This seems like a stupid question but I can't find an answer anywhere...

After I run chkdsk in XP, either by "Error checking" the disk in Windows (under Disk Properties,Tools) or running the boot-time version ('chkdsk /f' which runs 'autochk' at next boot), *where* are the results??? Isn't there a log file generated, like old SCANDISK used to do, where you can see what problems were found and what got fixed, or that no problems were found? Or are you just supposed to take it on faith that everything was OK or that anything that was wrong is fixed and it's OK now?

I've been getting "data error (CRC)" reading several files so i suspect my drive may be going. I've run error checking which just said it was finished when it was finished and chkdsk /f which i noticed said it was recovering a file at one point but rebooted when it was done and in neither case could I find a log file or anything in event logs (actually not sure about the system event log after "error checking" since it was suddenly corrupt!)

Any way to recover/salvage a corrupt event log file?

Other questions.

I've heard that NTFS/Windows supposedly detects and maps out bad sectors on the fly (automaticly recovering & relocating data in such sectors, if possible, I presume). Is this the case and if so does that imply that if chkdsk is detecting bad sectors that they must have formed recently (and one might assume that more are likely to form in the near future)?

In this case, chkdsk (run from the disk properties page) was able to do a full scan of the boot drive while Windows was running. In other cases I've seen it say "can't lock the drive...will have to run on next reboot". What's the difference? Why can chkdsk sometimes run on the boot drive (containing Windows) and sometimes not?

many thanks in advance.
John.

John

If you go to Event Viewer - Application - immediately after Chkdsk - you'll find an Entry called 'winlogon' - if you Click on that you'll get a Summary - on that Summary you'll notice '65Mb Occupied by Log File' - this has always puzzled me - if you Click on the More Info Link at the bottom of the Summary - you'll discover that a Log File called 'bootex.log' should be in the Root of the Scanned Drive - it is not! - not even Hidden

I can only assume that this bootex.log appears on XP Pro only - not XP Home

Lesley

Here what I've found out to answer my own question. And what I still don't know.

After running "Error Checking" within Windows using the Properties-Tools tab for the drive, results (or at least bad block messages) appear in the System Event log as "Error ID 7". Not mention of what block was bad. Just a 128 bytes of data in hex with no explanation that i can find anywhere.

When chkdsk runs at boot time or from the recovery console, it creates this file c:\bootex.log. However you will only see this file if boot-time chkdsk is interrupted or your are using the recovery console. When Windows next boots it copies any c:\bootex.log it to an entry in the *Application* Event log, helpfully titled "WINLOGON". The Bootex.log file is then deleted. For errors in areas allocated to files, the message gives you an "offset", which I take to be of the bad disk sector but it doesnt say in bytes, sectors or what, and it tells you the file affected. For errors in unallocated areas, it tells you nothing (except there was one). There's also a hex data block associated with this but no information available to interpret it.

I'd love to find out where I can find and explanation of these hex data blocks in the Event log associated with "Event ID 7" and "WINLOGON".

Again, Micro$oft has replaced something that was useful and worked (scandisk) with something that is confusing and nearly useless (XP/2000's chkdsk).

Apparently if you want serious and useful hard drive scanning you go buy Steve Gibson's SPINRITE from grc.com. But that doeast run from within Windows at all.

Anyone with more info or suggestions, feel free!