????

Your IP : 18.223.172.41

Current Path : C:/Windows/System32/drivers/en-US/
Upload File :
Current File : C:/Windows/System32/drivers/en-US/ntfs.sys.mui

MZ����@���	�!�L�!This program cannot be run in DOS mode.

$��<߱�R���R���R�U�����R�U�P���R�Rich��R�PEL�!d

���@  a8.rdata�@@.rsrcp b@@W!�f
T88W!�f$��8.rdata8x.rdata$zzzdbg �.rsrc$01� 8`.rsrc$02 �S�:��G��2����f7��ͱW!�f��(�@�X�p�����	�	�	�� ���!�[��}��MUI���WfO�?2-D�s
|��+۔��p���.e�@���MUIen-USd77���X$�l�  P    <0 0 @ @ 0P P �` ` Hp p D� � �� � x� � � � � 4"� � �#� � (&� � �'� � ,)!!P,!!�/ ! !h10!0!�3@@�5@@8PP<8�a�a�:�a�aE�e�e�F�e�eG�e�etH�e�e�H�e�e4J�e�e�J�e�eKff�K�g�g$Lxi�i�L�ij�[ j�j���bb8 ��d ��t#���'��,+��\6`8�8�811�811911@9$@'@p9PP�;qq <qqD<(�(�l<2�2�L=����(?����4@����pA��LF�
�dFd�d��Z�����Z����^�����d�����j����؞����ԡ����L������,�1�x�����̬�������h�
�
�������\������,�,���/�1������������������� ����� ����������������!����`)�����.�����3)�*��77�7��9�����:����<ѐ�(>�A corruption was discovered in the file system structure on volume %1.%n%n%8

�The file system structure on volume %2 has now been repaired.

�The file system structure on volume %2 cannot be corrected.%nPlease run the chkdsk utility on the volume %2.

�Too many repair events have occurred in a short period of time.%nTemporarily suspending posting of further repair events.

hSkipped posting of %1 repair events.  Repair event posting will now be resumed.%n

Here are the skipped posting repair events count by repair verbs:%n

BadFRS:            %2%n

OrphanChildFRS:    %3%n

BadClusters:       %4%n

BadFreeClusters:   %5%n

CrossLink:         %6%n

SDEntry:           %7%n

InvalidSecurityId: %8%n

IndexAttribute:    %9%n

IndexSubtree:      %10%n

IndexOffset:       %11%n

IndexEntry:        %12%n

IndexOrder:        %13%n

Connect:           %14%n

BreakCycle:        %15%n

FRSAllocate:       %16%n

Others:            %17%n

No-Op

,Force Full Chkdsk

4Force Proactive Scan

Bad FRS

,Orphan Child FRS

$Bad Clusters

,Bad Free Clusters

 Cross-Link

SD Entry

0Invalid Security Id

(Index Attribute

$Index Subtree

$Index Offset

 Index Entry

 Index Order

Connect

 Break Cycle

$FRS Allocate

 Index Sort

 Index Cycle

0File System Driver

,Proactive Scanner

,User Application

,Read Only Volume

 Self Healed

LSpot Corruption Handling Disabled

PSpot Verifier Bypassed On Critical

HSpot Verifier Bypassed On Error

0Sent To Spot Fixer

HSpot Fixer Bypassed On Critical

DSpot Fixer Bypassed On Error

Duplicate

Malformed

 Unsupported

Verified

(False Positive

 Superseded

Purged

 Pseudo Verb

4Unexpected Corruption

4Volume Not Available

 Maintenance

Normal

Critical

H<unable to determine file name>

�The exact nature of the corruption is unknown.  The file system structures need to be scanned and fixed offline.

�The exact nature of the corruption is unknown.  The file system structures need to be scanned online.

 The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".

TThe Master File Table (MFT) contains a child file record segment that is not reachable from its base file record segment.  The file reference number is 0x%1!0I64x!.

�A bad cluster was discovered while accessing file data.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The extent containing the bad cluster is located at Vcn 0x%3!0I64x!, Lcn 0x%4!0I64x!.

�A bad cluster was discovered outside of any existing file on the volume.  The bad cluster is located at Lcn 0x%1!0I64x!.

\Two files were found to occupy the same location on the volume.  The owning file reference number is 0x%1!0I64x!.  The name of the owning file is "%2!wZ!".  The owning extent containing the bad cluster is located at Vcn 0x%3!0I64x!, Lcn 0x%4!0I64x!.  The crossing file reference number is 0x%5!0I64x!.  The name of the crossing file is "%6!wZ!".  The crossing extent containing the bad cluster is located at Vcn 0x%7!0I64x!.

�A corruption was found in the security descriptor stream.  The corrupted entry is at offset 0x%1!I64x!.

LA file was found to have a security ID that is not described in the security file.  The invalid security ID is 0x%1!lx!.  The file reference number is 0x%2!0I64x!.  The name of the file is "%3!wZ!".  There may be additional files on the volume that also refer to this invalid security ID.

pA corruption was found in a file system index structure.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The corrupted index attribute is "%3!wZ!".

pA corruption was found in a file system index structure.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The corrupted index attribute is "%3!wZ!".

�A corruption was found in a file system index structure.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The corrupted index attribute is "%3!wZ!".  The corrupted index block is located at Vcn 0x%4!0I64x!, Lcn 0x%5!0I64x!.  The corruption begins at offset %6!lu! within the index block.

pA corruption was found in a file system index structure.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The corrupted index attribute is "%3!wZ!".

�A file system index structure contains entries that violate ordering rules.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The corrupted index attribute is "%3!wZ!".

$A file on the volume is no longer reachable from its parent directory.  The parent file reference number is 0x%1!0I64x!.  The name of the parent directory is "%2!wZ!".  The parent index attribute is "%3!wZ!".  The file reference number of the file that needs to be reconnected is 0x%4!0I64x!.  There may be additional files on the volume that also need to be reconnected to this parent directory.

4A cycle was found in the directory hierarchy on the volume, which can only be fixed by severing a parent-child relationship.  The parent file reference number is 0x%1!0I64x!.  The name of the parent directory is "%2!wZ!".  The child file reference number is 0x%3!0I64x!.  The name of the child directory is "%4!wZ!".  There may be additional directories on the volume that also participate in this cycle.

�A cluster was found to be used by a file but not marked as used in the volume bitmap.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The unallocated cluster is located at Vcn 0x%3!0I64x!, Lcn 0x%4!0I64x!.

dA file system index structure contains entries that violate ordering rules.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The corrupted index attribute is "%3!wZ!".  The corrupted subtree is rooted at entry number %4!lu! of the index block located at Vcn 0x%5!0I64x!.

$A file system index structure contains a cycle.  The file reference number is 0x%1!0I64x!.  The name of the file is "%2!wZ!".  The corrupted index attribute is "%3!wZ!".  The cycle includes %4!lu! index blocks starting at Vcn 0x%5!0I64x! and ending at Vcn 0x%6!0I64x!.

$UNUSED

4$STANDARD_INFORMATION

($ATTRIBUTE_LIST

 $FILE_NAME

 $OBJECT_ID

4$SECURITY_DESCRIPTOR

$$VOLUME_NAME

0$VOLUME_INFORMATION

$DATA

 $INDEX_ROOT

,$INDEX_ALLOCATION

$BITMAP

($REPARSE_POINT

($EA_INFORMATION

$EA

8$LOGGED_UTILITY_STREAM

�The file size is 0x%1!0I64x!. The maximum size for the volume is 0x%2!0I64x!.

�The bitmap size is 0x%1!0I64x!. The system limit is 0x%2!0I64x!.

�The USN journal size is 0x%1!0I64x!. The system limit is 0x%2!0I64x!.

�The file size is 0x%1!0I64x!. The system limit is 0x%2!0I64x!.

dClearing the in use bit for file record 0x%1.

pRepairing the sequence number for file record 0x%1.

pRepairing the first free byte for file record 0x%1.

pRepairing the segment number for file record 0x%1.

pRepairing the file attributes for file record 0x%1.

�Deleting attribute of type code 0x%1 and instance tag 0x%2

for file record 0x%3.

\Repairing the flags for file record 0x%1.

|Adding attribute of type code 0x%1 for file record 0x%2.

\Start repair on %2/%3/%1 at %4:%5:%6:%7%

TEnd repair on %2/%3/%1 at %4:%5:%6:%7

hMarked file record %1 as in use in MFT bitmap.

�Security Id 0x%2 is invalid in file record segment 0x%1.

It will be replaced with an administrator only Security Id.

�Marked %5 clusters in attribute %4 of type code 0x%2 and instance tag 0x%3

as in use by file 0x%1 in the volume bitmap.

xProcessing repair verb BadFrs: 0x%1

Flags: 0x%2, 0x%3

�Processing repair verb InvalidSid: 0x%1, 0x%2, 0x%3,,, 0x%4

Flags: 0x%5, 0x%6

�Processing repair verb FrsAllocate: 0x%1, 0x%2, "%3", 0x%4, 0x%5, 0x%6

Flags: 0x%7, 0x%8

�Processing repair verb Connect: 0x%1, "%2", 0x%3, 0x%4, 0x%5,,, 0x%6

Flags: 0x%7, 0x%8

�Processing repair verb IndexEntry: 0x%1, "%2", "%3"

Flags: 0x%4, 0x%5

�Processing repair verb OrphanChildFrs: 0x%1, 0x%2,,, 0x%3

Flags: 0x%4, 0x%5

�This repair generated too many messages.  %1 messages were skipped.

Swapping attribute of type code 0x%1 and instance tag 0x%2 with

attribute of type code 0x%3 and instance tag 0x%4 for file record 0x%5.

`Deleting corrupt file record segment 0x%1.

`Marking cluster starting at VCN 0x%5 with LCN 0x%6 for 0x%7 clusters in

attribute %4 of type code 0x%2 and instance tag 0x%3

as in use by file 0x%1 in the volume bitmap.

XCorrecting a minor error in file 0x%1.

hMarking cluster starting at VCN 0x%5 with LCN 0x%6 for 0x%7 clusters in

attribute %4 of type code 0x%2 and instance tag 0x%3

as not in use by file 0x%1 in the volume bitmap.

pDeleting index entry %3 in index 0x%2 of file 0x%1.

tDeleting an index entry from index 0x%2 of file 0x%1.

|Inserting an index entry %3 into index 0x%2 of file 0x%1.

�Inserting an index entry with Id 0x%3 into index 0x%2 of file 0x%1.

�Change file name flags from 0x%3 to 0x%4 for

file name instance 0x%2 in file 0x%1.

�Volume has 0x%1 file record segments which is more than 32 bits.

|The file name index present bit is not set for file 0x%1.

tThe view index present bit is not set for file 0x%1.

dThe system file bit is not set for file 0x%1.

XThe %2 index is missing from file 0x%1.

�EA Information is incorrect.

                 Actual          On Disk

PackedEaSize      0x%1            0x%4

NeedEaCount       0x%2            0x%5

UnpackedEaSize    0x%3            0x%6

,The EA INFORMATION attribute is not consistency with the EA DATA attribute

for file 0x%1.  EA INFORMATION equals 0x%2 while EA DATA equals 0x%3.

lThe EA INFORMATION is not readable for file 0x%1.

�The EA INFORMATION size, 0x%2, in file 0x%1 is incorrect.

The expected size is 0x%3.

`The EA DATA is not readable for file 0x%1.

�The EA DATA size, 0x%2, in file 0x%1 is incorrect.

The expected size is 0x%3.

%1%2

�Corrupt EA set for file 0x%1.  The remaining length, 0x%2,

is too small.

�Corrupt EA set for file 0x%1.  The unpacked total length, 0x%2,

is larger than the total data length, 0x%3.

�Corrupt EA set for file 0x%1.  The EA name is of length 0x%2.

�Corrupt EA set for file 0x%1.  The unpacked length, 0x%2,

is not the same as the record length, 0x%3.

�The EA Information value length, 0x%1, in file 0x%2 is incorrect.

�The EA total packed length, 0x%2, is too large in file 0x%1.

�The second MFT starting LCN in the boot sector is incorrect.

The actual value is 0x%2 while the expected value is 0x%1.

�The reparse point length, 0x%1, has exceeded a maximum of 0x%2.

�The reparse point length, 0x%1, is less than a minimum of 0x%2.

\Unable to read reparse point data buffer.

�Only 0x%1 bytes returned from a read of 0x%d bytes

of the reparse data buffer.

�ReparseDataLength, 0x%1, inconsistence with the attribute length 0x%2.

TReparse Tag, 0x%1, is a reserved tag.

`File 0x%1 has bad reparse point attribute.

�Both reparse point and EA INFORMATION attributes exist in file 0x%1.

�The attribute definition table length, 0x%1, is not divisible by 0x%2.

|Unable to find child frs 0x%1 with sequence number 0x%2.

�Unable to locate attribute of type 0x%1, lowest vcn 0x%2,

instance tag 0x%3 in file 0x%4.

�The is an attribute list attribute within the attribute list in file 0x%1.

�The lowest vcn, 0x%2, is not zero for attribute of type 0x%1

and instance tag 0x%3 in file 0x%4.

�The lowest vcn, 0x%2, is not zero for attribute of type 0x%1

in file 0x%3.

�The first attribute of type 0x%1 and instance tag 0x%2

in file 0x%3 should not be resident.

�The attribute of type 0x%1 and instance tag 0x%2

in file 0x%3 should not be resident.

�The attributes with instance tags 0x%2 and 0x%4 have different

type codes 0x%1 and 0x%3 respectively in file 0x%5.

DThe attributes with same type code 0x%1 but different instance tags

0x%2 and 0x%4 have non-contiguous VCN numbers 0x%3 and 0x%5

respectively in file 0x%6.

$The attributes with same type code 0x%1 but different instance tags

0x%2 and 0x%4 have different names %3 and %5

respectively in file 0x%6.

�The attribute of type 0x%1 and instance tag 0x%2 in file 0x%5

has allocated length of 0x%3 instead of 0x%4.

�The attribute of type 0x%1 in file 0x%4 has allocated length

of 0x%2 instead of 0x%3.

�The file attributes flag 0x%1 in file 0x%3 is incorrect.

The expected value is 0x%2.

pThe sequence number 0x%1 in file 0x%2 is incorrect.

The total allocated size 0x%3 of attribute of type 0x%1 and instance

tag 0x%2 in file 0x%5 is incorrect.  The expected value is %4.

�Read failure with status 0x%1 at offset 0x%2 for 0x%3 bytes.

�Incorrect read at offset 0x%1 for 0x%3 bytes but got 0x%2 bytes.

�Write failure with status 0x%1 at offset 0x%2 for 0x%3 bytes.

�Incorrect write at offset 0x%1 for 0x%3 bytes but wrote 0x%2 bytes.

�The data written out is different from what is being read back

at offset 0x%1 for 0x%2 bytes.

�The file 0x%1 belongs to parent 0x%3 but got 0x%2 as parent.

tThe file 0x%1 has file name %2 when it should be %3.

�The multi-sector header with total size 0x%1, USA offset 0x%2,

and USA count 0x%3 is incorrect.

�The USA check value, 0x%2, at block 0x%1 is incorrect.

The expected value is 0x%3.

�Unable to query LCN from VCN 0x%2 for attribute of type 0x%1.

�Attribute record of type 0x%1 and instance tag 0x%2 is cross linked

starting at 0x%3 for possibly 0x%4 clusters.

�Attribute record of type 0x%1 is cross linked starting at

cluster 0x%2 for possibly 0x%3 clusters.

�The attribute list in file 0x%1 does not contain

standard information attribute.

�The attribute list in file 0x%1 indicates the standard information

attribute is outside the base file record segment.

`The index root %2 is missing in file 0x%1.

dThe index bitmap %2 is missing in file 0x%1.

hThe index bitmap %2 in file 0x%1 is incorrect.

�The index bitmap %2 is present but there is no corresponding

index allocation attribute in file 0x%1.

�The length, 0x%2, of the root index %1 in file 0x%4

is too small.  The minimum length is 0x%3.

�The root index %1 in file 0x%3 is incorrect.

The expected name is %2.

�The collation rule 0x%3 for index root %1 in file 0x%2

is incorrect.  The expected value is 0x%4.

�Breaking the parent 0x%1 and child 0x%2

file relationship.  This also makes the child an orphan.

�The index attribute of type 0x%2 for index root %1

in file 0x%4 is incorrect.  The expected value is 0x%3.

tThe index %1 is not a known quota index in file 0x%2.

|The index %1 is not a known security index in file 0x%2.

�The index attribute of type 0x%2 for index root %1

in file 0x%3 is not recognized.

�The index attribute of type 0x%2 for index root %1

in file 0x%3 is not indexable.

�The bytes per index buffer, 0x%2, for index root %1 in file

0x%4 is incorrect.  The expected value is 0x%3.

�The clusters per index buffer, 0x%2, for index root %1 in file

0x%4 is incorrect.  The expected value is 0x%3.

�The index allocation value length, 0x%2, for index %1 in file

0x%4 is not in multiple of 0x%3.

�The index allocation allocated length, 0x%2, for index %1 in file

0x%4 is not in multiple of 0x%3.

�The first free byte, 0x%2, and bytes available, 0x%3, for

root index %1 in file 0x%4 are not equal.

�The index entry offset, 0x%3, of index %1 and VCN 0x%2

in file 0x%4 is incorrect.

�The index entry offset, 0x%2, of index %1

in file 0x%3 is incorrect.

�The bytes available, 0x%2, in index header for index %1 in file

0x%4 is not equal to 0x%3.

�The index header for index %1 and VCN 0x%2 in file 0x%3

is not marked as index node.

pThe VCN 0x%2 of index %1 in file 0x%3 is incorrect.

�The index bitmap for index %1 in file 0x%2 is invalid or missing.

|The VCN 0x%2 of index %1 in file 0x%3 is already in use.

�The index allocation for index %1 in file 0x%2 is invalid or missing.

�The multi-sector header signature for VCN 0x%2 of index %1

in file 0x%3 is incorrect.

�The USA offset 0x%3 of VCN 0x%2 of index %1

in file 0x%5 is below 0x%4.

�The VCN 0x%2 of index %1 in file 0x%4 is inconsistence with

the VCN 0x%3 stored inside the index buffer.

�The bytes per block, 0x%3, read from index buffer of VCN 0x%2

of index %1 in file 0x%4 is incorrect.

�The USA offset 0x%3 of VCN 0x%2 of index %1

in file 0x%4 is incorrect.

�The USA size 0x%3 of VCN 0x%2 of index %1 in file

0x%5 is incorrect.  The expected value is 0x%4.

�The index header of index %1 in file 0x%2

is marked as index node when it should not.

�The first free byte, 0x%2, in index header of index %1

in file 0x%4 is not equal to 0x%3.

�Unable to query the name of a file name index entry of length 0x%3

of index %2 in file 0x%4 with parent 0x%1.

�Index entry %2 of index 0x%1 points to unused or reused file 0x%3.

�An index entry of index 0x%1 points to unused or reused file 0x%2.

�The file 0x%4 pointed to by index entry %3 of index %2 with

parent file 0x%1 is not a base file record segment.

�The file 0x%3 pointed to by an index entry of index %2 with

parent file 0x%1 is not a base file record segment.

�Unable to locate the file name attribute of index entry %3

of index %2 with parent 0x%1 in file 0x%4.

�Unable to locate the file name attribute of an index entry

of index %2 with parent 0x%1 in file 0x%3.

�The object id index entry in file 0x%1 points to file 0x%2

but the file has no object id in it.

�The object id index entry in file 0x%1 points to file 0x%2

which is not a base file record segment.

�The object id in index entry in file 0x%1 is incorrect.

The entry points to file 0x%2.

�The parent 0x%2 in an object id index entry in file 0x%1

is incorrect.  The correct value is 0x%3.

�The object id in file 0x%2 already existed in the object

id index in file 0x%1.

�The object id in file 0x%2 does not appear in the object

id index in file 0x%1.

�The reparse point index entry in file 0x%1 points to file 0x%2

which is not a base file record segment.

The reparse tag 0x%2 of reparse point index entry in file 0x%1

is incorrect.  The correct reparse tag in file 0x%4 is 0x%3.

�The parent 0x%2 in the reparse point index entry with tag 0x%4

in file 0x%1 is incorrect.  The correct value is 0x%3.

�The reparse point index entry in file 0x%1 points to file 0x%2

but the file has no reparse point in it.

�The reparse point in file 0x%2 does not appear in

the reparse point index in file 0x%1.

�The file name index present bit is set in file 0x%1

but there is no file name index.

tThe root index %2 in file 0x%1 is missing or invalid.

�The index entry length 0x%1 is incorrect.  The maximum value is 0x%2.

�The index entry attribute length 0x%2 of index entry type 0x%1

is incorrect.  The correct length is 0x%3.

�The index entry data offset 0x%1 and length 0x%2 is

inconsistence with the index entry length 0x%3.

�The index entry length is incorrect for index entry type 0x%1.

�The index entry length is too small for index entry type 0x%1.

�The volume information attribute is missing from file 0x%1.

The attribute record length 0x%1 is too small for attribute of

type 0x%3 and instance tag 0x%4.  The minimum value is 0x%2.

�The attribute form code 0x%1 is invalid for attribute of type 0x%2

and instance tag 0x%3.

�The attribute of type 0x%1 and instance tag 0x%2 should be resident.

�The standard information attribute length 0x%1 is incorrect.

The expected value is 0x%2, 0x%3, or 0x%4.

�Attribute name is not allowed for attribute of type 0x%1

and instance tag 0x%2.

�The attribute of type 0x%1 and instance tag 0x%2 should not be resident.

�The attribute name offset for attribute of type 0x%1

and instance tag 0x%2 is incorrect.

�The attribute name for attribute of type 0x%1 and instance tag 0x%2

contains unicode NULL.

tUnknown attribute of type 0x%1 and instance tag 0x%2.

�The attribute of type 0x%1 and instance tag 0x%2 should not be indexed.

�The attribute of type 0x%1 and instance tag 0x%2 should be indexed.

�The indexable attribute of type 0x%1 and instance tag 0x%2

should not have name.

�The attribute of type 0x%1 and instance tag 0x%2 should have a name.

�The attribute length 0x%1 for attribute of type 0x%3 and

instance tag 0x%4 is too small.  The minimum value is 0x%2.

�The attribute length 0x%1 for attribute of type 0x%3 and

instance tag 0x%4 is too big.  The maximum value is 0x%2.

lThe resident attribute for attribute of type 0x%4 and instance

tag 0x%5 is incorrect.  The attribute has value of length 0x%1,

and offset 0x%2.  The attribute length is 0x%3.

�The resident attribute name is colliding with the resident value for attribute

of type 0x%4 and instance tag 0x%5.  The attribute name offset is

0x%2, length 0x%1, and the attribute value offset is 0x%3.

�The mapping pairs offset 0x%1 for attribute of type 0x%3 and instance

tag 0x%4 exceeded the attribute length 0x%2.

�The mapping pairs offset 0x%1 for attribute of type 0x%3 and instance

tag 0x%4 is too small.  The minimum value is 0x%2.

�The attribute name is colliding with the mapping pairs for attribute

of type %4 and instance tag 0x%5.  The attribute name offset is

0x%2, length 0x%1, and the mapping pairs offset is 0x%3.

�The attribute of type 0x%2 and instance tag 0x%3 in file 0x%4

has bad mapping pairs at attribute offset 0x%1.

�Unable to initialize an extent list for attribute type 0x%1 with

instance tag 0x%2.

�The highest VCN 0x%1 of attribute of type 0x%3 and instance

tag 0x%4 is incorrect.  The expected value is 0x%2.

@The non resident attribute of type 0x%4 and instance tag 0x%5 is

inconsistent.  The valid data length is 0x%1, file size 0x%2, and

allocated length 0x%3.

The non resident attribute of type 0x%4 is inconsistent.  The valid data

length is 0x%1, file size 0x%2, and allocated length 0x%3.

�The allocated length 0x%1 is not in multiple of 0x%2 for attribute

of type 0x%3 and instance tag 0x%4.

The file name value length 0x%1 for attribute of type 0x%3 with

instance tag 0x%4 is too small.  The minimum value is 0x%2.

�The attribute of type 0x%2 and instance tag 0x%3 is inconsistence.

The attribute value length is 0x%1.

�The file name length is zero for attribute of type 0x%1

and instance tag 0x%2.

�The file name in file name value in attribute of type 0x%1 and instance

tag %2 contains invalid character.

�The multi-sector header signature in file 0x%1 is incorrect.

�The USA offset 0x%1 in file 0x%3 is too small.

The minimum value is 0x%2.

�The file record segment size 0x%1 is invalid in file 0x%2.

hThe USA offset 0x%1 in file 0x%2 is incorrect.

�The USA size 0x%1 in file 0x%3 is incorrect.

The expected value is 0x%2.

�The first attribute offset 0x%1 in file 0x%2 is incorrect.

�The bytes available, 0x%1, in the file record segment header for

file 0x%3 is incorrect.  The expected value is 0x%2.

�The instance tag 0x%2 of attribute of type 0x%1 in file 0x%3

is already in use.

�The instance tag 0x%2 of attribute of type 0x%1 in file 0x%4

is too large.  The instance tag should be less than 0x%3.

�The standard information attribute in file 0x%1 is missing.

The attribute record offset 0x%1 is too large for attribute of type 0x%3

and instance tag 0x%4 in file 0x%5.  The maximum value is 0x%2.

�The record length of attribute of type 0x%1 and instance tag 0x%2

in file 0x%3 should not be zero.

�The record length 0x%1 of attribute of type 0x%2 and

instance tag 0x%3 in file 0x%4 is not aligned.

The record length 0x%1 is too large for attribute of type 0x%3

and instance tag 0x%4 in file 0x%5.  The maximum value is 0x%2.

0The first free byte, 0x%1, in file 0x%4 is incorrect.  The number of

bytes free in the file record segment is 0x%2 and the total length

is 0x%3.

The attribute of type 0x%1 and instance tag 0x%2 should be after

attribute of type 0x%3 and instance tag 0x%4 in file 0x%5.

�All attribute of type 0x%1 and instance tag 0x%2 should be indexed

in file 0x%5.

�Two identical attributes of type 0x%1 and instance tag 0x%2 are

in file 0x%3.

�The file name index present bit in file 0x%1 should not be set.

�The sparse flag in the standard information attribute in file 0x%1

is not set.

�The sparse flag in the standard information attribute in file 0x%1

should not be set.

�The old encrypted flag is being replaced by the new encrypted flag

in file 0x%1.

�The encrypted flag in standard information attribute in file 0x%1

is not set.

�The reparse flag in standard information attribute in file 0x%1

is not set.

�The reparse flag in standard information attribute in file 0x%1

should not be set.

�There are more than one NTFS file name attribute in file 0x%1.

The file name attributes in file 0x%3 has different parents.

The DOS name has 0x%1 as parent.  The NTFS name has 0x%2 as parent.

�There are more than one DOS file name attribute in file 0x%1.

xThe DOS file name attribute in file 0x%1 is incorrect.

pThere is no NTFS file name attribute in file 0x%1.

lThere is no DOS file name attribute in file 0x%1.

�The DOS and NTFS file name attributes in file 0x%1 are identical.

lUnable to setup the attribute list in file 0x%1.

�The attribute type 0x%1 with name %2 in file 0x%3 is missing.

pThe attribute of type 0x%1 in file 0x%2 is missing.

pThe unnamed data attribute in file 0x%1 is missing.

`The attribute list in file 0x%1 is missing.

The length, 0x%3, of the attribute list entry with attribute of type

0x%1 and instance tag 0x%2 in file 0x%4 is not aligned.

�The attribute list entry with attribute of type 0x%1 and instance tag 0x%2

in file 0x%6 is incorrect.  The attribute list entry name length is 0x%3,

and offset 0x%4.  The attribute list length is 0x%5.

LThe attribute name offset 0x%3 of attribute list entry with attribute of

type 0x%1 and instance tag 0x%2 in file 0x%5 is too small.

The minimum value is 0x%4.

�The attribute list length 0x%2 in file 0x%3 is incorrect.

The expected value is 0x%1.

�The extent list of the attribute list is crossed linked at 0x%1

for possibly 0x%2 clusters in file 0x%3.

The attribute list entry with attribute of type 0x%1 and instance tag

0x%2 should be after attribute of type 0x%3 and instance tag 0x%4.

�Two identical attribute list entries of type 0x%1 and instance tag 0x%2

are found.

�The attribute length 0x%3 of attribute of type 0x%1 and name %2 in

file 0x%5 is too small.  The minimum value is 0x%4.

�The sparse flag of attribute of type 0x%1 and name %2 in file

0x%3 is not set.

�The USN Journal offset 0x%1 in file 0x%2 is not at a page boundary.

�The USN Journal length 0x%1 in file 0x%3 is too large.

The maximum value is 0x%2.

�The USN Journal length 0x%1 in file 0x%3 is less than

its offset 0x%2.

�The remaining USN block at offset 0x%1 in file 0x%2 is

less than a page.

�The remaining of an USN page at offset 0x%1 in file 0x%2

should be filled with zeros.

�The USN Journal entry at offset 0x%1 and length 0x%2 crosses

the page boundary.

�The USN Journal entry length 0x%2 at offset 0x%1, in file

0x%4 is larger than the remaining length 0x%3 of a page.

�The USN Journal entry length 0x%2 at offset 0x%1 in file

0x%4 exceeded the page size 0x%3.

�The USN Journal entry length 0x%2 at offset 0x%1 in file

0x%3 is not aligned.

�The USN Journal entry version %2.%3 at offset 0x%1

in file 0x%4 is not recognized.

�The USN Journal entry length 0x%2 at offset 0x%1 in file

0x%4 is too small.  The minimum value is 0x%3.

$The remaining USN page length 0x%2 is too small to fit another

USN Journal entry at offset 0x%1 in file 0x%4.

It needs at least 0x%3 bytes.

�The USN value 0x%1 of USN Journal entry at offset 0x%2

in file 0x%3 is incorrect.

The USN Journal entry at offset 0x%1 in file 0x%4 is not

consistence.  The entry has length of 0x%3 and a file name length of 0x%2.

�The USN Journal length 0x%1 in file 0x%4 is less the

largest USN encountered, 0x%2, plus eight in file 0x%3.

pThe security data stream is missing from file 0x%1.

�The security data stream size 0x%1 should not be less than 0x%2.

�The remaining of a security data stream page starting at offset 0x%1

for 0x%2 bytes contains non-zero.

�The security data stream entry at offset 0x%1 with length 0x%2

crosses the page boundary.

�The length, 0x%2, of the security data stream entry at offset

0x%1 is too small.  The minimum value is 0x%3.

�The length, 0x%2, of the security data stream entry at offset

0x%1 exceeded the page size 0x%3.

The security data stream entry at offset 0x%1 does not fit into the

remaining length, 0x%2, of a page.  The minimum value is 0x%3.



�The security descriptor entry with Id 0x%2 at offset 0x%1 is invalid.

�The security Id 0x%2 of security descriptor entry at offset 0x%1

is a duplicate.

�The hash value 0x%2 of the security descriptor entry with Id

0x%4 at offset 0x%1 is invalid.  The correct value is 0x%3.

The offset 0x%2 stored in the security descriptor entry with Id

0x%4 at offset 0x%1 is invalid.  The correct value is 0x%3.

lThe security descriptor in file 0x%1 is invalid.

dThe security Id 0x%1 in file 0x%2 is invalid.

�The data stream with name %1 in file 0x%2 is not recognized.

�The attribute definition table length 0x%1 is incorrect.

The correct value is 0x%2.

tThe attribute definition table content is incorrect.

�Cluster zero is missing from the data attribute in boot file.

TAttribute list found in the log file.

�The data attribute is either resident or missing in the log file.

�Unable to obtain the LCN in data attribute of the MFT mirror.

�There is no physical LCN for VCN 0 in data attribute of the MFT mirror.

�The data attribute of the MFT mirror is not contiguous for 0x%1 sectors.

\The MFT mirror is different from the MFT.

pThe data attribute is missing from the upcase file.

�The upcase file length 0x%1 is incorrect.  The expected value is 0x%2.

TThe upcase file content is incorrect.

�The data attribute is either resident or missing in the MFT mirror.

�The two index entries of length 0x%1 and 0x%2 are either identical

or appear in the wrong order.

�The first index entry of length 0x%1 is a leaf but it is not in the root.

�The first index entry of length 0x%1 is a leaf but the previous entry is not.

Current leaf index entry of length 0x%3 is at depth 0x%2 which

is different from other leaf index entry which has a depth of 0x%1.

�The down pointer of current index entry with length 0x%1 is invalid.

�The index entry length 0x%1 is too large.  The maximum value is 0x%2.

\The allocation attribute does not exist.

pClearing unused security descriptor stream entries.

�Mirror security descriptor block different from that of

master security descriptor at offset 0x%1.

hThe attribute definition table cannot be read.

�The index buffer at VCN 0x%2 of index %1 in file 0x%3

cannot be read.

�The MFT mirror starting at cluster 0x%1 for 0x%2 sectors

cannot be read.

tThe security descriptor in file 0x%1 cannot be read.

LThe upcase table cannot be read.

�The USN attrib of type code 0x%1 and name %2 cannot be

read in file 0x%3.

�The EA Data value length, 0x%1, in file 0x%2 is incorrect.

�The index entry length 0x%2 for index %1 in file 0x%4

is too large.  The maximum value is 0x%3.

�Unable to query extent list entry 0x%3 from attribute

of type 0x%1 and instance tag 0x%2.

�The total allocated size 0x%1 for attribute of type 0x%3 and

instance tag 0x%4 is larger than the allocated length 0x%2.

�Unable to locate attribute with instance tag 0x%2 and segment

reference 0x%3.  The expected attribute type is 0x%1.

The first index entry offset, 0x%2, for index %1 in file 0x%4

points beyond the length, 0x%3, of the index.  VCN is unknown.

�Some clusters occupied by attribute of type 0x%1 and instance tag 0x%2

in file 0x%3 is already in use.

�Unable to setup the child file record segment 0x%2 in file 0x%1.

�The parent 0x%2 of index entry %3

in file 0x%4 is incorrect.  The expected parent is 0x%1.

�The file reference 0x%3 of an index entry %2 in

parent 0x%1 is not the same as 0x%4.

�The file reference 0x%3 of an index entry of index %2

with parent 0x%1 is not the same as 0x%4.

�Multiple object id index entries in file 0x%1

point to the same file 0x%2.

�The object id index entry in file 0x%1 points to file 0x%2

which is unreadable.

�The object id index entry in file 0x%1 points to file 0x%2

which is not in use.

�The reparse point index entry in file 0x%1 points to file 0x%2

which is not in use.

�The reparse point index entry in file 0x%1 points to file 0x%2

which is unreadable.

�----------------------------------------------------------------------

\Cleaning up instance tags for file 0x%1.

\Cleaning up encrypted flag for file 0x%1.

XCleaning up sparse flag for file 0x%1.

�Cleaning up %3 unused index entries from index %2 of file 0x%1.

`Cleaning up %1 unused security descriptors.

�The value length, 0x%1, of the MFT mirror is too small.

The minimum value is 0x%2.

�The valid data length, 0x%1, of the MFT mirror is too small.

The minimum value is 0x%2.

�Index entry %3 of index %2 in file 0x%1 points to unused file 0x%4.

�An index entry of index %2 in file 0x%1 points to unused file 0x%3.

�Unable to obtain the LCN in data attribute for VCN 0x%1 of the MFT.

�An index entry of index %2 in file 0x%1 points to file 0x%3

which is beyond the MFT.

pThe segment number 0x%1 in file 0x%2 is incorrect.

,

Internal Info:

�The mapping pairs offset 0x%1 for attribute of type 0x%2 and instance

tag 0x%3 is not quad aligned.

xThe NTFS file name attribute in file 0x%1 is incorrect.

�The attribute of type 0x%1 and instance tag 0x%2 has unexpected holes in the extent list.

tThe TxF file name attribute in file 0x%1 is corrupt.

|The $Txf file name attribute in file 0x%1 is a duplicate.

tThe $Txf file name attribute in file 0x%1 is corrupt.

�The $STANDARD_INFORMATION attribute was corrupted for a $Txf directory.

�The $STANDARD_INFORMATION attribute was corrupted for a RM Root directory.

|The TxF file name attribute in file 0x%1 is a duplicate.

\A TxF RM root file reference was corrupt.

�Detected cross linked attribute of type code 0x%1 and instance tag 0x%2

for file record 0x%3.

HFile record 0x%1 maps to "%2".

|The index entry %3 in index 0x%2 of file 0x%1 is missing.

�The parent 0x%1 of file name attribute %2 in file 0x%3 cannot be found.

�The file name flags 0x%1 in index entry %2 of parent 0x%3 is inconsistent

with that in file 0x%4.

�The only attribute in the file 0x%1 is the standard information.

@Failed to enumerate blocks

\Unsupported on thinly provisioned volume

LClaiming persisted memory failed

TAllocating memory for KSR runs failed

TCould not get system address from Mdl

0Invalid KSR version

�Vcb's TotalClusters did not match with KSRData's TotalClusters

TNtfs has detected MFT torn write on a volume.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n

          File reference: %6%n

          File name: %8%n

          Byte offset of the buffer within the file: %9%n

          Byte offset of the torn structure within the buffer: %10%n

          Block index: %11%n

          Expected sequence number: %12%n

          Actual sequence number: %13%n

          FRS file reference: %14%n

          FRS file name: %16%n

          Is child FRS: %17%n

,Volume %1 (%2) %3

The system failed to flush data to the transaction log. Corruption may occur in VolumeId: %2, DeviceName: %4.%n%n

          Failure status: %5%n%n

          Device GUID: %6%n

          Device manufacturer: %8%n

          Device model: %10%n

          Device revision: %12%n

          Device serial number: %14%n

          Bus type: %15%n%n

          Adapter serial number: %17%n

Surprise removal of a persistent memory device with active DAX mappings. This might lead to data corruption.%n%n

          Volume GUID: %4%n

          Volume Name: %6%n

          Volume Label: %8%n%nGuidance:%nA reboot is required to clean up the DAX mappings.

A volume that already has DAX mappings is being mounted. This generally occurs after surprise removal. This might lead to data corruption.%n%n

          Volume GUID: %4%n

          Volume Name: %6%n%nGuidance:%nA reboot is required to clean up the DAX mappings.

�An IO failed with %12 and NTFS has relocated the clusters. The original clusters are now marked as bad and they will not be reused.%nThis may indicate a failing disk.%n%n

          Process Id: %5%n

          Process name: %6%n

          File name: %8%n

          File offset: %9%n

          %11 cluster(s) were marked as bad starting at cluster %10%n%n

          Volume guid: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

The data read from the storage does not match what was previously written or read.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n

          Device name: %7%n

          File reference: %8%n

          File name: %10%n

          Attribute type code: %11%n

          Attribute name: %13%n

          File offset: %14%n

          Volume offset: %15%n

          Length: %16%n

          Called from worker: %17%n

          Livedump worker status: %18%n

,MftBitmap is not big enough for MftData or does not have required allocations.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n

          Device name: %7%n

          Mft data allocation size: %20%n

          Mft data file size: %21%n

          Mft bitmap allocation size: %22%n

          Mft bitmap file size: %23%n

          Bytes per FRS: %24%n

          Mft data attribute allocation size: %25%n

          Mft data attribute file size: %26%n

          Mft bitmap attribute highest Vcn: %27%n

          Mft bitmap attribute allocation size: %28%n

          Mft bitmap attribute file size: %29%n

          Last data and bitmap attribute record in Mft are in same FRS: %30%n

          Called from worker: %31%n

          Livedump worker status: %32%n

          Major function: %33%n

          Minor function: %34%n

          Source tag: %35%n

�Thinly provisioned volume %1 (%2)%nwere not being mapped between clusters %3 and %4.%nIt is now fixed.

,Thinly provisioned volume %1 (%2)%nwere not being mapped between clusters %3 and %4.%nRepair was unsucccessful.%nPossibly out of available slabs.

4Volume Mount/Dismount

 Statistics

,BadClusterHotFix

$Response Time

Info

Start

Stop

Resume

Suspend

hA user hit their quota threshold on volume %2.

`A user hit their quota limit on volume %2.

�The system has started rebuilding the user disk quota information on

device %1 with label "%2".

�The system has successfully rebuilt the user disk quota information on

device %1 with label "%2".

Error

Warning

 Information

$Volume mount

(Volume dismount

�The system has encounted an error rebuilding the user disk quota

information on device %1 with label "%2".

�{Delayed Write Failed}

Windows was unable to save all the data for the file %2. The data has been lost.

This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

The transaction resource manager on volume %2 encountered an error during recovery.  The resource manager will continue recovery.

<The default transaction resource manager on volume %2 encountered an error while starting and its metadata was reset.  The data contains the error code.

�{Delayed Write Failed}

Windows was unable to save all the data for the file %2; the data has been lost.

This error may be caused by network connectivity issues. Please try to save this file elsewhere.

�{Delayed Write Failed}

Windows was unable to save all the data for the file %2; the data has been lost.

This error was returned by the server on which the file exists. Please try to save this file elsewhere.

�{Delayed Write Failed}

Windows was unable to save all the data for the file %2; the data has been lost.

This error may be caused if the device has been removed or the media is write-protected.

System

$RundownStart

(RundownComplete

tRundownVolumeInformation VolumeId: %1, DeviceName: %3

XThe NTFS volume has been successfully mounted.%n%n

          Volume GUID: %4%n

          Volume Name: %6%n

          Volume Label: %8%n

          Device Name: %3%n

�NTFS KSR data retrieved successfully.%n%n

          Volume GUID: %4%n

          Device Name: %3%n%n

          NTFS KSR version: %5%n

          Number of runs restored: %6%n

          Time to restore (ms): %7%n

�NTFS KSR data retrieval failed.%n%n

          Volume GUID: %4%n

          Device Name: %3%n

          Error: %6

�Ntfs has detected torn write on a volume.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n

          File reference: %6%n

          File name: %8%n

          Byte offset of the buffer within the file: %9%n

          Byte offset of the torn structure within the buffer: %10%n

          Block index: %11%n

          Expected sequence number: %12%n

          Actual sequence number: %13%n

�File's duplicate info has been updated during flush.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          File Reference: %4%n

          File Name: %6%n

          File Link name: %8%n

          Parent file reference: %9%n

          Parent file name: %11%n

          Update Reason: [%12] %13%n

0NTFS scanned entire volume bitmap.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n%n

          Device name: %7%n

          Device GUID: %8%n

          Device manufacturer: %10%n

          Device model: %12%n

          Device revision: %14%n

          Device serial number: %16%n

          Bus type: %17%n%n

          Adapter serial number: %19%n%n

          Duration (micro seconds): %20%n

          InputFlags: %21%n

          Reason: %22%n

          Flags: %23%n

NTFS cached runs statistics.%n%n

          Volume correlation Id: %1%n

          Volume name: %2%n

          Volume label: %3%n%n

          Device name: %4%n

          Device GUID: %5%n

          Device manufacturer: %6%n

          Device model: %7%n

          Device revision: %8%n

          Device serial number: %9%n

          Bus type: %10%n%n

          Adapter serial number: %11%n%n

          Media type: %12%n

          Runs cached: %13%n

          Longest run cached: %15%n

          Most populated bin Count: %16%n

          Most populated bin's minimum length: %18%n

          Most populated bin's maximum length: %20%n

hNTFS global corruption action state is now %1.

,The file system structure that maintains security information on volume %1 (%2) has grown excessively large and fragmented.  The structure has reached %3%% of its maximum fragmentation limit.  If the structure continues to grow and reaches this limit, it may not be possible to create new files on this volume.  It is strongly recommended that the volume be taken offline for preventative maintenance.

�An operation failed because the disk was full.%n%n

          Process: %5%n

          Free space in bytes: %7%n

          Total reserved space in bytes: %8%n

          Txf TotalAbortReservation space in bytes: %9%n

          Requested space in bytes: %10%n

          Page file size in bytes: %11%n

          Volume guid: %1%n

          Volume name: %3%n

          Is boot volume: %6%n%nYour disk '%3' is full. Use disk cleanup to free up disk space by deleting unnecessary files. If this is a thinly provisioned volume the physical storage backing this volume may have been exhausted.%n

$Summary of disk space usage, since last event:%n%n

          Lowest free space in bytes: %4%n

          Highest free space in bytes: %5%n

          Page file size in bytes: 0%n

          Volume guid: %1%n

          Volume name: %3%n

          Is boot volume: %6%n

xIn the past %5 seconds %6 files were deleted from the user's popular known folders (i.e. Desktop, Documents, Downloads, Music, Pictures, Videos, etc.).%n%7 of the deletions recorded their process names.%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Process names: [%8]%n

          Delete counts: %n

            Desktop: [%9]%n

            Documents: [%10]%n

            Downloads: [%11]%n

            Music: [%12]%n

            Pictures: [%13]%n

            Videos: [%14]%n

            Other: [%15]%n

\A process has not acknowledged an NTFS oplock break in a long time.%n%n

          Time (seconds): %1%n

          Owner Process: %2%n

          Breaking Process: %3%n

�System file pages are now locked into memory.%n%n

                   Volume Id: %1%n

                   Volume name: %3%n%n

                   File reference: %4%n

                   File name: %6%n

�System file pages are no longer locked into memory.%n%n

                   Volume Id: %1%n

                   Volume name: %3%n%n

                   File reference: %4%n

                   File name: %6%n%n

                   Reason: %7%n

�VCB exclusive resource acquires:%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Interval duration: %18%n%n

          Acquire count: %19%n

          Max wait duration: %20 ms%n

          Avg wait duration: %21 ms%n

          Max hold duration: %22 ms%n

          Avg hold duration: %23 ms%n

          Max combined duration: %24 ms%n

          Avg combined duration: %25 ms%n%n

          Device GUID: %5%n

          Device manufacturer: %7%n

          Device model: %9%n

          Device revision: %11%n

          Device serial number: %13%n

          Bus type: %14%n

          %n

          Adapter serial number: %16%n

          %n

          For more details see the details tab.%n

�A resource duration exceeded %5 ms:%n%n

          Process Id: %6%n

          Process name: %7%n

          Major function: %8%n

          Minor function: %9%n

          Control code: %10%n

          Resource name: %11%n

          Exclusive acquire: %27%n

          Wait duration: %12 ms%n

          Hold duration: %13 ms%n

          Combined duration: %14 ms%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Device GUID: %15%n

          Device manufacturer: %17%n

          Device model: %19%n

          Device revision: %21%n

          Device serial number: %23%n

          Bus type: %24%n%n

          Adapter serial number: %26%n

,NTFS metadata statistics for volume:%n%n

          Volume Id: %1%n

          Volume name: %3%n%n

          UserFileReads: %4%n

          UserFileReadBytes: %5%n

          UserDiskReads: %6%n

          UserFileWrites: %7%n

          UserFileWriteBytes: %8%n

          UserDiskWrites: %9%n%n

          MetaDataReads: %10%n

          MetaDataReadBytes: %11%n

          MetaDataDiskReads: %12%n

          MetaDataWrites: %13%n

          MetaDataWriteBytes: %14%n

          MetaDataDiskWrites: %15%n%n

          MftReads: %16%n

          MftReadBytes: %17%n

          MftWrites: %18%n

          MftWriteBytes: %19%n

          Mft2Writes: %20%n

          Mft2WriteBytes: %21%n

          RootIndexReads: %22%n

          RootIndexReadBytes: %23%n

          RootIndexWrites: %24%n

          RootIndexWriteBytes: %25%n

          BitmapReads: %26%n

          BitmapReadBytes: %27%n

          BitmapWrites: %28%n

          BitmapWriteBytes: %29%n

          MftBitmapReads: %30%n

          MftBitmapReadBytes: %31%n

          MftBitmapWrites: %32%n

          MftBitmapWriteBytes: %33%n

          UserIndexReads: %34%n

          UserIndexReadBytes: %35%n

          UserIndexWrites: %36%n

          UserIndexWriteBytes: %37%n

          LogFileReads: %38%n

          LogFileReadBytes: %39%n

          LogFileWrites: %40%n

          LogFileWriteBytes: %41%n

          LogFileFull: %42%n

          LogFileFullReasons:%n

                    LF_LOG_SPACE: %43%n

                    LF_DIRTY_PAGES: %44%n

                    LF_OPEN_ATTRIBUTES: %45%n

                    LF_TRANSACTION_DRAIN: %46%n

                    LF_FASTIO_CALLBACK: %47%n

                    LF_DEALLOCATED_CLUSTERS: %48%n

                    LF_DEALLOCATED_CLUSTERS_MEM: %49%n

                    LF_RECORD_STACK_CHECK: %50%n

                    LF_DISMOUNT: %51%n

                    LF_COMPRESSION: %52%n

                    LF_SNAPSHOT: %53%n

                    LF_MOUNT: %54%n

                    LF_SHUTDOWN: %55%n

                    LF_RECURSIVE_COMPRESSION: %56%n

                    LF_TESTING: %57%n%n

          DiskResourceFailure: %58%n

          VolumeTrimCount: %59%n

                    VolumeTrimTime (ms): %60%n

                    VolumeTrimSize (KB): %61%n

                    AvgVolumeTrimTime (ms): %62%n

                    AvgVolumeTrimSize (KB): %63%n

          VolumeTrimSkippedCount: %64%n

                    VolumeTrimSkippedSize (KB): %65%n

          FileLevelTrimCount: %66%n

                    FileLevelTrimTime (ms): %67%n

                    FileLevelTrimSize (KB): %68%n

                    AvgFileLevelTrimTime (ms): %69%n

                    AvgFileLevelTrimSize (KB): %70%n

          NtfsFillStatInfoFromMftRecordCalledCount: %71%n

          NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: %72%n

          NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: %73%n

�NTFS has successfully completed the %19 request in %20 ms when trying to %18 the volume size from %4 (MB) to %5 (MB).%n%n

          Volume Id: %1%n

          Volume name: %3%n%n

          Device GUID: %6%n

          Device manufacturer: %8%n

          Device model: %10%n

          Device revision: %12%n

          Device serial number: %14%n

          Bus type: %15%n%n

          Adapter serial number: %17%n%n

          Operation: %18%n

                    Request Type: %19%n%n

          Stage Durations:%n

                    Stage 1. Verify input and calculate new volume size (ms): %21%n

                    Stage 2. Set boundary and allocate/deallocate cluster (ms): %22%n

                    Stage 3. Update bitmap (ms): %23%n

�NTFS has failed to complete the %19 request after %20 ms when trying to %18 the volume size from %4 (MB) to %5 (MB).%n%n

          Volume Id: %1%n

          Volume name: %3%n%n

          Device GUID: %6%n

          Device manufacturer: %8%n

          Device model: %10%n

          Device revision: %12%n

          Device serial number: %14%n

          Bus type: %15%n%n

          Adapter serial number: %17%n%n

          Operation: %18%n

                    Request Type: %19%n%n

          Stage Durations:%n

                    Stage 1. Verify input and calculate new volume size (ms): %21%n

                    Stage 2. Set boundary and allocate/deallocate cluster (ms): %22%n

                    Stage 3. Update bitmap (ms): %23%n%n

          Failure Stage: %24%n

          Status Code: %25%n

          Failure Reason: %26%n

XAn operation has failed due to a file system limitation.%n%n

          Reason: %1%n

          Volume Id: %3%n

          Volume Name: %4%n

          File Path: %5%n

\NtfsLogFileFull VolumeId: %1, Reason: %2

�PeriodicCheckpointStart VolumeId: %1, Reason: %2, Usage: %3%

�PeriodicCheckpointComplete VolumeId: %1, DirtyMetaDataPages: %2

|CleanCheckpointStart VolumeId: %1, Reason: %2, Usage: %3%

�CleanCheckpointComplete VolumeId: %1, DirtyMetaDataPages: %2

�MftRecordRead VolumeId: %1, BaseFileId: %2, FileId: %3, CacheHit: %4

xMftRecordRead VolumeId: %1, BaseFileId: %2, FileId: %3

\WorkItem queued, WorkItem: %1, Reason: %2

�WorkItem queue failed, WorkItem: %1, Reason: %2, Error: %3

`WorkItem started, WorkItem: %1, Reason: %2

dWorkItem completed, WorkItem: %1, Reason: %2

DFile metadata optimization started.%n%n

                   Volume guid: %1%n

                   Volume name: %3%n

                   File reference: %4%n

HFile metadata optimization completed.%n%n

                   Volume guid: %1%n

                   Volume name: %3%n

                   File reference: %4%n

NTFS volume dismount has started.%n%n

          Volume GUID: %4%n

          Volume Name: %6%n

          Volume Label: %8%n

�NTFS has sent volume dismount event notification and is waiting for the notifications to complete.

�The volume dismount event notification on the NTFS volume has completed.

The NTFS volume has successfully dismounted.%n%n

          Volume GUID: %4%n

          Volume Name: %6%n

          Volume Label: %8%n

�The NTFS volume dismount failed.%n%n

          Error:%1%n

HNTFS failed to mount the volume.%n%n

          Error: %1%n

          Volume GUID: %2%n

          Volume Name: %4%n%nGuidance:%nThe volume is recognized by NTFS but it is corrupted that NTFS could not mount it. Run CHKDSK /F to fix any errors on this volume, and then try accessing it.

0Efs offloading initiated.%n%n

                   Volume serial: %1%n

                   File reference: %2%n

                   File name: %4%n

@Efs offloading read regular file.%n%n

                   Volume serial: %1%n

                   File reference: %2%n

                   File name: %4%n

@Efs offloading write regular file.%n%n

                   Volume serial: %1%n

                   File reference: %2%n

                   File name: %4%n

(Efs legacy initiated.%n%n

                   Volume serial: %1%n

                   File reference: %2%n

                   File name: %4%n

8Efs legacy read regular file.%n%n

                   Volume serial: %1%n

                   File reference: %2%n

                   File name: %4%n

8Efs legacy write regular file.%n%n

                   Volume serial: %1%n

                   File reference: %2%n

                   File name: %4%n

�A process has created a USN journal on a volume.%n%n

          Process: %1%n

          Volume Id: %2%n

          Volume Name: %4%n

          Journal Id: %5%n

          Maximum Size: %6%n

          Allocation Delta: %7%n

�A process has deleted a USN journal on a volume.%n%n

          Process: %1%n

          Volume Id: %2%n

          Volume Name: %4%n

          Journal Id: %5%n

          Current USN: %6%n

$The NTFS volume has been successfully mounted.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n%n

          Device name: %7%n

          Device GUID: %8%n

          Device manufacturer: %10%n

          Device model: %12%n

          Device revision: %14%n

          Device serial number: %16%n

          Bus type: %17%n%n

          Adapter serial number: %19%n

          %n

          Total mount duration: %22%n

          Longest stage: %23. Duration %24 (%25% of the total)%n

          Second longest stage: %26. Duration %27 (%28% of the total)%n

          Volume restart applied: %29%n

�NTFS cached runs statistics.%n%n

          Volume correlation Id: %1%n

          Volume name: %2%n

          Volume label: %3%n%n

          Device name: %4%n

          Device GUID: %5%n

          Device manufacturer: %6%n

          Device model: %7%n

          Device revision: %8%n

          Device serial number: %9%n

          Bus type: %10%n%n

          Adapter serial number: %11%n%n

          Capacity tier name: %12%n

            Media type: %13%n

            Runs cached: %14%n

            Longest run cached: %16%n

            Most populated bin Count: %17%n

            Most populated bin's minimum length: %19%n

            Most populated bin's maximum length: %21%n

          Performance tier name: %30%n

            Media type: %31%n

            Runs cached: %32%n

            Longest run cached: %34%n

            Most populated bin Count: %35%n

            Most populated bin's minimum length: %37%n

            Most populated bin's maximum length: %39%n

�Summary of disk space usage, since last event:%n%n

          Available space was between %6 and %7%n

          Change in available space: %8%n

          %n

          Available clusters were between: %9 and %10%n

          Reserved clusters were between: %13 and %14%n

          Txf abort reserved clusters were between: %15 and %16%n

          %n

          Elapsed seconds: %5%n

          %n

          Pagefile size: %18%n

          Volume size: %20%n

          Bytes per cluster: %21%n

          %n

          Volume guid: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

�IO latency summary:%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

          %n

          IO type: %20%n

          %n

          Interval duration: %18%n

          %n

          Max Acceptable IO Latency: %22%n

          High Latency IOs: %23%n

          %n

          IO count: %24%n

          Avg IOPS: %25%n

          Avg latency: %27%n

          %n

          Latency buckets: [%28]%n

          IO count buckets: [%29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40]%n

          Total time buckets (ns): [%41, %42, %43, %44, %45, %46, %47, %48, %49, %50, %51, %52]%n

          %n

          Device GUID: %5%n

          Device manufacturer: %7%n

          Device model: %9%n

          Device revision: %11%n

          Device serial number: %13%n

          Bus type: %14%n

          %n

          Adapter serial number: %16%n

          %n

          For more details see the details tab.%n

0NTFS volume dismount has started.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n%n

          Device name: %7%n

          Device GUID: %8%n

          Device manufacturer: %10%n

          Device model: %12%n

          Device revision: %14%n

          Device serial number: %16%n

          Bus type: %17%n

          %n

          Adapter serial number: %19%n

          %n

          Process Id: %21%n

          Process name: %22%n

          %n

          Reason: %23%n

0The NTFS volume has successfully dismounted.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n%n

          Device name: %7%n

          Device GUID: %8%n

          Device manufacturer: %10%n

          Device model: %12%n

          Device revision: %14%n

          Device serial number: %16%n

          Bus type: %17%n%n

          Adapter serial number: %19%n

          %n

          Process Id: %21%n

          Process name: %22%n

          %n

          Reason: %23%n

�The NTFS volume dismount failed.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n%n

          Device name: %7%n

          Device GUID: %8%n

          Device manufacturer: %10%n

          Device model: %12%n

          Device revision: %14%n

          Device serial number: %16%n

          Bus type: %17%n

          %n

          Adapter serial number: %19%n

          %n

          Error:%21%n

�NTFS failed to mount the volume.%n%n

          Volume correlation Id: %1%n

          Volume name: %3%n

          Volume label: %5%n%n

          Device name: %7%n

          Device GUID: %8%n

          Device manufacturer: %10%n

          Device model: %12%n

          Device revision: %14%n

          Device serial number: %16%n

          Bus type: %17%n%n

          Adapter serial number: %19%n

          %n

          Error: %20%n

          %nGuidance:%nThe volume is recognized by NTFS but it is corrupted and NTFS could not mount it. Run CHKDSK /F to fix any errors on this volume, and then try accessing it.

`Summary of disk space usage, since last event:%n%n

          Available space was between %6 and %7%n

          Change in available space: %8%n

          %n

          Available clusters were between: %9 and %10%n

          Reserved clusters were between: %13 and %14%n

          Txf abort reserved clusters were between: %15 and %16%n

          %n

          Elapsed seconds: %5%n

          %n

          Pagefile size: %18%n

          Volume size: %20%n

          Bytes per cluster: %21%n

          %n

          Slab size: %23%n

          Slabs in use: %24%n

          Slabs required for volume: %25%n

          Thin provisioning map failures: %26%n

          %n

          Volume guid: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

          Volume is thinly provisioned%n

�A %9 failed with %14.%nThis may indicate a failing disk.%n%n

          Process Id: %5%n

          Process name: %6%n

          File name: %8%n

          IO Size: %10 bytes%n

          File offset: %11%n

          %13 cluster(s) starting at cluster %12%n

          Latency: %15 ms%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Device GUID: %16%n

          Device manufacturer: %18%n

          Device model: %20%n

          Device revision: %22%n

          Device serial number: %24%n

          Bus type: %25%n%n

          Adapter serial number: %27%n

LIn the past %17 seconds we had high latency IOs and/or IO failures.%n%n

          High latency IO count: %18%n

          Failed writes: %19%n

          Failed reads: %20%n

          Bad clusters relocated: %21%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Device GUID: %5%n

          Device manufacturer: %7%n

          Device model: %9%n

          Device revision: %11%n

          Device serial number: %13%n

          Bus type: %14%n%n

          Adapter serial number: %16%n

IO latency summary:%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

          %n

          IO type: %20%n

          %n

          Interval duration: %18%n

          %n

          Max Acceptable IO Latency: %22%n

          High Latency IOs: %23%n

          %n

          IO count: %24%n

          Total bytes: %53%n

          Avg IOPS: %25%n

          Avg Bps: %54%n

          Avg latency: %27%n

          %n

          Latency buckets: [%28]%n

          IO count buckets: [%29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40]%n

          Total time buckets (ns): [%41, %42, %43, %44, %45, %46, %47, %48, %49, %50, %51, %52]%n

          %n

          Device GUID: %5%n

          Device manufacturer: %7%n

          Device model: %9%n

          Device revision: %11%n

          Device serial number: %13%n

          Bus type: %14%n

          %n

          Adapter serial number: %16%n

          %n

          For more details see the details tab.%n

�Summary of disk space usage, since last event:%n%n

          Available space was between %6 and %7%n

          Change in available space: %8%n

          %n

          Available clusters were between: %9 and %10%n

          Reserved clusters were between: %13 and %14%n

          Txf abort reserved clusters were between: %15 and %16%n

          %n

          Elapsed seconds: %5%n

          %n

          Pagefile size: %18%n

          Volume size: %20%n

          Bytes per cluster: %21%n

          %n

          Volume guid: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

          %n

          Cached runs miss counts:%n

              For MFT: %22%n

              For MFT zone: %23%n

              Everything else: %24%n

�IO latency summary:%n%n

          Volume Id: %2%n

          Volume name: %4%n

          Is boot volume: %5%n%n

          Device GUID: %7%n

          Device manufacturer: %9%n

          Device model: %11%n

          Device revision: %13%n

          Device serial number: %15%n

          Bus type: %16%n%n

          Adapter serial number: %18%n%n

          Max Acceptable IO Latency: %19 ms%n%n

          Read/Write latency buckets (ns): [%20, %21, %22, %23, %24, %25, %26]%n

          Trim latency buckets (ns): [%27, %28, %29, %30, %31, %32, %33]%n

          Flush latency buckets (ns): [%34, %35, %36, %37, %38, %39, %40]%n%n

          Interval duration: %42 us%n%n

          Non-cached reads:%n

                    IO count: %43%n

                    Total bytes: %44%n

                    Avg latency: %45 ns%n%n

          Non-cached writes:%n

                    IO count: %46%n

                    Total bytes: %47%n

                    Avg latency: %48 ns%n%n

          File flushes:%n

                    IO count: %49%n

                    Avg latency: %50 ns%n%n

          Directory flushes:%n

                    IO count: %51%n

                    Avg latency: %52 ns%n%n

          Volume flushes:%n

                    IO count: %53%n

                    Avg latency: %54 ns%n%n

          File level trims:%n

                    IO count: %55%n

                    Total bytes: %56%n

                    Extents count: %57%n

                    Avg latency: %58 ns%n%n

          Volume trims:%n

                    IO count: %59%n

                    Total bytes: %60%n

                    Extents count: %61%n

                    Avg latency: %62 ns%n%n

          VCB exclusive resource acquires:%n

                    Acquire count: %71%n

                    Max wait duration: %72 ms%n

                    Avg wait duration: %73 ms%n

                    Max hold duration: %74 ms%n

                    Avg hold duration: %75 ms%n

                    Max combined duration: %76 ms%n

                    Avg combined duration: %77 ms%n%n

          For more details see the details tab.%n

�An IO took more than %5 ms to complete:%n%n

          Process Id: %6%n

          Process name: %7%n

          File name: %9%n

          File offset: %12%n

          IO Type: %10%n

          IO Size: %11 bytes%n

          %15 cluster(s) starting at cluster %14%n

          Latency: %13 ms%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Device GUID: %16%n

          Device manufacturer: %18%n

          Device model: %20%n

          Device revision: %22%n

          Device serial number: %24%n

          Bus type: %25%n%n

          Adapter serial number: %27%n

�A %11 failed with %16.%nThis may indicate a failing disk.%n%n

          Process Id: %5%n

          Process name: %6%n

          File name: %8%n

          IO Size: %12 bytes%n

          File offset: %13%n

          %15 cluster(s) starting at cluster %14%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Device GUID: %17%n

          Device manufacturer: %19%n

          Device model: %21%n

          Device revision: %23%n

          Device serial number: %25%n

          Bus type: %26%n%n

          Adapter serial number: %28%n

@IO latency summary:%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

          %n

          IO type: %20%n

          %n

          Interval duration: %18%n

          %n

          Max Acceptable IO Latency: %22%n

          High Latency IOs: %23%n

          %n

          IO count: %24%n

          Total bytes: %53%n

          Total extents: %67%n

          Avg IOPS: %25%n

          Avg Bps: %54%n

          Avg latency: %27%n

          %n

          Latency buckets: [%28]%n

          IO count buckets: [%29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40]%n

          Total time buckets (ns): [%41, %42, %43, %44, %45, %46, %47, %48, %49, %50, %51, %52]%n

          %n

          Device GUID: %5%n

          Device manufacturer: %7%n

          Device model: %9%n

          Device revision: %11%n

          Device serial number: %13%n

          Bus type: %14%n

          %n

          Adapter serial number: %16%n

          %n

          For more details see the details tab.%n

�Summary of disk space usage, since last event:%n%n

          Available space was between %6 and %7%n

          Change in available space: %8%n

          %n

          Available clusters were between: %9 and %10%n

          Reserved clusters were between: %13 and %14%n

          Txf abort reserved clusters were between: %15 and %16%n

          %n

          Elapsed seconds: %5%n

          %n

          Pagefile size: %18%n

          Volume size: %20%n

          Bytes per cluster: %21%n

          %n

          Slab size: %23%n

          Slabs in use: %24%n

          Slabs required for volume: %25%n

          Thin provisioning map failures: %26%n

          %n

          Volume guid: %1%n

          Volume name: %3%n

          Is boot volume: %4%n

          Volume is thinly provisioned%n

          %n

          Cached runs miss counts:%n

              For MFT: %27%n

              For MFT zone: %28%n

              Everything else: %29%n

4IO latency summary common data for volume:%n%n

          Volume Id: %2%n

          Volume name: %4%n

          Is boot volume: %5%n%n

          Device GUID: %7%n

          Device manufacturer: %9%n

          Device model: %11%n

          Device revision: %13%n

          Device serial number: %15%n

          Bus type: %16%n%n

          Adapter serial number: %18%n%n

          Max Acceptable IO Latency: %19 ms%n%n

          Read/Write latency buckets (ns): [%20, %21, %22, %23, %24, %25, %26]%n

          Trim latency buckets (ns): [%27, %28, %29, %30, %31, %32, %33]%n

          Flush latency buckets (ns): [%34, %35, %36, %37, %38, %39, %40]%n

�An IO took more than %5 ms to complete:%n%n

          Process Id: %6%n

          Process name: %7%n

          File name: %9%n

          File offset: %15%n

          IO Type: %13%n

          IO Size: %14 bytes%n

          %18 cluster(s) starting at cluster %17%n

          Latency: %16 ms%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Device GUID: %19%n

          Device manufacturer: %21%n

          Device model: %23%n

          Device revision: %25%n

          Device serial number: %27%n

          Bus type: %28%n%n

          Adapter serial number: %30%n

An IO took more than %5 ms to complete:%n%n

          Process Id: %6%n

          Process name: %7%n

          File name: %9%n

          IO Type: %13%n

          Latency: %14 ms%n%n

          Volume Id: %1%n

          Volume name: %3%n

          Is boot volume: %4%n%n

          Device GUID: %15%n

          Device manufacturer: %17%n

          Device model: %19%n

          Device revision: %21%n

          Device serial number: %23%n

          Bus type: %24%n%n

          Adapter serial number: %26%n

The file system structure on the disk is corrupt and unusable.

Please run the chkdsk utility on the device %1 with label "%2".

8The user disk quota information is unusable.

To ensure accuracy, the file system quota information on the device %1 with label "%2" will

be rebuilt.

�The file system structure on the disk is corrupt and unusable.

Please run the chkdsk utility on the volume %2.

<The transaction resource manager on volume %2 was unable to create free space in its log due to a non-retryable error.  The data contains the error code.

(The default transaction resource manager on volume %2 encountered a non-retryable error and could not start.  The data contains the error code.

�The transaction resource manager at %2%3 encountered a fatal error and was shut down.  The data contains the error code.

Lis healthy.  No action is needed.

requires an Online Scan.  An Online Scan will automatically run as part of the next scheduled maintenance task.  Alternatively you may run "CHKDSK /SCAN" locally via the command line, or run "REPAIR-VOLUME <drive:> -SCAN" locally or remotely via PowerShell.

�needs to be taken offline for a short time to perform a Spot Fix.  Please run "CHKDSK /SPOTFIX" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.

dneeds to be taken offline to perform a Full Chkdsk.  Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.

LogSpace

 DirtyPages

(OpenAttributes

,TransactionDrain

(FastIOCallback

0DeallocatedClusters

8DeallocatedClustersMem

,RecordStackCheck

Dismount

 Compression

Snapshot

Mount

Shutdown

4RecursiveCompression

Testing

 PostRequest

 Checkpoint

 DelayClose

@MarkUnusedContextCompletion

HotFix

0DiskFlushCompletion

 McbCleanup

 UsnTimeOut

Repair

4TxfRmDelayedWorkItem

4TxfRmCriticalWorkItem

4TxfRmRestartWorkItem

,TxfThawRmsWorker

,ScavengeDeleteUsn

8ScavengeRepairObjectId

<ScavengeRepairQuotaIndex

4ScavengeMarkUserLimit

LScavengeResolveVolumeAndLogEvent

PWrite: NonPaging, NonCached, Async

LWrite: NonPaging, NonCached, Sync

lWrite: NonPaging, NonCached, Async, Writethrough

hWrite: NonPaging, NonCached, Sync, Writethrough

HWrite: NonPaging, Cached, Async

HWrite: NonPaging, Cached, Sync

dWrite: NonPaging, Cached, Async, Writethrough

dWrite: NonPaging, Cached, Sync, Writethrough

HWrite: Paging, NonCached, Async

HWrite: Paging, NonCached, Sync

dWrite: Paging, NonCached, Async, Writethrough

dWrite: Paging, NonCached, Sync, Writethrough

LRead: NonPaging, NonCached, Async

LRead: NonPaging, NonCached, Sync

HRead: NonPaging, Cached, Async

DRead: NonPaging, Cached, Sync

HRead: Paging, NonCached, Async

DRead: Paging, NonCached, Sync

create

,create named pipe

close

read

write

,query information

(set information

query EA

set EA

$flush buffers

<query volume information

8set volume information

,directory control

0file system control

(device control

8internal device control

shutdown

$lock control

cleanup

,create mail slot

(query security

$set security

power

(system control

$device change

 query quota

set quota

$plug and play

<unknown>

SCSI

ATAPI

ATA

1394

SSA

Fibre

USB

RAID

iSCSI

SAS

SATA

SD

MMC

Virtual

0File backed virtual

Spaces

NVMe

SCM

Ufs

Unknown

TInternal attribute stream was deleted

,Stream was purged

4Configuration changed

VCB

Extend

Shrink

Extend

Prepare

Shrink

Abort

Unknown

lFile size exceeds the maximum allowed by a volume

LFile size exceeds a system limit

LA file record could not be split

PBitmap size exceeds a system limit

XUSN journal size exceeds a system limit

false

true

<unknown>

Unknown

 File create

8Last modification time

,Last change time 

,Last access time

(Allocation size

File size

(File attributes

$File EA size

0Mismatch info found

 Unspecified

Hard disk

SSD

4Storage class memory

Mount

�Reload requested because of an exception or configuration change

`Could not extend Mft without fragmenting it

lPreviously reduced Mft zone is now being expanded

4Change in volume size

TNew cluster alignment was initialized

pProactive background scan to repopulate cached runs

�4VS_VERSION_INFO��

|O

|O?�StringFileInfo�040904B0LCompanyNameMicrosoft CorporationTFileDescriptionNT File System Drivern'FileVersion10.0.20348.3328 (WinBuild.160101.0800)2	InternalNamentfs.sys�.LegalCopyright� Microsoft Corporation. All rights reserved.B
OriginalFilenamentfs.sys.muij%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.20348.3328DVarFileInfo$Translation	�PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING