> For the complete documentation index, see [llms.txt](https://docs.eazybackup.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.eazybackup.com/troubleshooting/how-to-identify-disk-read-write-errors-and-failing-disks-in-windows.md). # How to identify disk read/write errors and failing disks in Windows If a backup job reports read errors, I/O errors, corrupted files, or unusually slow disk access, Windows may have recorded additional information about the affected storage device in the Windows Event Log. Disk-related errors do not always mean that the physical disk itself has failed. Similar errors can be caused by a failing disk, bad sectors, a damaged cable, USB/SAS/SATA connection problems, a storage controller or HBA, an enclosure or backplane, storage firmware or drivers, or filesystem corruption. ### Check the Windows System Event Log Some useful Windows storage-related Event IDs include: | Event ID | What it generally means | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **7** | Windows encountered a bad block on the device. Repeated Event ID 7 errors are a strong indication that the affected storage device should be investigated. | | **11** | A controller or I/O-path error occurred while communicating with the device. Possible causes include the disk, cable, controller/HBA, enclosure, connection, firmware or driver. | | **51** | Windows detected an error while performing a disk I/O operation. Despite the wording "during a paging operation", this event can also occur during normal buffered file reads and writes. | | **55** | Filesystem corruption was detected. | | **98** | Windows determined that the volume requires an offline CHKDSK repair. | | **129** | Windows reset a storage device or storage path after an I/O request timed out. | | **153** | An I/O operation had to be retried. Repeated events can indicate a slow, unreliable or overloaded storage subsystem. | | **154** | An I/O operation failed because of a hardware error. | | **157** | Windows unexpectedly lost communication with a disk ("surprise removed"). This can be caused by a disk failure or a problem elsewhere in the storage path. | A single event does not necessarily prove that a disk is failing. Repeated errors, particularly Event IDs 7, 129, 153 or 154, should be investigated. ### Quickly find disk errors with PowerShell Open **PowerShell as Administrator** and run: `Get-WinEvent -FilterHashtable @{LogName='System'; ID=@(7,11,51,55,98,129,153,154,157); StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue | Select-Object TimeCreated,Id,LevelDisplayName,ProviderName,Message | Format-List` This displays matching storage-related events recorded during the previous 30 days. To search the entire available System event log instead, remove: `StartTime=(Get-Date).AddDays(-30)` Pay particular attention to the device or disk number shown in the event message. For example: `The device, \Device\Harddisk3\DR3, has a bad block.` or: `The IO operation at logical block address ... for Disk 3 was retried.` You can compare the disk number with the physical disks detected by Windows. Run: `Get-Disk | Select-Object Number,FriendlyName,SerialNumber,HealthStatus,OperationalStatus,Size | Format-Table -AutoSize` This can help determine which physical disk corresponds to the disk number reported in Event Viewer. > Disk information reported by Windows may be incomplete when disks are located behind some RAID controllers, HBAs, SANs, USB bridges or virtual storage systems. ### Check disk health information You can also ask Windows for the health information it has available for installed physical disks: `Get-PhysicalDisk | Select-Object FriendlyName,SerialNumber,MediaType,HealthStatus,OperationalStatus | Format-Table -AutoSize` A drive reporting `Healthy` is not guaranteed to be physically healthy. Some disk controllers and storage adapters do not expose complete SMART or device-health information to Windows. If Windows is reporting disk I/O errors but the drive appears healthy, additional manufacturer diagnostics may be required. ### Performance Monitor Windows Performance Monitor can help determine whether a disk is experiencing unusually high latency, but Performance Monitor does **not** directly identify disk read errors. High values for: `Disk Reads/sec` or: `Disk Read Bytes/sec` normally indicate that the disk is busy. They do not by themselves indicate a failing disk. For troubleshooting storage performance, more useful counters include: `PhysicalDisk(*)\Avg. Disk sec/Read` `PhysicalDisk(*)\Avg. Disk sec/Write` Sustained high latency can indicate an overloaded, slow or problematic storage subsystem, but it should be considered together with Windows Event Log errors and disk-health information. ### Check the filesystem with CHKDSK Windows includes the `chkdsk` utility for checking filesystem integrity. Before running CHKDSK on a disk that may be physically failing, make sure important data is backed up or recovered whenever possible. A lengthy disk scan can place additional load on a failing device. A read-only check can normally be started with: `chkdsk D:` Replace `D:` with the volume you want to check. To locate bad sectors and attempt to recover readable information, run: `chkdsk D: /r` The `/r` option includes `/f`. It checks the filesystem, scans for bad sectors and attempts to recover readable information. CHKDSK can repair filesystem problems and prevent Windows from using clusters that have been identified as bad, but it cannot repair a physically failing hard drive or SSD. If you run CHKDSK against the Windows system volume, Windows may ask: `Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)` Enter `Y` and restart the computer if you want the check to run during startup. Depending on the size, speed and condition of the disk, a `/r` scan can take a considerable amount of time. ### View CHKDSK results Windows records CHKDSK results in the **Application** event log. To display recent CHKDSK results using PowerShell: `Get-WinEvent -FilterHashtable @{LogName='Application'} -ErrorAction SilentlyContinue | Where-Object {$_.ProviderName -match 'Chkdsk|Wininit'} | Select-Object -First 10 TimeCreated,ProviderName,Message | Format-List` You can also view these events manually: **Event Viewer → Windows Logs → Application → Filter Current Log** Select the event sources: `Chkdsk` and: `Wininit` ### Third-party and manufacturer disk diagnostics If Windows reports disk I/O problems, additional disk-health testing can be useful. Common diagnostic tools include: * **CrystalDiskInfo** — displays SMART and NVMe health information for many HDDs and SSDs. * **SeaTools** — Seagate's disk diagnostic utility. * **Manufacturer-specific SSD/HDD diagnostic software** — useful for retrieving detailed SMART, NVMe health and firmware information. * **smartmontools / smartctl** — an advanced tool for retrieving SMART and NVMe health information. SMART information is particularly useful for checking attributes such as reallocated sectors, pending sectors, uncorrectable errors, media errors and overall device health. Keep in mind that RAID controllers, HBAs, USB adapters and virtualized storage may prevent diagnostic tools from communicating directly with the underlying disk. ### What to do if errors are found A disk showing repeated bad-block or hardware I/O errors should not be considered reliable simply because CHKDSK completes successfully. If Windows repeatedly reports bad blocks, hardware I/O failures or storage resets: 1. Make sure important data is backed up. 2. Identify the physical disk associated with the error. 3. Check the disk's SMART or NVMe health information. 4. Check cables, connections, enclosures, HBAs and storage controllers where applicable. 5. Run the disk manufacturer's diagnostic tests. 6. Replace the disk if hardware errors continue or the manufacturer's diagnostics indicate a problem. Backup jobs often perform sustained reads across large portions of a disk and can expose previously unnoticed problems with the underlying storage device.