NTFS event ID 55 and the Shadow Copy Service

[AWS]

I recently upgraded an XP system to Windows 7 (custom build) and after a few days I started seeing the NTFS 55 errors telling me that my file system structure was corrupt and unusable.

Running chkdsk (no fix/repair) finds no errors. Running chkdsk with all repair options turned on (including looking for bad blocks) finds no errors except for an error about the MFT and free space.

 

The system is running fine – no problems – but these errors are unnerving.

All Windows 7 updates are loaded

 

When I first did the upgrade I was getting a volsnap 25 error on every reboot, wiping out my restore points.

This was fixed by creating an unfragmented pagefile. This might not be relevant except that it also involves the shadow copy area.

 

These NTFS errors often occur when nothing in particular is going on, and often after coming out of sleep mode.

Here are the System Log events immediately prior to the NTFS errors.

It appears that the Volume Shadow Copy service is always starting just prior to these errors.

 

I’ve allocated 20GB to system protection, and this space was finally filled up on 4/20.

My restore points look fine. In fact, when I check my restore points I can create a sequence that results in a single NTFS event ID 55 error.

 

It would certainly look like these NTFS errors are strongly correlated with the Shadow Copy service.

 

Since chkdsk never finds any problems with the disk, should I assume that these NTFS errors are bogus?

 

Would it help (or at least be interesting) if I deleted everything in the shadow copy area (System -&gt System protection -&gt Configure), rebooted and started fresh?

 

I’m running Norton security suite. I’m also using Macrium Reflect for backups, although I’ve not seen any NTFS errors before or during backups.

 

Thoughts or suggestions?

 

System log sequences...

 

4/17 2:14:32PM The Disk Defragmenter service entered the running state.

4/17 2:21:57PM The Volume Shadow Copy service entered the running state.

4/17 2:21:58PM The Microsoft Software Shadow Copy Provider service entered the running state.

4/17 2:23:16PM Ntfs event ID 55

4/17 2:23:59PM Ntfs event ID 55

4/17 2:24:58PM Ntfs event ID 55

 

4/17 10:21:34PM The Volume Shadow Copy service entered the running state.

4/17 10:31:35PM The Windows Modules Installer service entered the running state.

4/17 10:31:36PM The Microsoft Software Shadow Copy Provider service entered the running state

4/17 10:31:42PM Ntfs event ID 55

 

4/18 4:18:54PM The Volume Shadow Copy service entered the running state.

4/18 4:18:55PM The Microsoft Software Shadow Copy Provider service entered the running state

4/18 4:18:59PM Ntfs event ID 55

 

4/18 4:44:32PM The Volume Shadow Copy service entered the running state.

4/18 4:44:32PM The Microsoft Software Shadow Copy Provider service entered the running state

4/18 4:44:40PM The Block Level Backup Engine service entered the running state.

4/18 4:44:47PM Ntfs event ID 55

 

4/18 5:29:32PM The Volume Shadow Copy service entered the running state.

4/18 5:29:32PM The Microsoft Software Shadow Copy Provider service entered the running state

4/18 5:29:34PM Ntfs event ID 55

4/18 5:29:37PM Ntfs event ID 55

4/18 5:29:40PM Ntfs event ID 55

 

4/19 5:34:31AM The Volume Shadow Copy service entered the running state.

4/19 5:34:31AM The Microsoft Software Shadow Copy Provider service entered the running state

4/19 5:34:34AM Ntfs event ID 55

4/19 5:34:37AM Ntfs event ID 55

4/19 5:34:39AM Ntfs event ID 55

 

4/20 5:07:16AM The Volume Shadow Copy service entered the running state.

4/20 5:07:16AM The Microsoft Software Shadow Copy Provider service entered the running state

4/20 5:07:19AM Ntfs event ID 55

4/20 5:07:22AM Ntfs event ID 55

4/20 5:07:24AM Ntfs event ID 55

 

4/20 6:05:47AM The Volume Shadow Copy service entered the running state.

4/20 6:05:47AM The Microsoft Software Shadow Copy Provider service entered the running state

4/20 6:05:52AM volsnap event 33: The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit.

4/20 6:05:52AM volsnap event 33: The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit.

4/20 6:05:52AM volsnap event 33: The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit.

4/20 6:10:14AM The Multimedia Class Scheduler service entered the running state.

4/10 6:10:16AM The Software Protection service entered the running state.

4/20 6:11:23AM The Block Level Backup Engine Service entered the running state.

4/20 6:11:27AM Ntfs event ID 55

 

 

 

View the thread