Re: Tutorial creating & using Hirens Boot CD & MemTest86 diagnostic stress testing tools for USB boot to Windows 10 PE & WinXPmini on BIOS & UEFI

On Sat, 12 Sep 2020 20:17:31 -0000 (UTC), Arlen Holder wrote:

> Neat. I forgot about that command for the hardware testing tutorial!
> o I'm gonna add your suggested cut-&-paste one liner:
> 
> o Win+R > %comspec% /k chkdsk C: /r {control+shift+enter}
>    The type of the file system is NTFS.
>    Cannot lock current drive.
>    Chkdsk cannot run because the volume is in use by another
>    process.  Would you like to schedule this volume to be
>    checked the next time the system restarts? (Y/N) y
>    This volume will be checked the next time the system restarts.

Hmmmmmmmmmmmmmmm

So I ran the check disk as a user as follows:
o Win+R > %comspec% /k chkdsk C: /r {control+shift+enter}

Note: I never use "cortana search" (never never never never!).

Then I booted and watched it for a while, but of course, it's boring:
o <https://i.postimg.cc/rm0zHSGT/bsod108.jpg>

I left chkdsk to do its four stages, which took about a half hour:
o Stage 1 ¡V verifying files;
o Stage 2 ¡V verifying indexes;
o Stage 3 ¡V verifying security descriptors;
o Stage 4 ¡V verifying Usn Journal and sectors.

Coming back to a login.
o Now what?

Where's the check disk log file anyway?
o Googling, I find it's a common question... 

The first thing you're supposed to check, supposedly, is:
o Win+R > control > View by: Category
  System and Security > Security and Maintenance > Maintenance > 
  Drive Status
  You're looking for "All drives are working properly" of course. 
o <https://i.postimg.cc/GpdzP63J/bsod113.jpg>

One way to view the check disk log is have powershell create it:
o <https://i.postimg.cc/Cx8W1dFN/bsod110.jpg>

o Win+R > powershell {control+shift+enter}
  $path = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
  $UserDesktop = (Get-ItemProperty -Path $path -Name "Desktop").Desktop
  get-winevent -ProviderName "ChkDsk" | fl timecreated, message | out-file "$UserDesktop\ChkDskResults.txt"
  get-winevent -FilterHashTable @{logname="Application"}| ?{$_.providername -match "wininit"} | fl timecreated, message | out-file "$UserDesktop\ChkDskResults.txt" -append

Another way to view the check disk log is the event viewer:
o <https://i.postimg.cc/KY7fgm0S/bsod109.jpg>

Open the Event Viewer
o Win+R > eventvwr 
  Event Viewer (Local} > Windows Logs > Application > 
  (Scroll down to see "Wininit (Windows Initialization)"

   Checking file system on C: 
   The type of the file system is NTFS. 
   Volume label is foobar. 
   A disk check has been scheduled. 
   Windows will now check the disk. 

   Stage 1: Examining basic file system structure ... 
   270080 file records processed. 
   File verification completed. 
   Phase duration (File record verification): 6.55 seconds. 
   6980 large file records processed. 
   Phase duration (Orphan file record recovery): 0.00 milliseconds. 
   0 bad file records processed. 
   Phase duration (Bad file record checking): 1.90 milliseconds. 

   Stage 2: Examining file name linkage ... 
   1040 reparse records processed. 
   365912 index entries processed. 
   Index verification completed. 
   Phase duration (Index verification): 1.26 minutes. 
   0 unindexed files scanned. 
   Phase duration (Orphan reconnection): 299.97 milliseconds. 
   0 unindexed files recovered to lost and found. 
   Phase duration (Orphan recovery to lost and found): 1.21 seconds. 
   1040 reparse records processed. 
   Phase duration (Reparse point and Object ID verification): 10.31 milliseconds. 

   Stage 3: Examining security descriptors ... 
   Cleaning up 4196 unused index entries from index $SII of file 0x9.
   Cleaning up 4196 unused index entries from index $SDH of file 0x9.
   Cleaning up 4196 unused security descriptors. 
   Security descriptor verification completed. 
   Phase duration (Security descriptor verification): 233.36 milliseconds. 
   47917 data files processed. 
   Phase duration (Data attribute verification): 1.95 milliseconds. 
   CHKDSK is verifying Usn Journal... 
   36184984 USN bytes processed. 
   Usn Journal verification completed. 
   Phase duration (USN journal verification): 383.78 milliseconds. 

   Stage 4: Looking for bad clusters in user file data ... 
   270064 files processed. 
   File data verification completed. 
   Phase duration (User file recovery): 32.53 minutes. 

   Stage 5: Looking for bad, free clusters ... 204496592 free clusters processed. 
   Free space verification is complete. 
   Phase duration (Free space recovery): 0.00 milliseconds.
   Windows has scanned the file system and found no problems. 
   No further action is required. 

   976708607 KB total disk space. 
   158175452 KB in 214336 files. 
   139824 KB in 47918 indexes. 
   0 KB in bad sectors. 
   406959 KB in use by the system. 
   65536 KB occupied by the log file. 
   817986372 KB available on disk. 
   4096 bytes in each allocation unit. 
   244177151 total allocation units on disk. 
   204496593 allocation units available on disk.
 
   Total duration: 33.95 minutes (2037596 ms). 
   Internal Info: (a bunch of numbers)
   Windows has finished checking your disk. 
   Please wait while your computer restarts. 

An easier way to _find_ the log is to filter events:
o <https://i.postimg.cc/3wcrrQHp/bsod112.jpg>

To filter by events, Rightclick on:
 Event Viewer (Local) > Windows Logs > Application
 Select "Filter Current Log"
 In the Event sources dropdown, check
  [x]Chkdsk
  [x]Winit
  [OK]

You can also spit out the last few event viewer logs:
Get-EventLog -LogName Application -Source chkdsk | Select-Object -Last 5 -Property TimeGenerated,Message | Format-Table -Wrap| out-file "$env:userprofile\Desktop\CHKDSK_SCANS.txt"

There is apparently also wevtutil but I couldn't get it to work.
o wevtutil epl [Application/System/Security/etc] [savepath&filename]
<https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil>

Also there's a task scheduler option for check disk:
o <https://i.postimg.cc/QMGpNTYN/bsod114.jpg>
o Win+R > taskschd.msc
  Task Scheduler (Local) > Task Scheduler Library
  Microsoft > Windows > Chkdsk > ProactiveScan

<http://woshub.com/view-check-disk-chkdsk-results-in-windows-10/>
Note: "chkdsk C: /F /R" is probably what I should have run
      because that will "fix" the bad sectors, or maybe even
      "chkdsk C: /F /R /X" to unmount it first, or, 
      "chkdsk C: /f /offlinescanandfix" to check it offline.

Note: I could also have run a "Storage Diagnostic Tool" test:
      stordiag.exe -collectEtw -checkfsconsistency -out %userprofile%\desktop

Note: There's also a check disk equivalent in powershell:
      Repair-Volume ¡Vdriveletter C ¡Vscan
      Repair-Volume ¡Vdriveletter C ¡Vofflinescanandfix
      Repair-volume ¡Vdriveletter E ¡Vspotfix	
      Repair-Volume -DriveLetter EHI ¡VSpotFix
      You can even scan drives on remote computers:
      Repair-Volume ¡Vdriverletter c -scan ¡Vcimsession ny-fs01,ny-fs02,ny-dc01
      And you can scan SMART status of HDD using "cmdlets"
      Get-PhysicalDisk | Sort Size | FT FriendlyName, Size, MediaType,SpindleSpeed, HealthStatus, OperationalStatus -AutoSize