• Still running Windows 7 or earlier? Support for Windows 7 ended on January 14th 2020. Please review the thread here for more details.

[SOLVED] Hundreds of NTFS ID 55 errors at a time? CHKDSK clean. SMART values all good

sleveo

Active member
Joined
Dec 8, 2017
Posts
25
Location
USA
~~ Q: Hundreds of NTFS ID 55 errors at a time? CHKDSK comes back clean. SMART values all good.
No other symptoms noticed. Is my SSD dying? SanDisk SDSSDP128G running Windows 7, with full updates.

~~ 2018.01.09 Dang! I ran CHKDSK /r on C: this morning at 10am and again about an hour later, I see a series of NTFS ID 55 events at 11am for NTFS Error ID 55. 980 of them. Days later, after I Aligned the SSD, I got almost 8,000 errors all in a row.

~~ 2018.01.10 What I did: Researched NTFS ID 55 errors in Event Logs. Ran sfc again, still clean. Ran MalwareBytes, still clean. Checked my Windows Power Settings, which are set to High Performance, meaning Never turn off HD, ssd, but turn OFF Display after 15m. Fine. The SSD has no firmware update available, and was made in 2012 with the latest Firmware v3.2.0. After running CHKDSK and rebooting, chkNTFS c: reported: "The type of the file system is NTFS. C: is not dirty." Malwarebytes Anti-Rootkit BETA v1.09.3.1001 and "Scan Finished: No malware found!" Ran Speccy, CrystalDiskInfo7 and SSD-Z and SMART Status was OK. Temp: 35c. TRIM is enabled and working. The only real problem on this SSD is that it is NOT 4k-aligned.

~~ 2018.01.11 Running Part Wiz / Align All Partitions. Need to reboot to complete the process. This was after I ran CCleaner and also cleaned cache on Basilisk, which is not covered by CCleaner. ... Rebooted fine. SSD-Z now reports that all partitions aligned. A few hours after this step, I got almost 8,000 NTFS ID 55 errors. So maybe that was a mistake to run at this time.


~~ 2018.01.11 Happened again today, after I Aligned the ssd w/MiniTool Partition Wizard. Just before I see the NTFS errors I see these two:

Info event ID 26 "Application popup: Windows - Corrupt File : Exception Processing Message 0xc0000102 Parameters 0x000007FEFD80819C 0x000007FEFD80819C 0x000007FEFD80819C 0x000007FEFD80819C"

AND:
Info Event ID 7036 for the Service Control Manager: "The Windows Modules Installer service entered the running state."

NOTE: This is the same 2 events that preceded the earlier times when I saw a series of NTFS ID 55 errors. Even just before I saw two lone ID 55 errors, instead of the usual hundreds.

NOTES: My data is all backed up. My C: SSD has been imaged.
 
Yes, xilolee. SanDisk SDSSDP128G running Windows 7, with full updates.

Your command did not work on windows 7:
C:\Windows\system32>fsutil fsinfo sectorinfo c:
sectorinfo is an invalid parameter.

C:\Windows\system32>fsutil fsinfo
---- FSINFO Commands Supported ----
drives List all drives
drivetype Query drive type for a drive
volumeinfo Query volume information
ntfsinfo Query NTFS specific volume information
statistics Query file system statistics

Here is the best I could do:

C:\Windows\system32>fsutil fsinfo ntfsinfo c:
NTFS Volume Serial Number : 0x01d38ae7929c1f60
Version : 3.1
Number Sectors : 0x000000000e4a0ff8
Total Clusters : 0x0000000001c941ff
Free Clusters : 0x00000000014219d9
Total Reserved : 0x0000000000000f60
Bytes Per Sector : 512
Bytes Per Physical Sector : 512
Bytes Per Cluster : 4096
Bytes Per FileRecord Segment : 1024
Clusters Per FileRecord Segment : 0
Mft Valid Data Length : 0x0000000015454000
Mft Start Lcn : 0x0000000000581028
Mft2 Start Lcn : 0x000000000000000e
Mft Zone Start : 0x0000000000596460
Mft Zone End : 0x00000000005a2c80
RM Identifier: 2EA12393-DD06-11E7-BA33-806E6F6E6963

C:\Windows\system32>fsutil fsinfo volumeinfo c:
Volume Name : AsusWin7ssd
Volume Serial Number : 0x929c1f60
Max Component Length : 255
File System Name : NTFS
Supports Case-sensitive filenames
Preserves Case of filenames
Supports Unicode in filenames
Preserves & Enforces ACL's
Supports file-based Compression
Supports Disk Quotas
Supports Sparse files
Supports Reparse Points
Supports Object Identifiers
Supports Encrypted File System
Supports Named Streams
Supports Transactions
Supports Hard Links
Supports Extended Attributes
Supports Open By FileID
Supports USN Journal


C:\Windows\system32>fsutil fsinfo statistics c:
File System Type : NTFS

UserFileReads : 35627
UserFileReadBytes : 977563136
UserDiskReads : 34236
UserFileWrites : 11334
UserFileWriteBytes : 768080832
UserDiskWrites : 18207
MetaDataReads : 9907
MetaDataReadBytes : 56582144
MetaDataDiskReads : 11908
MetaDataWrites : 8915
MetaDataWriteBytes : 48775168
MetaDataDiskWrites : 14199

MftReads : 8908
MftReadBytes : 45907968
MftWrites : 6132
MftWriteBytes : 32366592
Mft2Writes : 0
Mft2WriteBytes : 0
RootIndexReads : 0
RootIndexReadBytes : 0
RootIndexWrites : 0
RootIndexWriteBytes : 0
BitmapReads : 4
BitmapReadBytes : 4194304
BitmapWrites : 1923
BitmapWriteBytes : 9904128
MftBitmapReads : 11
MftBitmapReadBytes : 45056
MftBitmapWrites : 403
MftBitmapWriteBytes : 1671168
UserIndexReads : 2836
UserIndexReadBytes : 13283328
UserIndexWrites : 4965
UserIndexWriteBytes : 27127808
LogFileReads : 7
LogFileReadBytes : 28672
LogFileWrites : 10821
LogFileWriteBytes : 91070464
LogFileFull : 0
 
I checked the Power settings just in case the SSD was configured to Shut down after 15 minutes. It was not.
Power Settings Currently set to High Performance, meaning Never turn off HD, ssd, but turn OFF Display after 15m.
 
Try the clean boot:
  • Start, searchbox, type msconfig, press enter.
  • In the new msconfig window, in General tab (default opened tab), click Selective startup and untick/deselect Load startup items.
    Only that one should be unticked, the other two must be ticked.
  • Go to Msconfig Services tab, tick/select Hide all Microsoft services (don't forget to hide them!).
    Disable the remaining NON-windows services.
    (i.e., DON'T disable windows services)
  • Click ok, reboot
 
I changed from the SSD to the backup HDD with the same issue. So it's not related to SSD.
I think it started when I was working out Windows Update problems with softwaremaniac.

~~ 2018.01.15 So today, on waking from rest after an hour on Performance 15, 0, 20, I got new rash of NTFS, ID 55 errors 978 of them. ~~ Q: Wonder if it depends how long I keep it in rest mode? Seems unlikely as all the errors occur within a minute. ... I changed Power options / Change plan settings / Change Advanced power setting / Hard disk / Turn OFF disk after: 20-0, which it translates to Never. ... When I woke from Performance 15,0, 0, meaning 15 screen OFF, Never Sleep, Never OFF HDD, I got NO NTFS errors. So I've confirmed that I can hack/fix it. I also tried to replicate error on DalePC with same settings? Nothing, I failed to replicate the error on another PC. Can't replicate on DalePC. ~~ Q: What happens when I put my DalePC to sleep and wake with Performance settings of 15, 0, 20? ~~ Q: What happens when I return to normal Balanced 10, 30, 20 on Asus? Starting 12:55-2:30p. Nothing. No errors when on Balanced. Wonder if it only happens once a day? ~~ Q: What happens when I put it back on Performance 15, 0, 20?




~~ 2018.01.16 Test sleep mode, now that I changed it from Performance to Balanced (which threw no NTFS errors yesterday) and back to Performance in Power Options. I believe I can stop the ID 55 errors by simply never turning off the disk, but that's a workaround. I'm hoping that just changing settings from Performance to Balanced and back to Performance will do it. Start: 8:30a - 12. But at 9am, I see hundreds of NTFS errors 654 of them. Then at 2pm, after another sleep cycle with nothing changed, I see no additional errors. I suspect it only happens once a day, perhaps related to Windows Update, and sure enough there is one update available.

~~ 2018.01.16 So I did configs for Clean Boot as suggested by SysNative, and will reboot tomorrow. Will post those results.
 
Problem Solved. I fixed first on the old HDD, and then on the SSD.

Cause: The most likely cause of hundreds of NTFS ID 55 errors in the logs (after running basic diagnostics like CHKDSK) is a corrupted Shadow Copy. If that's not it, it could be a corrupt Swap File.

Correction: Either Delete all Shadow Copies or, failing that, delete the Swap file.

How: Delete all Shadow Copies. At elevated Command Prompt (Run as Administrator):
vssadmin list shadows
vssadmin delete shadows /for=c: /all
vssadmin list shadows

Problems with System log error: NTFS ID 55

NTFS ID 55 errors by the hundreds is one of the more difficult errors to track down, with lots of conflicting and wrong information found, even on Microsoft forums. A few posts pointed to problems with Power Settings, Sleep mode and Volume Shadow Copy. Only with the help of SysNative did I get to a post on Dell on how to correct the problem. I fixed the problem on my PC. Here is what I learned along the way.

Shadow Copy and NTFS ID 55 FAQ

~~ Q: Why is this problem of NTFS ID 55 errors by the hundreds, so rarely discussed on forums, with so little correct information? Several reasons. First because the errors were in the System Log file, where few people look. Also, there is usually no other symptoms, so no reason to look in the log files. One could argue that one could safely ignore the errors. But if you have a corruption in your Shadow Copies, it could mess up or prevent a full image backup of your disk. These are silent errors, so you have to look for them in either: Nirsoft FullEvenLogView or in the MS Event Viewer.
~~ Q: Where do I find these NTFS ID 55 errors? In MS Event Viewer / Custom Views / Administrative Events. Or in Event Viewer / Windows Logs / System.
~~ Q: What to do first when I have NTFS ID 55 errors in the hundreds? First run CHKDSK /r/f on C:. Then check your disk drive for SMART errors (w/any disk diag, like Speccy by Piriforms). Run disk tests. Then run malware scans, and maybe try a Clean Boot. Then, if you found nothing and still get hundreds of ID 55 errors, you can suspect Volume Shadow Copy corruption. See next questions.
~~ Q: How to view your current set of Shadow Copies? a) Use NirSoft ShadowCopyView OR b) At an Admin elevated command prompt: vssadmin list shadows
~~ Q: How to tell the size of a Shadow Copy, given that they are Differential copies? I can't see how in Nirsoft ShadowCopyView, but you can see the size at elevated command prompt: vssadmin list ShadowStorage
~~ Q: Will I lose my Restore Points if I delete all Shadow Copies? Yes you will. To save the last one, you might use Disk Cleanup / More Options tab to remove all but the last Restore point / Shadow Copy. But that assumes the one that got corrupted is not the last one. If you clear all but the last Shadow Copy and still get the ID 55 errors, then go ahead and delete the last Shadow Copy. Check the log again for ID 55 errors.
~~ Q: How to delete all Shadow Copies when their corruption has triggered log Error NTFS ID 55? At elevated Command Prompt: vssadmin delete shadows /for=c: /all
~~ Q: How to tell for sure if you have a corrupt Shadow Copy? There is no easy way. a) Look in EventViewer / Windows Logs / System. Look for NTFS errors ID 55, in groups of hundreds at a time, when you've already run CHKDSK and checked the hard drive and found no errors and found no SMART warnings. The presence of such errors may indicate a dying hard drive or corrupt Shadow Copies. But the lack of those errors means you do NOT have any corruption in your Shadow Copies. Sometimes but not always, you will see mention of a particular Shadow Copy in the Event for NTFS ID 55 error, in the Details pane of the Event Viewer. There could be corruption even if no mention of Shadow Copy was in Details.
b) Using either command "VSSadmin list shadows" OR NirSoft ShadowCopyView, look for a missing ShadowCopy in the list. For example, it might go from GLOBALROOT\Device\HarddiskVolumeShadowCopy2 to GLOBALROOT\Device\HarddiskVolumeShadowCopy4, missing ShadowCopy3. Strong indication of corruption. c) Open text files from a restored Shadow Copy to look for blocks of SPACES where text used to be. This is hard to do, so not recommended. d) Some say you can run CHKDSK on the corrupted shadow copy, but I never figured out how to tell which was corrupt, except in the case of the Details panel of the error telling you so, but that never happened for me.
~~ Q: How to fix NTFS ID 55 errors in the hundreds? Two options. 1. Delete all (or the offending) Shadow Copies. 2. If that fails to stop the errors in Event logs, delete the Swap file, and/or move it to another partition.

~~ Q: How are all the ways to delete System Restore points, or Shadow Volume Copies? 1. Easiest way: In elevated Cmd prompt: (vssadmin delete shadows /for=c: /all) 2. Delete ALL: Ctrl Panel / System / System Protection / Configure / Delete (all restore points) / Continue / Ok. 3. Disk Cleanup OR RC disk / Properties / General tab / Disk Cleanup / Clean up system files / Then click on More Options tab / System Restore and Shadow Copies / Clean up... / You are prompted: Are you sure you want to delete all but the most recent restore point? Yes/Cancel. But it leaves the last one in place.
~~ Q: How to run chkdsk on a particular Shadow Copy? Any benefit in running CHKDSK on Shadow Copy? It's possible, but difficult. This post says NO: How to run chkdsk on a volume shadow copy "My advice would be to drop all shadow copies (thus deleting the problem), and let new (healthy) ones take their place. You would do this by turning off system protection for the C: drive, upon which all the shadow copies get deleted. Afterwards, turn system protection for the C: drive back on again, upon which it will make new ones as per normal schedule."
~~ Q: Does changing the Power Settings to Performance fix or cause this problem? No. But when the system is quiet for 30 minutes, the Volume Shadow Copy service begins to run. So it looks related, but it is not.
~~ Q: Does Microsoft know about this problem with NTFS ID 55? Yes and there is a patch. But it was already installed. You can download Update for Windows (KB2748349) for your particular OS from here https://support.microsoft.com/en-us...eated-by-using-the-windows-volume-shadow-copy "This issue occurs because some regions in the snapshot are not protected when the original volume is changed. " Unfortunately, I already had that update installed, with no problems. So there are other causes of this same problem.
~~ Q: Is a Volume Shadow Copy the same as a Restore Point? Sort of. They are often used synonymously. But technically, the Restore Point is a service that makes use of the Volume Shadow Copy for its data file.

~~ Q: What is the relationship between volume shadow copy and restore point? Seems to be the same thing. I see the same dates and copies in both NirSoft ShadowCopyView and C:/ Properties / Previous Versions tab (called: "Shadow Copies tab" on Win Server 2003). What you should know about Volume Shadow Copy/System Restore in Windows 7 & Vista (FAQ) << Hope This Helps "Volume Shadow Copy is a service that creates and maintains snapshots (“shadow copies”) of disk volumes in Windows 7 and Vista. It is the back-end of the System Restore feature,... Volume shadow copies (restore points) are created before the installation of device drivers, system components (e.g. DirectX), Windows updates, and some applications. In addition, Windows automatically creates restore points at hard-to-predict intervals. The first thing to understand here is that the System Restore task on Vista and 7 will only execute if your computer is idle for at least 10 minutes and is running on AC power."

~~ Q: Should my Shadow Volume Copy service be ON all the time? It's off at the moment and set to Manual. SEEMS that it's off most of the time, and it's turned on when needed. It's only a problem if it's Disabled. Although the forum posts I read, as well as the Help Text in the Services applet itself, both warn about it being off. "Volume Shadow Copy Service: Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start."
~~ Q: How to find the Shadow Copy ID of a particular shadow? At elevated Cmd Prompt: vssadmin list shadows Then notice the long HEX number in the braces {}. That's the ID of the shadow copy, without the braces.
Vssadmin delete shadows | Microsoft Docs Documents on how to use: Vssadmin delete shadows
Windows 7 Technical Library Roadmap | Microsoft Docs Really good docs on Windows 7.

~~ NTFS ID 55 errors and Swap file: https://social.technet.microsoft.co...the-chkdsk-utility-on-the?forum=windowsbackup "I had this issue rather consistently and found that it was due to a corrupt swap file. I deleted the swap file and moved it to another partition and the problem went away." The details for deleting the specific shadow copy are there, but complicated. Easier to delete all Shadow Copies at an elevated Command Prompt: vssadmin delete shadows /for=c: /all
~~ OPEN Q: What happens to the D: partition Shadow Copies after I run this command? vssadmin delete shadows /for=c: /all
~~ OPEN Q: When the quota has been met (6gb on my PC), do the shadow copies get renumbered when a new one is added?
~~ OPEN Q: When I run: "vssadmin delete shadows /for=c: /all" will that also delete Shadow copies I have on D:?


Sorry I took so long to post this success. Thanks again.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top