NTFS – Autochk: file system check occurred on startup

Product: Windows Operating System
Event ID: 1001
Source: Winlogon
Version: 5.2.3790.1830
Message: NTFS – Autochk: file system check occurred on startup

Microsoft® Windows® encountered corrupted file-system metadata during the last Windows session, so Windows marked the file system as “dirty” (corrupt). Windows ran the chkdsk /f command during startup in an attempt to repair the corrupted file system metadata.

Related Events

Chkdsk: Event ID 26180Chkdsk: Event ID 1066


The file system might have been marked as “dirty” (corrupt) for one of the following reasons:

  • I/O requests that were issued by the file system to the disk subsystem might not have been completed successfully.
  • The operating system was shut down incorrectly. If the volume is formatted with the FAT file system, an incorrect shutdown of Windows will always cause this event (Event ID 1001). FAT is not a journaling file system. In order to maintain metadata consistency, FAT requires the operating system to be shut down properly. An incorrect shutdown (for example, a power failure) forces Windows to run chkdsk in order to ensure that the file-system metadata is consistent.If the volume is formatted with the NTFS file system, running chkdsk is not normally necessary. NTFS is a journaling file system and does not usually require chkdsk to ensure metadata consistency. However, NTFS depends upon the media to guarantee its write-through semantics. If the media does not accept write-through semantics, inconsistencies in the file-system metadata might occur when there is a sudden loss of power or a system failure.
  • The media (hard disk) might have developed bad sectors.
User Action

This message is provided to inform you that the chkdsk command was run on the file system. No actions are required, but the corrupted disk might indicate other disk problems. You should do the following:

  • Review the application log and the system log in Event Viewer for additional errors. Event ID 1066 contains the detailed chkdsk log. You should review the chkdsk log to see what problems (if any) chkdsk found on the volume and what fixes (if any) were made.
  • Check related hardware and devices on the shared bus to ensure that the cables are connected and that the hardware and devices are properly terminated.
  • Avoid improper shutdowns. If the volume is formatted with the FAT file system, you can usually avoid Event ID 1001 by properly shutting down Windows.If Event ID 1001 occurs frequently for an NTFS volume (or for a FAT volume, despite proper shutdowns), it is likely that the disk has developed bad sectors. Run chkdsk /r to locate bad sectors on the hard disk.

Related Resources

For more information about chkdsk, see Knowledge Base article 187941, “An Explanation of CHKDSK and the New /C and /I Switches,” at http://go.microsoft.com/fwlink/?LinkId=25770.


Leave a Reply