A snapshot error occurred while scanning this drive run an offline scan and fix

У меня есть Windows Storage Space, массив из 8 дисков, настроенный на паритет и отформатированный как NTFS. Вчера я выполнял обслуживание некоторых файлов, используя вкладку «Безопасность» в диалоговом окне свойств папки для рекурсивного изменения большого количества файлов. Никакой другой процесс не работал с этим диском.

В какой-то момент процесс заблокировал файл, и я попросил отменить операцию. Было предоставлено предупреждение о том, что это приведет к тому, что разрешения останутся в несогласованном состоянии, но я решил, что смогу исправить любые проблемы позже. Проводник заблокирован, и громкость перестала отвечать. Я попытался выключить компьютер, что привело к блокировке Windows, поэтому я принудительно отключил его.

После перезагрузки у меня возникли проблемы с монтированием поврежденного раздела. Все остальные разделы не имеют проблем.

Информация примечания:

Дисковые пространства распознают пул и идентифицируют его и все диски, которые он содержит, как в «нормальном» (исправном) состоянии. Я могу успешно смонтировать проблемный том, но любая форма доступа приводит к блокировке процесса до тех пор, пока весь пул не отключится.

Например, в CMD:

> dir \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The device is not ready.

> mountvol z: \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
> dir z:

Приглашение будет заблокировано до тех пор, пока пул не перейдет в автономный режим. В командной строке выдается ошибка:

The parameter is incorrect.

Отчеты о хранилищах и состояние ошибок и следующий статус для пула. Все физические диски по-прежнему сообщают «ОК»:

Offline due to critical write failures; add drives

И Event Viewer говорит следующее:

Событие 140, Ntfs (Microsoft-WIndows-Ntfs) — ПРЕДУПРЕЖДЕНИЕ

Системе не удалось сбросить данные в журнал транзакций. Повреждение может возникнуть в VolumeId: Z:, DeviceName: Device HarddiskVolume78. (Устройство, которое не существует, было указано.)

Ошибка 0xc000000e

а также

Событие 50, NTFS — WARNING {Ошибка отложенной записи}

Windows не удалось сохранить все данные для файла. Данные были потеряны. Эта ошибка может быть вызвана отказом вашего компьютера или сетевого подключения. Пожалуйста, попробуйте сохранить этот файл в другом месте.

Попытка выполнить chkdsk на томе или в любой точке монтирования для него вызывает такую же блокировку с теми же предупреждениями о событиях, и пул отключается.

Поскольку пул всегда отключался из-за ошибки записи, я смог восстановить данные, подключив том только для чтения:

> diskpart
DISKPART> list disk
DISKPART> select disk 13
DISKPART> attributes disk set readonly

Диск был снова подключен:

DISKPART> online disk

И объем был установлен:

DISKPART> select volume 2
DISKPART> assign letter z

Доступ ко всем файлам был восстановлен, и была сделана резервная копия.

Теперь, когда я вернул все свои данные, у меня осталось много вопросов. Во-первых, я даже не знаю, что пошло не так или почему громкость испортилась.

Я не получаю ошибок от chkdsk:

> chkdsk z:
The type of the file system is NTFS.
Volume label is Development.

WARNING!  /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
  526336 file records processed.
File verification completed.
  0 large file records processed.
  0 bad file records processed.

Stage 2: Examining file name linkage ...
  6 reparse records processed.
  627238 index entries processed.
Index verification completed.
  0 unindexed files scanned.
  0 unindexed files recovered to lost and found.
  6 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
  50451 data files processed.

Windows has scanned the file system and found no problems.
No further action is required.

 134218748 KB total disk space.
  48483444 KB in 475729 files.
     61908 KB in 50453 indexes.
         0 KB in bad sectors.
   2175476 KB in use by the system.
     65536 KB occupied by the log file.
  83497920 KB available on disk.

      4096 bytes in each allocation unit.
  33554687 total allocation units on disk.
  20874480 allocation units available on disk.

Это все, что я могу сделать, так как любая попытка прикоснуться к тому, когда он не защищен от записи, приводит к тому, что процесс блокируется, и пул в конечном итоге отключается.

> chkdsk z: /r
The type of the file system is NTFS.
Windows cannot run disk checking on this volume because it is write protected.

> chkdsk z: /f
The type of the file system is NTFS.
Windows cannot run disk checking on this volume because it is write protected.

> chkdsk z: /scan
The type of the file system is NTFS.
Shadow copying the specified volume is not supported.

A snapshot error occured while scanning this drive. Run an offline scan and fix.

> chkdsk z: /offlinescanandfix
The type of the file system is NTFS.
Windows cannot run disk checking on this volume because it is write protected.

Объем также не сообщается как «грязный»:

> chkntfs z:
The type of the file system is NTFS.
Z: is not dirty.

Я до сих пор не знаю, что случилось или что случилось. Громкость все еще плохая. Я мог бы удалить его и начать все сначала, но я не знаю, в чем проблема. Я думаю, что это просто программное обеспечение и что-то не так с файловой системой, но это только предположение.

Любые мысли о том, как диагностировать это дальше или как восстановить объем, если это возможно?

ОБНОВИТЬ

Я установил диск для чтения-записи, а том — только для чтения. Затем при попытке проверить диск он записывается как RAW вместо NTFS:

> chkntfs \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The type of the file system is RAW.
Cannot query state of drive \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}

> chkdsk \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The type of the file system is RAW.
CHKDSK is not available for RAW drives.

Если я смонтирую его, а затем проверю, то он распознается должным образом (все еще только для чтения):

> mountvol z: \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}

> chkntfs \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The type of the file system is NTFS.
\?Volume{73ad1258-809b-4db1-a153-9832c3697fcf} is not dirty.

Монтируется снова как том для чтения-записи на томе, но блокируется даже при попытке выполнить автономное сканирование:

> chkdsk \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf} /offlinescanandfix
Cannot open volume for direct access.

(Бассейн отключился)

Long post, please be patient…

I have a fairly new (purchased 8/2013) Lenovo ThinkPad T431s with Windows 8.1 Pro 64-bit (updated from 8.0 -> 8.1). It has a very tricky error coming basically 8 / 10 boots:
Windows is Scanning and repairing drive…

What has been done 1st trying to fix that:

1. SSD disk has been changed (image from previous SSD copied back) ->
   no solution, error remains
2. chkdsk /F /R -> no solution, error remains
3. SFC /scannow -> no solution, error remains
4. dism /online /cleanup-image /restorehealth -> no solution, error remains after a few boots
5. TRIED using Windows 8.1 «Update & Recovery -> Refresh Your PC without affecting your files» -> Inserted the Lenovo «Operating System Recovery Disk Windows 8 Pro (OEM Activation 3.0 Required)» BUT Windows did not accept
   that DVD claiming «The media inserted is not valid»… ???
6. Ended up calling Lenovo Support and they instructed me to order the Recovery DVD from
   Lenovorecovery.com -> Unfortunatelly Windows does not recognice the DVD(s)…

Summary:
One of our iSCSI volumes just randomly stopped working in Windows. After a reboot, all 3 volumes appeared as RAW in Disk Management and could not be fixed with chkdsk. They would later degrade to uninitialised. They’ve now been wiped clean. The MSA was up-to-date with firmware.

Full version:
It started while everything was simply running. We had 3 iSCSI volumes via direct connect ethernet cable, each 64TB NTFS on Windows Server 2022. I had connected a couple of people to a SMB share on one of them, but with read-only permissions. Suddenly one of them couldn’t be read in Windows anymore, despite the other two seeming to be fine. The MSA was about 70% through a scrub but reported no problems at all in its GUI or my email notifications. Trying to interact with the drive in any way through the Windows GUI stopped the server from responding to those windows and was freezing all work for staff. It also seemed to be preventing the server from doing a normal restart, so I did a desperate hard reboot.

When Windows came back up, all 3 volumes were showing as RAW in Disk Management. Googling it showed an abundance of threads about this happening after hard reboots with iSCSI. However, running chkdsk /f on each of the volumes failed immediately despite being a reliable fix in most of the threads I had read. Using a different computer as the iSCSI initiator made no difference at any point. The MSA 2060 said the data was still there on each volume (although it seemed to be losing a couple percent every time I checked back later).

I looked at running partition and file recovery programs, but they were clearly going to take forever for each volume with no guaranteed success and the data was all backed up elsewhere anyway. However, interacting with the volumes seemed to cause each of them to degrade further by showing up as Not Initialized one by one. Also, when I deleted the volume that was of least importance and tried to create a new one I couldn’t initialize any of them either which was sending up red flags that the MSA 2060 might be the problem.

I’m not sure what resolved it exactly but power cycling the MSA and switching 10Gbe ports allowed me to at least initialize new volumes. I was pretty exhausted and stressed by this point and just decided to create clean reliable volumes so I could start the long process of copying data back over. In hindsight I should have slept on it so that HPE support could actually look at the corrupted volumes to better make suggestions about the cause/fix, but that’s where I’m at.

I’m hoping somebody might have some helpful advice on what might have happened here and what measures can be taken in future. Thanks.

Appendix — Event Logs:

Below are a selection of events from Event Viewer as it all happened. I couldn’t find any events of any note before these all appeared at the same time:

At 16/02/2022 2:31:41
Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\?Volume{2e40a1e3-f58c-4092-9e52-187e46be723c} — 0000000000000244,0x0053c008,0000010C4E0068B0,0,0000010C4E0078E0,4096,[0]).  hr = 0x80820001, The bootfile is too small to support persistent snapshots.

.

Operation:

   Processing EndPrepareSnapshots

Context:

   Execution Context: System Provider

And:
Volume H: (DeviceHarddiskVolume19) requires an Online Scan.  An Online Scan will automatically run as part of the next scheduled maintenance task.  Alternatively you may run «CHKDSK /SCAN» locally via the command line, or run «REPAIR-VOLUME <drive:> -SCAN» locally or remotely via PowerShell.

And:

Chkdsk was executed in verify mode on a volume snapshot. 

Checking file system on DeviceHarddiskVolume19

The shadow copy provider had an error. Check the System and Application event logs for more information.

A snapshot error occured while scanning this drive. You can try again, but if this problem persists, run an offline scan and fix.

And:
A corruption was discovered in the file system structure on volume H:.

The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0x100000000040d.  The name of the file is «<unable to determine file name>».

And:
The file system structure on volume H: cannot be corrected.

Please run the chkdsk utility on the volume H:.

2:38:27

The file system structure on volume H: has now been repaired.

2:56:44

The file system structure on volume H: cannot be corrected.

Please run the chkdsk utility on the volume H:.

3:50:33

Hard reset

3:57:26

A corruption was discovered in the file system structure on volume G:.

The exact nature of the corruption is unknown.  The file system structures need to be scanned online.

And that was where none of the volumes would work anymore. There were plenty more NTFS errors after this point, although only for G: drive for some reason.

I have a Windows Storage Space that is an 8-drive array configured for parity and formatted as NTFS. Yesterday I was performing maintenance on some files using the security tab from the properties dialog of a folder to modify a large number of files recursively. No other process was working with this disk.

At some point the process locked up on a file and I requested the operation to cancel. A warning was provided that this would leave permissions in an inconsistent state but I decided that I could correct any issues later. Explorer locked up and the volume became unresponsive. I attempted to shut down the computer which resulting in Windows locking up so I powered it off forcefully.

Upon rebooting I had a number of issues mounting the affected partition. All other partitions have no issue.

Information of note:

Storage Spaces recognizes the pool and identifies it and all drives it comprises as in an «OK» (healthy) state. I can successfully mount the troubled volume but any form of access causes the process to lock up until the entire pool goes offline.

For example, in CMD:

> dir \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The device is not ready.

> mountvol z: \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
> dir z:

The prompt will lock up until the pool finally goes offline. The command prompt provides the error:

The parameter is incorrect.

Storage spaces reports and error state and the following status for the pool. All physical drives still report as «OK»:

Offline due to critical write failures; add drives

And Event Viewer says the following:

Event 140, Ntfs (Microsoft-WIndows-Ntfs) — WARNING

The system failed to flush data to the transaction log. Corruption may occur in VolumeId: Z:, DeviceName: DeviceHarddiskVolume78. (A device which does not exist was specified.)

Error 0xc000000e

and

Event 50, NTFS — WARNING {Delayed Write Failed}

Windows was unable to save all the data for the file . The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

Attempting to perform a chkdsk on the volume or any mount point for it causes the same lockup with the same event warnings and the pool goes offline.

Because the pool would always go offline as a result of a write error I was able to recover the data by mounting the volume as read-only:

> diskpart
DISKPART> list disk
DISKPART> select disk 13
DISKPART> attributes disk set readonly

The disk was put back online :

DISKPART> online disk

And the volume was mounted:

DISKPART> select volume 2
DISKPART> assign letter z

Access to all files was restored and a backup was made.

Now that I’ve gotten all of my data back I’m left with a lot of questions. Firstly, I don’t even know what went wrong or why the volume is so messed up.

I get no errors from chkdsk:

> chkdsk z:
The type of the file system is NTFS.
Volume label is Development.

WARNING!  /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
  526336 file records processed.
File verification completed.
  0 large file records processed.
  0 bad file records processed.

Stage 2: Examining file name linkage ...
  6 reparse records processed.
  627238 index entries processed.
Index verification completed.
  0 unindexed files scanned.
  0 unindexed files recovered to lost and found.
  6 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
  50451 data files processed.

Windows has scanned the file system and found no problems.
No further action is required.

 134218748 KB total disk space.
  48483444 KB in 475729 files.
     61908 KB in 50453 indexes.
         0 KB in bad sectors.
   2175476 KB in use by the system.
     65536 KB occupied by the log file.
  83497920 KB available on disk.

      4096 bytes in each allocation unit.
  33554687 total allocation units on disk.
  20874480 allocation units available on disk.

This is all I can do as any attempt to touch the volume when it’s not write-protected causes the process doing so lock up and the pool to eventually go offline.

> chkdsk z: /r
The type of the file system is NTFS.
Windows cannot run disk checking on this volume because it is write protected.

> chkdsk z: /f
The type of the file system is NTFS.
Windows cannot run disk checking on this volume because it is write protected.

> chkdsk z: /scan
The type of the file system is NTFS.
Shadow copying the specified volume is not supported.

A snapshot error occured while scanning this drive. Run an offline scan and fix.

> chkdsk z: /offlinescanandfix
The type of the file system is NTFS.
Windows cannot run disk checking on this volume because it is write protected.

The volume also is not reported as «dirty»:

> chkntfs z:
The type of the file system is NTFS.
Z: is not dirty.

I still don’t know what’s wrong or what happened. The volume is still bad. I could delete it and start over but I don’t know what the problem is. I think it’s just software and something wrong with the filesystem but that’s just a guess.

Any thoughts on how to diagnose this further or how to repair the volume if possible?

UPDATE

I set the disk as read-write but the volume as read-only. Then when attempting to check the disk it is reported as RAW instead of NTFS:

> chkntfs \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The type of the file system is RAW.
Cannot query state of drive \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}

> chkdsk \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The type of the file system is RAW.
CHKDSK is not available for RAW drives.

If I mount it and then check it then it’s recognized properly (still as read-only):

> mountvol z: \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}

> chkntfs \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf}
The type of the file system is NTFS.
\?Volume{73ad1258-809b-4db1-a153-9832c3697fcf} is not dirty.

Mounted again as read-write on the volume but it locks up even when attempting to perform an offline scan:

> chkdsk \?Volume{73ad1258-809b-4db1-a153-9832c3697fcf} /offlinescanandfix
Cannot open volume for direct access.

(The pool went offline)