Win8.1 update : events 55 NTFS "A corruption was found in a file system index structure"

Got an extremely stable system, originally running Windows 8 Pro 64-bit. The system was upgraded from within store to Windows 8.1 and on May 1st to 8.1 update 1.


I have been running a small applet which checks the drive SMART status as well as reads and analyzes the Windows logs. Some days ago it showed that a pair of ntfs errors happened. Note that my system showed and still shows no other signs of problems. The errors are as follows:


Error 1:

A corruption was discovered in the file system structure on volume ?? (note: notice the ?? here)


A corruption was found in a file system index structure. The file reference number is 0x300000002384b. The name of the file is "\Windows". The corrupted index attribute is ":$O:$INDEX_ALLOCATION".

Error 2:

A corruption was discovered in the file system structure on volume ?? (note: again, notice the ?? here)

A corruption was found in a file system index structure. The file reference number is 0x30000000245fb. The name of the file is "\Windows\System32\config". The corrupted index attribute is ":$O:$INDEX_ALLOCATION".

These two errors were logged on June 21st. After taking a backup of my critical files, I ran chkdsk /f /r. The result is that on reboot the system started checking and stayed for quite a few hours stuck at 11%. Later on I discovered that the system entered Windows without a hitch.

After working a couple of days, this error did not show up again. Then, it happened again today, the EXACT same pair of event id 55 ntfs errors.

Something else: if you examine the XML event log entries, as well see above that there is no reference to the hard disk, you'll see that devices \Device\HarddiskVolumeShadowCopy4 and \Device\HarddiskVolumeShadowCopy3 are referenced.

Other information of interest:

* As mentioned above, apart from these errors in the event log, there has been no other hint of problem with the system. No freezes or BSODs or slow startups or whatever...

* Run both short as well as long SMART diagnostics on the hard drive (WD 1TB black), passed both with flying colors.

* Attached the problematic events

Any idea on how to proceed from here? Definitely want to avoid a reinstall. Running again a chkdsk /f /r might cure only the symptoms and not the issue itself.

The pair of errors follow here, sorry for the Greek:

Error 1:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Ntfs" Guid="{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}" />
  <EventID>55</EventID>
  <Version>0</Version>
  <Level>2</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated SystemTime="2014-06-21T10:47:21.022500000Z" />
  <EventRecordID>16507</EventRecordID>
  <Correlation />
  <Execution ProcessID="4" ThreadID="3888" />
  <Channel>System</Channel>
  <Computer>Monolith</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <EventData>
  <Data Name="DriveName">??</Data>
  <Data Name="DeviceName">\Device\HarddiskVolumeShadowCopy4</Data>
  <Data Name="CorruptionState">0x14</Data>
  <Data Name="HeaderFlags">0x22</Data>
  <Data Name="Severity">Κανονικό</Data>
  <Data Name="Origin">Πρόγραμμα οδήγησης συστήματος αρχείων</Data>
  <Data Name="Verb">Υποδέντρο ευρετηρίου</Data>
  <Data Name="Description">Εντοπίστηκε αλλοίωση σε μια δομή ευρετηρίου του συστήματος αρχείων. Ο αριθμός αναφοράς αρχείου είναι 0x300000002384b. Το όνομα του αρχείου είναι "\Windows". Το κατεστραμμένο χαρακτηριστικό ευρετηρίου είναι ":$I30:$INDEX_ALLOCATION".</Data>
  <Data Name="Signature">0x2c82efbb</Data>
  <Data Name="Outcome">Τόμος μόνο για ανάγνωση</Data>
  <Data Name="SampleLength">0</Data>
  <Data Name="SampleData" />
  <Data Name="SourceFile">0x14</Data>
  <Data Name="SourceLine">4004</Data>
  <Data Name="SourceTag">351</Data>
  <Data Name="CallStack">Ntfs+0x15404a, Ntfs+0xe4bb4, Ntfs+0xedce6, Ntfs+0xc1ec1, Ntfs+0xb0c0c, fltmgr+0x56d6, fltmgr+0x2c0e1, ntoskrnl+0x3f3843, ntoskrnl+0x3f94f8, ntoskrnl+0x3f6e53, ntoskrnl+0x481785, ntoskrnl+0x15f7b3</Data>
  </EventData>
  </Event>

-


Error 2:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Ntfs" Guid="{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}" />
  <EventID>55</EventID>
  <Version>0</Version>
  <Level>2</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated SystemTime="2014-06-21T10:47:21.784217600Z" />
  <EventRecordID>16508</EventRecordID>
  <Correlation />
  <Execution ProcessID="4" ThreadID="1100" />
  <Channel>System</Channel>
  <Computer>Monolith</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <EventData>
  <Data Name="DriveName">??</Data>
  <Data Name="DeviceName">\Device\HarddiskVolumeShadowCopy4</Data>
  <Data Name="CorruptionState">0x14</Data>
  <Data Name="HeaderFlags">0x22</Data>
  <Data Name="Severity">Κανονικό</Data>
  <Data Name="Origin">Πρόγραμμα οδήγησης συστήματος αρχείων</Data>
  <Data Name="Verb">Χαρακτηριστικό ευρετηρίου</Data>
  <Data Name="Description">Εντοπίστηκε αλλοίωση σε μια δομή ευρετηρίου του συστήματος αρχείων. Ο αριθμός αναφοράς αρχείου είναι 0x30000000245fb. Το όνομα του αρχείου είναι "\Windows\System32\config". Το κατεστραμμένο χαρακτηριστικό ευρετηρίου είναι ":$I30:$INDEX_ALLOCATION".</Data>
  <Data Name="Signature">0xb7d7309</Data>
  <Data Name="Outcome">Τόμος μόνο για ανάγνωση</Data>
  <Data Name="SampleLength">0</Data>
  <Data Name="SampleData" />
  <Data Name="SourceFile">0x14</Data>
  <Data Name="SourceLine">3995</Data>
  <Data Name="SourceTag">350</Data>
  <Data Name="CallStack">Ntfs+0x153fe7, Ntfs+0xe4bb4, Ntfs+0xdede4, Ntfs+0xd11f9, Ntfs+0xe9252, Ntfs+0xe93a9, fltmgr+0x2cf8, fltmgr+0x10b6, ntoskrnl+0x3c4d28, ntoskrnl+0x15f7b3</Data>
  </EventData>
  </Event>

 

Question Info


Last updated September 1, 2019 Views 6,667 Applies to:
Answer
Answer

Yes, the vssadmin command should delete those.  For your Copy 4, use the Shadow Copy ID, which can be copied and pasted in the Command prompt window.

vssadmin Delete Shadows /Shadow={d8854a53-46df-4aa0-9ef5-f3643a6b4f8d}

This command should remove your Copy 4.

It should not hurt to keep Copy5.

1 person was helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.