Failing hard drive? Or not?

H

Haole Boy

Active Member
Reaction score
190
Aloha folks. I'm back again with another "is this drive failing, or not?" question.

I'm testing a new-to-me tool called Malwarebytes Toolset (it is yet another diagnostic tool aimed at technicians and has the various Malwarebytes tools built in along with capability to add your own tools). When I ran the "Scan" option that looks for things that might be wrong, it found 80 event log entries indicating possible problems with the hard drive. The two different entries that were found look like this:

===================

Level Date and Time Source Event ID Task Category
Warning 4/27/2017 2:29:29 PM Microsoft-Windows-Ntfs 147 None "An IO took more than 30000 ms to complete:

Process Id: 4
Process name: System
File name: 000A0000000349CA
File offset: 4526080
IO Type: Write: Paging, NonCached, Sync
IO Size: 684032 bytes
4 cluster(s) starting at cluster 520397
Latency: 40914 ms

Volume Id: {506A37EB-5B09-4228-8FE9-22062359611A}
Volume name: C:
Is boot volume: true
"
Warning 4/27/2017 2:38:05 PM Microsoft-Windows-Ntfs 149 None "In the past 3600 seconds we had IO failures.
This may indicate a failing disk.

High latency IO count: 1
Failed writes: 0
Failed reads: 0
Bad clusters relocated: 0

Volume Id: {506A37EB-5B09-4228-8FE9-22062359611A}
Volume name: C:
Is boot volume: true
===================

After seeing this, I created a full disk image using ddrescue.
- ddrescue copied all sectors with no errors.
- SMART shows no problems (and yes, I know that SMART is not a reliable indicator of disk problems).
- This is a WD drive, so I ran Data Lifeguard Diagnostics both short and long tests and both passed

So, is this drive starting to fail and only Windows is able to detect this? Or can I ignore these event log entries?

Mahalo for sharing your knowledge!

Harry Z.
 
My general feeling when I see that or a few other disk-related event log entries is that the drive is showing signs of failing. Cloning to a new drive at this point is generally fast, cheap and painless and avoids the risk of downtime or system slowdowns in the future.

If it's for a residential system that doesn't get much use, maybe just alert them and push for/ensure that there's a backup process in place. For business systems used daily, this is preventive maintenance for any system on a maintenance plan.

Edit: The only caveats on that: is it one of those Green drives that spin down at the drop of a hat? Some of this might be a combination of spin-up and those drives failing regularly. Also, is the system being used for a ton of disk-intensive stuff? If so, the load should be split onto a second drive.
 
fencepost said:
My general feeling when I see that or a few other disk-related event log entries is that the drive is showing signs of failing. Cloning to a new drive at this point is generally fast, cheap and painless and avoids the risk of downtime or system slowdowns in the future.

If it's for a residential system that doesn't get much use, maybe just alert them and push for/ensure that there's a backup process in place. For business systems used daily, this is preventive maintenance for any system on a maintenance plan...
Click to expand...

Yes, this is for a residential system. It still has 3 months left on the warranty, so I think I'll make sure about the backup process she's using (if any) and also ask her if she's willing to go through the warranty process and be without her machine for a while.

Markverhyden said:
So, what caused you to do this to begin with? Is this a machine brought in by a customer with problems? Or you just decided to test the tool on a drive you had lying around?
Click to expand...

It belongs to a friend's wife and was given to me with a "can't log on" problem description. I resolved that problem (had her reset her MIcrosoft ID), password. And, yes, since it was here I decided to run this new tool just to see what would pop up. :-)

ComputerRepairTech said:
*scratches head in confusion* have i ever seen this event log before? I don't think I have. Am I going crazy here?
Click to expand...

You're not going crazy. I wanted to copy the events so that I could paste them here, and it took me about 45 minutes to find them since they are not in the System Log. Perhaps I did not choose the best format to save them in. I have not researched if this log's location is something new in Win10.

Here's how you find these log entries

Event Viewer
- Applications and Services Logs
-- Microsoft
--- Windows
---- Ntfs (Note: the case is just like this - it's not NTFS like I expected)
----- Operational
Then I filtered the log to remove the Informational entries.

Mahalo for all the feedback!

Harry Z.
 
Haole Boy said:
Here's how you find these log entries

Event Viewer
- Applications and Services Logs
-- Microsoft
--- Windows
---- Ntfs (Note: the case is just like this - it's not NTFS like I expected)
----- Operational
Then I filtered the log to remove the Informational entries.

Mahalo for all the feedback!

Harry Z.
Click to expand...
On the windows 7 workstation im currently on this entry does not exist however it does exist on my windows 10 microsoft surface and I do have the same entries you have but on 11/13/2016 based on other log entries it looks like this happened on initial setup of windows when all the drivers were being installed.
 
Update: the errors have now stopped being issued. Customer needed the machine so I returned it to her and I'll check on the status in a week or two.
 
All hard drive manufacturers have software you can download to check their drives for failures. My favorite, which I use on all brand drives, is Western Digital's "Data Lifeguard Diagnostics", though I haven't updated it in a few years and the name does change every now and then. A thorough scan can take hours but its...well, thorough. As an added bonus I can also write zeroes to the drive. Just the first and last million bytes if I just want to "clear it" quickly rather than go through the trouble of checking for viruses, deleting partitions, etc. or, if the customer is willing to pay a little bit for my time, the entire drive to make the data unrecoverable.
 
nlinecomputers said:
That's fine but you ought to verify that with tools you do use like Crystal Disk Info.
Click to expand...

Again, please read my original post...

Haole Boy said:
After seeing this, I created a full disk image using ddrescue.
- ddrescue copied all sectors with no errors.
- SMART shows no problems (and yes, I know that SMART is not a reliable indicator of disk problems).
- This is a WD drive, so I ran Data Lifeguard Diagnostics both short and long tests and both passed
...
Click to expand...
 
You must log in or register to reply here.

Similar threads

timeshifter
Which drive is \Device\Harddisk1\DR1 - here's an easy way to find out
Replies
2
Views
831
Markverhyden
Markverhyden
H
Using ddrescue on a Mac
Replies
10
Views
8K
Haole Boy
H
H
EventID 153
Replies
5
Views
948
sapphirescales
sapphirescales
H
Corrupted macOS hard drive
Replies
15
Views
4K
Markverhyden
Markverhyden
H
Number of Reported Uncorrectable Errors does not match SMART
2
Replies
20
Views
8K
Joep
Joep
Back
Top