EVENT ID 55: When Good Bits Go Bad

My name is William Effinger, and I am a Senior Support Escalation Engineer with the Windows Core team at Microsoft. Some of the most common questions we get here at the storage team center around CHKDSK. If you have ever come across any event ID 55s in your system event log, this blog is for you.

What is an event ID 55? Let’s start by looking at the error:

Event Type: Error
Event Source: NTFS
Event ID: 55
Description:
The file system structure on disk is corrupt and unusable. Please run the chkdsk utility on the volume "Drive_letter:"

While the error description is direct and self-explanatory, we often receive calls from customers who want to better understand how this occurred and their subsequent options.

How did we get into this situation to begin with?

The file system does not proactively check each write (doing so would hugely impact performance, as you can imagine). NTFS instead has a logic that checks some reads for congruence. As a preventative measure, we can only suggest best practices such as keeping up to date with drivers and firmware.      

We do know, however, that the corruption that we see in the file system is due one of two things: either a hardware problem or an issue with the file system driver.

The majority of the issues we see revolve around problems with hardware. As a rule of thumb, hardware tends to corrupt unpredictably.

If you suspect hardware, the following techniques will likely help you identify the culprit:

  • Install the latest SCSIPORT/RAIDPORT update(s).
  • Remove or update filter drivers.
  • Update 3rd party storage drivers /firmware.
  • Try switching to different type of driver (raidport vs. monolithic).
  • P2V the machine and try using a different storage method (virtualized SCSI or ATAPI).
  • If all else fails, rearrange hardware into various combinations.

While extremely rare, NTFS issues can certainly happen. Unlike hardware, NTFS will leave a trail of very specific clues in the corruption leading straight to the offending code. Due to the exceptionally large install base of NTFS, opportunities for corruption have already been identified and resolved. If a software concern still remains, updating the latest version of NTFS would be a prudent course of action.

The only option left for Microsoft support is to look over your server and provide an analysis of the storage stack health. To do that, we look for filter and out of date storage drivers. Then we attempt to eliminate multi-pathing and/or contact the storage vendor suggesting updates as necessary.

Sometimes identifying the root cause of the corruption is less important than resolving the corruption itself. Event ID 55 has alerted you to the fact that there is corruption on the volume, and the only tool capable of resolving the file system corruption is CHKDSK. Unfortunately, customers are unable to use the corrupted volume while CHKDSK is repairing problems with the file system and estimating downtime is impossible. My colleague summed this up in his blog “Questions you shouldn't call Microsoft for...

If you have any event ID 55s in your system event log, it’s time to run CHKDSK. The longer you wait the worse it is likely to get.

William Effinger
Senior Support Escalation Engineer
Microsoft Enterprise Platforms Support