped during the volume scan.	CrashRecovery
125	Crash recovery volume scan completed on FriendlyVolumeName (VolumeName).	CrashRecovery
126	Volume scan was partially completed on FriendlyVolumeName (VolumeName).	CrashRecovery
127	Drt clear completed on FriendlyVolumeNameLength (VolumeNameLength).	CrashRecovery
128	Drt clear completed on FriendlyVolumeNameLength (VolumeNameLength).	CrashRecovery
129	Crash recovery volume scan completion at PercentComplete% on FriendlyVolumeName …	CrashRecovery
154	File data inconsistency was detected and was repaired successfully.	CrashRecovery
155	File data scrub operation failed.	CrashRecovery
156	Volume metadata inconsistency was detected and was repaired successfully.	CrashRecovery
157	Volume metadata scrub operation failed.	CrashRecovery
158	File metadata inconsistency was detected and was repaired successfully.	CrashRecovery
159	File metadata scrub operation failed.	CrashRecovery
160	Parity repair completed.	Admin
161	Parity repair failed.	Admin

Event ID 1 — Started checking data integrity.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Level: Informational
Opcode: Start

Description

Started checking data integrity.

Message #

Started checking data integrity.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DataIntegrityScan",
    "guid": "13BC4371-4E21-4E46-A84F-8C0FFB548CED",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-04T07:41:12.522605+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 2140,
      "thread_id": 5340
    },
    "channel": "Microsoft-Windows-DataIntegrityScan/Admin",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4 — Completed data integrity checks.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Level: Informational
Opcode: Stop

Description

Completed data integrity checks.

Message #

Completed data integrity checks.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DataIntegrityScan",
    "guid": "13BC4371-4E21-4E46-A84F-8C0FFB548CED",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-04T07:41:17.424144+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 2140,
      "thread_id": 5340
    },
    "channel": "Microsoft-Windows-DataIntegrityScan/Admin",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 11 — Disk scan started on \\?

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Start

Description

Disk scan started on \\?\PhysicalDriveDiskNumber (\\?\DiskDiskGuid).

Message #

Disk scan started on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields #

Name	Description
`DiskNumber` UInt32	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 12 — Disk scan completed on \\?

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Stop

Description

Disk scan completed on \\?\PhysicalDriveDiskNumber (\\?\DiskDiskGuid).

Message #

Disk scan completed on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields #

Name	Description
`DiskNumber` UInt32	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 21 — Volume scan started on FriendlyVolumeName (VolumeName) in \\?

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Start

Description

Volume scan started on FriendlyVolumeName (VolumeName) in \\?\PhysicalDriveVolumeGuid (\\?\DiskDiskNumber).

Message #

Volume scan started on %4 (%2) in \\?\PhysicalDrive%5 (\\?\Disk%6)

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`VolumeGuid` GUID	—
`DiskNumber` UInt32	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 22 — Volume scan completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Stop

Description

Volume scan completed on FriendlyVolumeName (VolumeName).

Message #

Volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`TotalTimeTaken` UInt64	—
`VolumeGuid` GUID	—

Event ID 23 — Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Stop

Description

Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Message #

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`TotalTimeTaken` UInt64	—
`VolumeGuid` GUID	—

Event ID 24 — Files were skipped during the volume scan.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

Files were skipped during the volume scan.

Message #

Files were skipped during the volume scan.
Files skipped: %6
Volume name: %4 (%2)
First skipped file name: %8
HResult: %5

Fields #

Name	Description
`Volume_name`	—
`HResult` Int32	—
`Files_skipped`	—
`First_skipped_file_name`	Volume name.
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`Count` UInt64	—
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`VolumeGuid` GUID	—

Event ID 25 — Volume scan completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Stop

Description

Volume scan completed on FriendlyVolumeName (VolumeName).

Message #

Volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`TotalTimeTaken` UInt64	—
`VolumeGuid` GUID	—

Event ID 26 — Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Stop

Description

Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Message #

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`TotalTimeTaken` UInt64	—
`VolumeGuid` GUID	—

Event ID 27 — Volume scan completion at PercentComplete% on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

Volume scan completion at PercentComplete% on FriendlyVolumeName (VolumeName).

Message #

Volume scan completion at %25% on %4 (%2)
Bytes repaired: %10
Bytes not repaired: %11

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`TotalTimeTaken` UInt64	—
`PercentComplete` UInt16	—
`VolumeGuid` GUID	—

Event ID 54 — File data inconsistency was detected and was repaired successfully.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

File data inconsistency was detected and was repaired successfully.

Message #

File data inconsistency was detected and was repaired successfully.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 55 — File data scrub operation failed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

File data scrub operation failed.

Message #

File data scrub operation failed.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 56 — Volume metadata inconsistency was detected and was repaired successfully.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

Volume metadata inconsistency was detected and was repaired successfully.

Message #

Volume metadata inconsistency was detected and was repaired successfully.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 57 — Volume metadata scrub operation failed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

Volume metadata scrub operation failed.

Message #

Volume metadata scrub operation failed.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 58 — File metadata inconsistency was detected and was repaired successfully.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

File metadata inconsistency was detected and was repaired successfully.

Message #

File metadata inconsistency was detected and was repaired successfully.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 59 — File metadata scrub operation failed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

File metadata scrub operation failed.

Message #

File metadata scrub operation failed.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 60 — File data inconsistency was detected and the parity repair was scheduled at the end of the task.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

File data inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.

Message #

File data inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 61 — Volume metadata inconsistency was detected and the parity repair was scheduled at the end of the task.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

Volume metadata inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.

Message #

Volume metadata inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 62 — File metadata inconsistency was detected and the parity repair was scheduled at the end of the task.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

File metadata inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.

Message #

File metadata inconsistency was detected and the parity repair was scheduled at the end of the task. No user action is required.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 101 — Started checking data integrity for crash recovery.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Start

Description

Started checking data integrity for crash recovery.

Message #

Started checking data integrity for crash recovery.

Event ID 104 — Completed data integrity checks for crash recovery.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Stop

Description

Completed data integrity checks for crash recovery.

Message #

Completed data integrity checks for crash recovery.

Event ID 111 — Crash recovery disk scan started on \\?

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Start

Description

Crash recovery disk scan started on \\?\PhysicalDriveDiskNumber (\\?\DiskDiskGuid).

Message #

Crash recovery disk scan started on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields #

Name	Description
`DiskNumber` UInt32	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 112 — Crash recovery disk scan completed on \\?

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Stop

Description

Crash recovery disk scan completed on \\?\PhysicalDriveDiskNumber (\\?\DiskDiskGuid).

Message #

Crash recovery disk scan completed on \\?\PhysicalDrive%1 (\\?\Disk%2)

Fields #

Name	Description
`DiskNumber` UInt32	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 121 — Crash recovery volume scan started on FriendlyVolumeName (VolumeName) in \\?

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Start

Description

Crash recovery volume scan started on FriendlyVolumeName (VolumeName) in \\?\PhysicalDriveDiskNumber (\\?\DiskDiskGuid).

Message #

Crash recovery volume scan started on %4 (%2) in \\?\PhysicalDrive%5 (\\?\Disk%9)

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 122 — Crash recovery volume scan completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Stop

Description

Crash recovery volume scan completed on FriendlyVolumeName (VolumeName).

Message #

Crash recovery volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`ThreadCount` UInt32	—
`TotalTimeTaken` UInt64	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—

Event ID 123 — Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Stop

Description

Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Message #

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`ThreadCount` UInt32	—
`TotalTimeTaken` UInt64	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—

Event ID 124 — Files were skipped during the volume scan.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

Files were skipped during the volume scan.

Message #

Files were skipped during the volume scan.
Files skipped: %6
Volume name: %4 (%2)
First skipped file name: %8
HResult: %5

Fields #

Name	Description
`Volume_name`	—
`HResult` Int32	—
`Files_skipped`	—
`First_skipped_file_name`	Volume name.
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`Count` UInt64	—
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`VolumeGuid` GUID	—

Event ID 125 — Crash recovery volume scan completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Stop

Description

Crash recovery volume scan completed on FriendlyVolumeName (VolumeName).

Message #

Crash recovery volume scan completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`ThreadCount` UInt32	—
`TotalTimeTaken` UInt64	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—

Event ID 126 — Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Stop

Description

Volume scan was partially completed on FriendlyVolumeName (VolumeName).

Message #

Volume scan was partially completed on %4 (%2)
Bytes repaired: %11
Bytes not repaired: %12
HResult: %5

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`HResult` Int32	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`ThreadCount` UInt32	—
`TotalTimeTaken` UInt64	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—

Event ID 127 — Drt clear completed on FriendlyVolumeNameLength (VolumeNameLength).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

Drt clear completed on FriendlyVolumeNameLength (VolumeNameLength).

Message #

Drt clear completed on %4 (%2)
HResult: %5

Fields #

Name	Description
`HResult` Int32	—
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 128 — Drt clear completed on FriendlyVolumeNameLength (VolumeNameLength).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

Drt clear completed on FriendlyVolumeNameLength (VolumeNameLength).

Message #

Drt clear completed on %4 (%2)
HResult: %5

Fields #

Name	Description
`HResult` Int32	—
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—
`DiskGuid` GUID	—
`PortPoolId` GUID	—
`PortDiskId` GUID	—

Event ID 129 — Crash recovery volume scan completion at PercentComplete% on FriendlyVolumeName (VolumeName).

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

Crash recovery volume scan completion at PercentComplete% on FriendlyVolumeName (VolumeName).

Message #

Crash recovery volume scan completion at %26% on %4 (%2)
Bytes repaired: %10
Bytes not repaired: %11

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`DirectoryCount` UInt64	—
`FileCount` UInt64	—
`StreamCount` UInt64	—
`DataCount` UInt64	—
`FsctlCount` UInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`BytesSkippedDueToNoAllocation` HexInt64	—
`BytesSkippedDueToInvalidRun` HexInt64	—
`BytesSkippedDueToIntegrityStream` HexInt64	—
`BytesSkippedDueToRegionBeingClean` HexInt64	—
`BytesSkippedDueToLockConflict` HexInt64	—
`BytesSkippedDueToNoScrubDataFlag` HexInt64	—
`BytesSkippedDueToNoScrubNonIntegrityStreamFlag` HexInt64	—
`DataBytesScrubbed` HexInt64	—
`MetadataBytesProcessed` HexInt64	—
`DataBytesProcessed` HexInt64	—
`TotalMetadataBytesInUse` HexInt64	—
`TotalDataBytesInUse` HexInt64	—
`MaxThreadCount` UInt32	—
`TotalTimeTaken` UInt64	—
`PercentComplete` UInt16	—
`DiskNumber` UInt32	—
`DiskOffset` HexInt64	—
`Length` HexInt64	—
`VolumeGuid` GUID	—

Event ID 154 — File data inconsistency was detected and was repaired successfully.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

File data inconsistency was detected and was repaired successfully.

Message #

File data inconsistency was detected and was repaired successfully.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 155 — File data scrub operation failed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

File data scrub operation failed.

Message #

File data scrub operation failed.
File name: %2
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 156 — Volume metadata inconsistency was detected and was repaired successfully.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

Volume metadata inconsistency was detected and was repaired successfully.

Message #

Volume metadata inconsistency was detected and was repaired successfully.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 157 — Volume metadata scrub operation failed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

Volume metadata scrub operation failed.

Message #

Volume metadata scrub operation failed.
Volume name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 158 — File metadata inconsistency was detected and was repaired successfully.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

File metadata inconsistency was detected and was repaired successfully.

Message #

File metadata inconsistency was detected and was repaired successfully.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 159 — File metadata scrub operation failed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: CrashRecovery
Opcode: Info

Description

File metadata scrub operation failed.

Message #

File metadata scrub operation failed.
File name: %2
Metadata reference: %3
Range offset: %4
Range length (in bytes): %5
Bytes repaired: %6
Bytes not repaired: %7
Status: %8

Fields #

Name	Description
`FileNameLength` UInt16	—
`FileName` UnicodeString	—
`InternalFileReference` HexInt64	—
`FileOffset` HexInt64	—
`Length` HexInt64	—
`BytesRepaired` HexInt64	—
`BytesFailed` HexInt64	—
`Status` HexInt32	— NTSTATUS reference
`VolumeGuid` GUID	—

Event ID 160 — Parity repair completed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

Parity repair completed.

Message #

Parity repair completed.
Volume name: %4 (%2)
Extent count: %5
Length (in bytes): %6

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`ExtentCount` UInt64	—
`ExtentSize` UInt64	—
`HResult` Int32	—
`VolumeGuid` GUID	—

Event ID 161 — Parity repair failed.

Provider: Microsoft-Windows-DataIntegrityScan
Channel: Admin
Opcode: Info

Description

Parity repair failed.

Message #

Parity repair failed.
Volume name: %4 (%2)
Extent count: %5
Length (in bytes): %6
HResult: %7

Fields #

Name	Description
`VolumeNameLength` UInt16	—
`VolumeName` UnicodeString	—
`FriendlyVolumeNameLength` UInt16	—
`FriendlyVolumeName` UnicodeString	—
`ExtentCount` UInt64	—
`ExtentSize` UInt64	—
`HResult` Int32	—
`VolumeGuid` GUID	—