Resolved Acronis Drive Monitor is scaring me with warnings

Hi. I had totally forgotten that Acronis Drive Monitor is installed (presumably an OEM pre-install) until it yesterday started sending me some worrying messages. After boot, I get an email with the following message: "Events that may potentially lead to a data loss were detected in Windows Event Log ", followed by 10 instances like this:

Risk: High
Type: Error
Source: Ntfs
Category: 0
ID: 55
Date: 2014/5/16
Time: 8:26:55
Description:
Damage to the structure of the file system on volume ACER [my C: drive]. The Master File Table (MFT) contains a damaged record file. The reference number of the file is 0x9000000000009. The name of the file is " ".

(I've translated the final para of the warning from the native Italian of the system.) The only difference between the 10 instances is the time-stamp, ranging from 8:26:48 to the 8:26:55 quoted above.

• I've run chkdsk c: /f two or three times (in the variant "can't do it now, do you want to book it for next reboot?" > Y) but it still gives me the same warnings after booting and chkdsk-ing.
• I have run "Automatic maintenance" a couple of times (which BTW tells me "No action needed ").
• The same page in "Action Center" give me "All drives are working properly ".
• Control Panel > Troubleshooting doesn't find any trouble to shoot.
• All Microsoft Updates are up to date and installed.
• The event log doesn't give me any helpful detail.

Everything else seems to be totally normal, no slowdown, no hesitations or apps crashing, nothing.

Is this something I should be worrying about? Is there anything I should be doing, like picking up a system refresh point from a couple of days back? If these are false positives, is there any way I can delete them and start clean?

Grateful for any advice.

 

Hard drives use S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) to gauge their own reliability and determine if they’re failing.

Acronis Drive Monitor alerts you to changes reported by the S.M.A.R.T. sensors.

The latest free version of Speccy will let you look at the individual parameters for your drive, in an easy to understand graphical pass/fail format.

http://www.piriform.com/speccy/download/standard

(from Release notes for v1.26.698 29 Apr 2014)
Added SMART attribute real values and statuses.
Restructured SMART attributes and RAM JEDEC data into grid view.

You might also want to read the wikipedia entry on S.M.A.R.T., and the Acronis Users Guide

http://en.wikipedia.org/wiki/S.M.A.R.T.

http://www.acronis.com/sites/default/files/multilingual/ADM_userguide_en-US_0.pdf

 

Many thanks, antik.

I'll get hold of Speccy and report back once I've used it.

UPDATE: Got it - many thanks, a great little program!

Shows everything OK, no warnings, temperatures nice and cool after a full day's work.

I wonder where I go from here...

 

Good time to have a well tested backup system for all your files, make sure you have the keys for all your software, install disks for your apps and drivers, etc.

Try chkdsk /r

/r includes the functionality of /f, but checks physical disk errors in addition to logical.

http://technet.microsoft.com/en-us/library/cc730714(v=ws.10).aspx

 

OK - I'll do so and report back. But it won't be tonight (CET), as the reboot with chkdsk takes quite a while and it's already pretty late here...

 

OK, so I ran chkdsk /r. The scan phase hesitated for a long time at 11%; then I had to go out, and when I returned it had finished - I'd estimate 0:40 to 1:00 total time. Very soon the usual email with warnings came in. Just as before: 10 warnings, 10 corresponding entries in Windows Event Log with no helpful detail, Control Panel > Action > Maintenance tells me everything's OK, so does ADM. Nothing helpful found in the Acronis KB. In short, everything exactly as before.

The only thing I noticed which is strange (to me) is that Speccy now reports the drive to have 5 partitions, when it's only supposed to have 2 (drives C: and D:, which here appear as partitions 2 and 4): I've never noticed this anywhere else before, and it may be totally irrelevant to the problem, and just some way of reporting that I'm not familiar with. I confess I didn't notice this when I used Speccy for the first time yesterday, and can't swear whether it was showing 2 or 5 partitions, but I sort of doubt how I could have overlooked something so eye-catching. The "ghost" partitions 1, 3 and 5 don't show up in Windows Explorer, even though they account for over 600 Mb.

ST1000DM003-1CH162
Manufacturer Seagate
Heads 16
Cylinders 121.601
Tracks 31.008.255
Sectors 1.953.520.065
SATA type SATA-III 6.0Gb/s
Device type Fixed
ATA Standard ATA8-ACS
Serial Number Z1D3GB7D
Firmware Version Number CC44
LBA Size 48-bit LBA
Power On Count 1091 times
Power On Time 166,1 days
Speed 7200 RPM
Features S.M.A.R.T., APM, NCQ
Max. Transfer Mode SATA III 6.0Gb/s
Used Transfer Mode SATA II 3.0Gb/s
Interface SATA
Capacity 931 GB
Real size 1.000.204.886.016 bytes
RAID Type None
S.M.A.R.T
Status Good
Temperature 31 °C
Temperature Range OK (less than 50 °C)
S.M.A.R.T attributes

Partition 0
Partition ID Disk #0, Partition #0
File System NTFS
Volume Serial Number C88FA499
Size 399 MB
Used Space 265 MB (66%)
Free Space 134 MB (34%)

Partition 1
Partition ID Disk #0, Partition #1
Size 300 MB

Partition 2
Partition ID Disk #0, Partition #2
Disk Letter C:
File System NTFS
Volume Serial Number 40914279
Size 456 GB
Used Space 81 GB (17%)
Free Space 375 GB (83%)

Partition 3
Partition ID Disk #0, Partition #3
File System NTFS
Volume Serial Number D2AFCEF2
Size 349 MB
Used Space 300 MB (85%)
Free Space 49 MB (15%)

Partition 4
Partition ID Disk #0, Partition #4
Disk Letter D:
File System NTFS
Volume Serial Number C092BB50
Size 458 GB
Used Space 6,05 GB (1%)
Free Space 451 GB (99%)

Partition 5
Partition ID Disk #0, Partition #5
File System NTFS
Volume Serial Number 8E9417F2
Size 15,5 GB
Used Space 12,6 GB (81%)
Free Space 2,9 GB (19%)

 

Also, thinking about the wording of the warning advisories ( "Events ... were detected in Windows Event Log ") it occurs to me that ADM didn't find the errors: it merely reported that it had spotted that Windows had found some errors, and therefore logged them. So I shouldn't be looking into ADM resources for help, but in Windows. Unfortunately, Windows resources aren't telling me anything useful yet.

 

It comes via email? That seems odd to me - if not downright suspicious. How is one to get (let alone send) the email if the system is not working properly? No pop-up errors? Are you 200% sure these emails are being initiated and sent by Acronis?

If me, I would visit the drive maker's website and download the Hard Drive Diagnostics tool for your drive. Alternatively, you can run SeaTools from Seagate as it works on drives from all makers.

If Seatools reports all is well, I would uninstall Acronis. If Seatools reports problems, then I would suspect drive failure may be eminent.

In ANY case I would urge you to make sure you have a recent backup of any personal data file you don't want to lose.

 

Hi Bill, and thanks. Yes, that is correct that the advisories come by email. I checked the ADM settings and confirmed that I had selected this option and provided my email address, presumably among all the other startup stuff several months back when I first bought the new PC and was setting everything up, but I had forgotten ADM as it never raised any flags up to now. My router, for example, also provides advisories via email (funny to think the emails go all the way to the ISP and back rather than just across my desk...), on exploits blocked by the firewall and similar.

And thanks also for the suggestion about diagnostic tools - a very helpful one. I'll do as much of that as I can today, maybe finishing Monday as I'm out of town tomorrrow, and will report back anything useful.

 

Did chkdsk say that it found no errors, found errors and fixed them, or that it found errors but could not fix them?

I'm assuming that Win Event Log is reporting errors in index files. True? Can you associate the dates and times of the log errors with anything? Do they happen at the same time every day?. Can you associate the beginning of the errors with any change in your routine, installation of new hardware or software, change in settings?

Does chkdsk ever run automatically at boot, indicating that the drive has been marked as "dirty" by Windows?

Seems like you are facing a couple of choices. One is to live dangerously, configure Acronis to ignore the log errors, and see what happens. The other is system repair, reset to factory specs, reformatting. That means you lose all your data, updates, settings, everything.

If you can't find the cause of the errors, the problem may reoccur.

You said that you installed all Win 8.1 updates. Have you checked the Acer site to see if there are driver updates necessary to run Win 8.1 update? Am I correct that the machine shipped with 8 and you have updated to 8.1?

Here is a microsoft community thread on ntfs id 55 errors.

http://social.technet.microsoft.com...-logged-event-id-55-ntfs?forum=w7itprogeneral

I don't disagree with Bill, and drives can fail at any time, without warning, but it is a very new machine and you say the computer operates normally, except for the event log warnings.

 

Good! That makes sense now-thanks for clarifying. As for your router, that makes sense too since the router monitoring software is running on the router, not your computer. And emails must go through an email server - also not running on your computer.

All true - but I will add when it comes to electronics (including electro-mechanical devices like HDs) IF they are destined to fail pre-maturely, that typically (with exceptions of course) happens when still relatively new.

By "destined ", I am assuming a "normal" life with no "abuse" - that is, voltages are correct, temperatures are well within the "normal operating range" and the drive has not been bounced off the floor.

And again, in any case, ensuring a viable backup of all precious data is paramount.

 

None of the above. Unlike XP, where one can follow the progress of the disk check, in W8.1 you only see the whirly-thingy that has replaced the hourglass (anybody have a name for that? Like the "twirling baton" of DOS?) and the percentage of disk check completed.

Don't know. Don't understand the question.

Yes - they always seem to happen in a very close bunch (10 errors in less than a second) around 20 - 30 minutes after boot. But no, no change in routine, installations (except for MS Updates), change in settings.

No, never. Also, chkntfs also reports "not dirty ".

Exactly. That's why I'm here

Yes, correct. Nothing helpful/relevant on the Acer site that I could find.

Thanks for finding this. I read it but it didn't help in my specific case. It almost seems to suggest that these are false positives, which is tending me towards disactivating the error reporting by ADM.

This, too, is tending me towards the "false positives" version.

 

I'd strongly second this advice. Its very good advice even if nothing is wrong with the hard drive. The only reason why I don't worry about my laptop hdd going out is because I make regular backups to an external drive, and my "drop dead" files are backed up to Amazon Cloud as well.

 

Hi g.watson - welcome back.

Did you run SeaTools? What was the verdict?

Thank you for answering my questions. Let's take things one at a time.

Chkdsk does create a log. Here is one tutorial for how to access it.

http://mywindows8.org/read-event-viewer-log-check-disk-chkdsk-windows-7-windows-8/

Let me know if it works for you.

 

g. watson - The 5th partition in your list looks like it may be an Acer recovery partition. Can you confirm that? Using Acer Recovery Management to Restore Windows 8:

http://acer.custhelp.com/app/answers/detail/a_id/26281

If the SeaTools test says the drive is OK, the next step is doing a "clean boot" and seeing whether errors are still reported when nothing is running but Windows 8.1

http://support.microsoft.com/kb/929135

http://www.eightforums.com/tutorials/23382-troubleshoot-problem-clean-boot-windows-8-a.html

There are a couple of good articles about how Windows deals with ntfs errors and how chkdsk operates in Windows 8. The first article is referenced in the second.

Redesigning chkdsk and the new NTFS health model

http://blogs.msdn.com/b/b8/archive/2012/05/09/redesigning-chkdsk-and-the-new-ntfs-health-model.aspx

CHKDSK - Check a Drive for Errors in Windows 8

http://www.eightforums.com/tutorials/6221-chkdsk-check-drive-errors-windows-8-a.html

 

Yes, I did. I ran all but one of the tests - the one not guaranteed to be data-safe - and they all reported the drive clean.

Something else new I've learned - thanks! The chkdsk log contained a couple of advisories, which I'll translate from the Italian as best I can, not knowing what the heck I'm talking about here in any language:
Cleanup of 21 unused entries in index $S11
Cleanup of 21 unused entries in index $DIt
Cleanup of 21 unused security descriptors

And then, at the end, the good news:
No problems found
No further action required.

OK, that was the first of your 2 most recent posts. Now I'll take the other one and report back when I've done everything you suggested. Many thanks again for the moment...

 

No, I can't. Don't know how to find out and confirm that.

I'd like to leave that option to the very last, when nothing else has worked, because of the huge downtime and probable data-loss issues. Also I'm just plain scared!

I ran the check from This PC > Drive C: > Properties > Tools > Check and the drive checked out with no errors.

Yes, the SeaTools tests did give OK. I'll do this next, and time it for when I need to go out this afternoon, because the warnings seem to come after a while. Above I wrote "about 20-30 minutes after boot ", but since writing that I've seen them happen about an hour after boot, so I'll need to wait a while after the clean boot to see if they still occur.

 

Thanks for the feedback. Know this is a lot of work, and kudos to you for sticking with it. - antik

 

Hey, I should be thanking you for all the time and effort you're putting into this!

OK, did that. No effect whatever: the same errors were logged as usual about 20 minutes after the clean boot.

So to sum up, what I have here is a fairly new HD (less than a year) which recently started throwing up 10 warnings shortly after boot, but otherwise has no symptoms of damage and passes all tests I can throw at it. It also has three mysterious "ghost partitions" according to Speccy, which I can't access or see anywhere else, for a total of some 16Gb out of some 900Gb total.

I think I can live with that. I shall not set ADM to stop sending me warnings, because one email per day to add to all the other junk mail is a small price to pay for keeping a watch for any creeping worsening of the HD's health.

Unless you or anybody else can suggest any further options, I'll mark this thread "solved" (pity there's no "abandoned" option!), and sorry if this hasn't been useful to anybody else. Many thanks, antik.

 

Most HDs are warrantied for at least 1 year, some 3 and some 5. I would contact the maker and get an RMA.