C:\bootex.log gets deleted. Bootex.log can be acessed with recovery
software such as Restoration.
This is a sample of one of my Event ID 1001 Winlogon.
Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 12/4/2004
Time: 8:01:27 AM
User: N/A
Computer: MYPENTIUM450
Description:
Checking file system on C:
The type of the file system is NTFS.
Volume label is Local Disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 10 unused index entries from index $SII of file 0x9.
Cleaning up 10 unused index entries from index $SDH of file 0x9.
Cleaning up 10 unused security descriptors.
9952235 KB total disk space.
6020596 KB in 40720 files.
15248 KB in 2053 indexes.
0 KB in bad sectors.
102811 KB in use by the system.
51824 KB occupied by the log file.
3813580 KB available on disk.
4096 bytes in each allocation unit.
2488058 total allocation units on disk.
953395 allocation units available on disk.
That is the same exact info as what was in the bootex.log from that time. I
know because I recovered the deleted bootex.log and compared it to the Event
Viewer entry.
Bootex.log is from BootExecute, here...
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Value Name: BootExecute
and whatever autocheck value exists or existed at the time autochk.exe ran.
autocheck autochk /r \??\C: for example.
You can create a chkdsk log.
From: Doug Knox MS-MVP...
This will create a chkdsk log.
Paste this into a command prompt...
CHKDSK C: /F > C:\CHKDISKLOG.TXT
Hit your Enter key.
Click YES on the popup to reboot.
After CHKDSK has run paste this in Start | Run...
C:\CHKDISKLOG.TXT
Click OK.
You get THREE. The fourth pass is OPTIONAL. "If the /R switch is in
effect, CHKDSK runs a fourth pass to look for bad sectors in the volume's
free space."
Phase 1: Checking files
Phase 2: Checking indexes
Phase 3: Checking security descriptors
Phase 4: Checking sectors
<quote>
Checking an NTFS disk
Windows displays chkdsk status reports for an NTFS disk in the following
format:
The type of the file system is NTFS.
CHKDSK is verifying files...
File verification completed.
CHKDSK is verifying indexes...
Index verification completed.
CHKDSK is verifying security descriptors...
Security descriptor verification completed.
12372 kilobytes total disk space.
3 kilobytes in 1 user files.
2 kilobytes in 1 indexes.
4217 kilobytes in use by the system.
8150 kilobytes available on disk.
512 bytes in each allocation unit.
24745 total allocation units on disk.
16301 allocation units available on disk.
<quote>
from...
Microsoft Windows XP - Chkdsk
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/chkdsk.mspx?mfr=true
Understanding what CHKDSK does
CHKDSK's activity is divided into three major passes, during which CHKDSK
examines all the metadata on the volume, and an optional fourth pass.
Phase 1: Checking files
During its first pass, CHKDSK displays a message that tells you that CHKDSK
is verifying files and also displays the percent of verification that is
completed, counting from 0 to 100 percent. During this phase, CHKDSK
examines each file record segment in the volume's master file table (MFT).
Phase 2: Checking indexes
During its second pass, CHKDSK displays a message that tells you that CHKDSK
is verifying indexes and again displays the percent completed, counting from
0 to 100 percent. During this phase, CHKDSK examines each of the indexes on
the volume.
Phase 3: Checking security descriptors
During its third pass, CHKDSK displays a message that tells you that CHKDSK
is verifying security descriptors and, for the third time, displays "percent
completed," counting from 0 to 100 percent. During this phase, CHKDSK
examines each security descriptor that is associated with files or
directories that are on the volume.
Phase 4: Checking sectors
If the /R switch is in effect, CHKDSK runs a fourth pass to look for bad
sectors in the volume's free space. CHKDSK attempts to read every sector on
the volume to confirm that the sector is usable. Even without the /R switch,
CHKDSK always reads sectors that are associated with metadata. Sectors that
are associated with user data are read during earlier phases of CHKDSK if
the /R switch is specified.
from...
An explanation of the new /C and /I Switches that are available to use with
Chkdsk.exe
http://support.microsoft.com/kb/314835