Menu ▾ ▴

[Weird] External HDD volume dismounts by itself

Technical Topics
Nix Coleman
2021-04-03
2023-04-30

  • Nix Coleman

    Nix Coleman - 2021-04-03

    I doubt this is really a Veracrypt issue, but I don't really know where to turn to.

    So, I got a new 5TB Seagate Expansion Portable, and as always (I already have 13 of those) first thing I did, after checking the SMART, was to format and encrypt it. Then I put it to be filled (copying from another full HDD) and left it overnight. Next day I come back to an error that a file couldn't be copied (Windows' "the volume couldn't be found"). The volume was dismounted. Both seem to indicate that the disk was disconnected during the process. But the disk was still on and spinning. A little less than 2TB were copied. Checking the SMART the disk didn't have an increased power count, no bad sectors nor any anomaly. According to the SMART the only thing that changed was the power-on hours. The disk itself never experienced a power off and power back on.

    I re-mounted it and put the remaining files to copy (deleting the one where the copying halted, as the file was corrupted). Everything went fine. Not happy with this I formatted it and put everything to copy again, from the start in one go, this time with no Veracrypt. Everything went fine. Read everything back, all ok. From this I assume the disk itself is good.

    But I needed the disk encrypted. New format, all from the start, this time creating an encrypted volume. Left it overnight. Now barely over a 1 TB was copied when the process failed again, in the same fashion. Yet another format/encrypt, now it crashed at a point further down the line than the very first attempt. Around 2TB were copied.

    All the while the disk's SMART remains clean. The volume is dismounting itself, with no apparent disconnection of the actual physical disk. It's very weird and it all happens when I'm away. I remembered the Window's event log and I found the entries pertaining to the disk (copied below, newest first, you have to start from the bottom)

    Things to notice:

    • System is Win 10 Entrprise LTSC, Veracrypt 1.24 U7
    • Other Veracrypt volumes remain mounted
    • Other connected HDDs remain connected
    • There are no power saving features enabled, nor the Seagate's enclosure powers itself down (other 3rd party ones do power down after some time on their own)
    • Even if power saving features were present there was an active copy process
    • I changed USB cable and port
    • I have other 13 Seagate Expansion, all full, all encrypted, all done in this same system, in the same fashion. Never a problem.

    I can just resume the copying from the last file when it fails, but this whole mess leaves me uneasy. Any ideas? It's like phantom comes in my sleep and clicks "dismount" in Veracrypt

    Thanks for reading, I know it's a bit of a WoT

    Log Name:      System
Source:        MSiSCSI
Date:          2021/04/03 18:46:13
Event ID:      108
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
Status 0x00001069 determining that device interface \\?\USB#VID_0BC2&PID_2322#MSFT30NAAYFXLM#{2accfe60-c130-11d2-b082-00a0c91efb8b} does not support iSCSI WMI interfaces. If this device is not an iSCSI HBA then this error can be ignored.  
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSiSCSI" />
    <EventID Qualifiers="0">108</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:46:13.489039500Z" />
    <EventRecordID>50940</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x00001069</Data>
    <Data>\\?\USB#VID_0BC2&amp;PID_2322#MSFT30NAAYFXLM#{2accfe60-c130-11d2-b082-00a0c91efb8b}</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          2021/04/03 18:45:52
Event ID:      16
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}" />
    <EventID>16</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:52.632793000Z" />
    <EventRecordID>50939</EventRecordID>
    <Correlation />
    <Execution ProcessID="6424" ThreadID="2524" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="HiveNameLength">85</Data>
    <Data Name="HiveName">\??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat</Data>
    <Data Name="KeysUpdated">0</Data>
    <Data Name="DirtyPages">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:47
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file . The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:47.636255300Z" />
    <EventRecordID>50938</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Application Popup
Date:          2021/04/03 18:45:44
Event ID:      26
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
Application pop-up: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 - Unexpected parameters
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:44.236928400Z" />
    <EventRecordID>50937</EventRecordID>
    <Correlation />
    <Execution ProcessID="592" ThreadID="1420" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Caption">Windows - Delayed Write Failed</Data>
    <Data Name="Message">Exception Processing Message 0xc0000222 - Unexpected parameters</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:44
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file <file.abc>. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:44.233169200Z" />
    <EventRecordID>50936</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data><file.abc></Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Application Popup
Date:          2021/04/03 18:45:44
Event ID:      26
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
Application pop-up: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 - Unexpected parameters
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:44.193025500Z" />
    <EventRecordID>50935</EventRecordID>
    <Correlation />
    <Execution ProcessID="592" ThreadID="608" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Caption">Windows - Delayed Write Failed</Data>
    <Data Name="Message">Exception Processing Message 0xc0000222 - Unexpected parameters</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:44
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file <file.abc>. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:44.192467800Z" />
    <EventRecordID>50934</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data><file.abc></Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Application Popup
Date:          2021/04/03 18:45:44
Event ID:      26
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
Application pop-up: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 - Unexpected parameters
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:44.083295400Z" />
    <EventRecordID>50933</EventRecordID>
    <Correlation />
    <Execution ProcessID="592" ThreadID="732" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Caption">Windows - Delayed Write Failed</Data>
    <Data Name="Message">Exception Processing Message 0xc0000222 - Unexpected parameters</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:44
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file <file.abc>. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:44.082424300Z" />
    <EventRecordID>50932</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data><file.abc></Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Application Popup
Date:          2021/04/03 18:45:43
Event ID:      26
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
Application pop-up: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 - Unexpected parameters
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.973184200Z" />
    <EventRecordID>50931</EventRecordID>
    <Correlation />
    <Execution ProcessID="592" ThreadID="608" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Caption">Windows - Delayed Write Failed</Data>
    <Data Name="Message">Exception Processing Message 0xc0000222 - Unexpected parameters</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:43
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file <file.abc>. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.972506100Z" />
    <EventRecordID>50930</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data><file.abc></Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Application Popup
Date:          2021/04/03 18:45:43
Event ID:      26
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
Application pop-up: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 - Unexpected parameters
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.863423000Z" />
    <EventRecordID>50929</EventRecordID>
    <Correlation />
    <Execution ProcessID="592" ThreadID="608" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Caption">Windows - Delayed Write Failed</Data>
    <Data Name="Message">Exception Processing Message 0xc0000222 - Unexpected parameters</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:43
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file <file.abc>. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.862311000Z" />
    <EventRecordID>50928</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data><file.abc></Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Application Popup
Date:          2021/04/03 18:45:43
Event ID:      26
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
Application pop-up: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 - Unexpected parameters
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.753206200Z" />
    <EventRecordID>50927</EventRecordID>
    <Correlation />
    <Execution ProcessID="592" ThreadID="732" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Caption">Windows - Delayed Write Failed</Data>
    <Data Name="Message">Exception Processing Message 0xc0000222 - Unexpected parameters</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:43
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file <file.abc>. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.752356200Z" />
    <EventRecordID>50926</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data><file.abc></Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Application Popup
Date:          2021/04/03 18:45:43
Event ID:      26
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      X-PC
Description:
Application pop-up: Windows - Delayed Write Failed : Exception Processing Message 0xc0000222 - Unexpected parameters
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.650378700Z" />
    <EventRecordID>50925</EventRecordID>
    <Correlation />
    <Execution ProcessID="592" ThreadID="1420" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Caption">Windows - Delayed Write Failed</Data>
    <Data Name="Message">Exception Processing Message 0xc0000222 - Unexpected parameters</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:43
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file <file.abc>. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">50</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.647426000Z" />
    <EventRecordID>50924</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data><file.abc></Data>
    <Binary>04000400020030000000000032000480000000006E0200C0000000000000000000000000000000006E0200C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          2021/04/03 18:45:43
Event ID:      140
Task Category: None
Level:         Warning
Keywords:      (8)
User:          X-PC\X
Computer:      X-PC
Description:
The system failed to flush data to the transaction log. Corruption may occur in VolumeId: S:, DeviceName: \Device\VeraCryptVolumeS.
(A device which does not exist was specified.)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
    <EventID>140</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000008</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.540595000Z" />
    <EventRecordID>50923</EventRecordID>
    <Correlation />
    <Execution ProcessID="3372" ThreadID="3900" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-21-3756490284-797257069-429076621-1001" />
  </System>
  <EventData>
    <Data Name="VolumeId">S:</Data>
    <Data Name="DeviceName">\Device\VeraCryptVolumeS</Data>
    <Data Name="Error">0xc000000e</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          2021/04/03 18:45:43
Event ID:      140
Task Category: None
Level:         Warning
Keywords:      (8)
User:          X-PC\X
Computer:      X-PC
Description:
The system failed to flush data to the transaction log. Corruption may occur in VolumeId: S:, DeviceName: \Device\VeraCryptVolumeS.
(A device which does not exist was specified.)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
    <EventID>140</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000008</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.540176000Z" />
    <EventRecordID>50922</EventRecordID>
    <Correlation />
    <Execution ProcessID="3372" ThreadID="3900" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-21-3756490284-797257069-429076621-1001" />
  </System>
  <EventData>
    <Data Name="VolumeId">S:</Data>
    <Data Name="DeviceName">\Device\VeraCryptVolumeS</Data>
    <Data Name="Error">0xc000000e</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          2021/04/03 18:45:43
Event ID:      140
Task Category: None
Level:         Warning
Keywords:      (8)
User:          X-PC\X
Computer:      X-PC
Description:
The system failed to flush data to the transaction log. Corruption may occur in VolumeId: S:, DeviceName: \Device\VeraCryptVolumeS.
(A device which does not exist was specified.)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
    <EventID>140</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000008</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.524562500Z" />
    <EventRecordID>50921</EventRecordID>
    <Correlation />
    <Execution ProcessID="3372" ThreadID="3900" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-21-3756490284-797257069-429076621-1001" />
  </System>
  <EventData>
    <Data Name="VolumeId">S:</Data>
    <Data Name="DeviceName">\Device\VeraCryptVolumeS</Data>
    <Data Name="Error">0xc000000e</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          2021/04/03 18:45:43
Event ID:      140
Task Category: None
Level:         Warning
Keywords:      (8)
User:          X-PC\X
Computer:      X-PC
Description:
The system failed to flush data to the transaction log. Corruption may occur in VolumeId: S:, DeviceName: \Device\VeraCryptVolumeS.
(A device which does not exist was specified.)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
    <EventID>140</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000008</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.522755700Z" />
    <EventRecordID>50920</EventRecordID>
    <Correlation />
    <Execution ProcessID="3372" ThreadID="3900" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-21-3756490284-797257069-429076621-1001" />
  </System>
  <EventData>
    <Data Name="VolumeId">S:</Data>
    <Data Name="DeviceName">\Device\VeraCryptVolumeS</Data>
    <Data Name="Error">0xc000000e</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          2021/04/03 18:45:43
Event ID:      137
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
The default transaction resource manager on volume S: encountered a non-retryable error and could not start.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="49156">137</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.512379200Z" />
    <EventRecordID>50919</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>S:</Data>
    <Binary>1C0004000200300002000000890004C000000000220000C000000000000000000000000000000000220000C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          2021/04/03 18:45:43
Event ID:      140
Task Category: None
Level:         Warning
Keywords:      (8)
User:          X-PC\X
Computer:      X-PC
Description:
The system failed to flush data to the transaction log. Corruption may occur in VolumeId: S:, DeviceName: \Device\VeraCryptVolumeS.
(A device which does not exist was specified.)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
    <EventID>140</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000008</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:43.520827000Z" />
    <EventRecordID>50918</EventRecordID>
    <Correlation />
    <Execution ProcessID="3372" ThreadID="3900" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-21-3756490284-797257069-429076621-1001" />
  </System>
  <EventData>
    <Data Name="VolumeId">S:</Data>
    <Data Name="DeviceName">\Device\VeraCryptVolumeS</Data>
    <Data Name="Error">0xc000000e</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          2021/04/03 18:45:42
Event ID:      140
Task Category: None
Level:         Warning
Keywords:      (8)
User:          SYSTEM
Computer:      X-PC
Description:
The system failed to flush data to the transaction log. Corruption may occur in VolumeId: S:, DeviceName: \Device\VeraCryptVolumeS.
(A device which does not exist was specified.)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482}" />
    <EventID>140</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000008</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:42.458133100Z" />
    <EventRecordID>50917</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="248" />
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="VolumeId">S:</Data>
    <Data Name="DeviceName">\Device\VeraCryptVolumeS</Data>
    <Data Name="Error">0xc000000e</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Disk
Date:          2021/04/03 18:45:38
Event ID:      157
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
Disk 3 has been surprise removed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Disk" />
    <EventID Qualifiers="32772">157</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:38.464629800Z" />
    <EventRecordID>50916</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\Harddisk3\DR3</Data>
    <Data>3</Data>
    <Binary>0000000002003000000000009D000480000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Disk
Date:          2021/04/03 18:45:38
Event ID:      153
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      X-PC
Description:
The IO operation at logical block address 0x157a93038 for Disk 3 (PDO name: \Device\00000045) was retried.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Disk" />
    <EventID Qualifiers="32772">153</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-03T21:45:38.449002100Z" />
    <EventRecordID>50915</EventRecordID>
    <Channel>System</Channel>
    <Computer>X-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\Harddisk3\DR3</Data>
    <Data>0x157a93038</Data>
    <Data>3</Data>
    <Data>\Device\00000045</Data>
    <Binary>0F01040004002C0000000000990004800000000000000000000000000000000000000000000000000000048A</Binary>
  </EventData>
</Event>
     

    Last edit: Nix Coleman 2021-04-03

  • See Bop

    See Bop - 2023-04-30

    Hey, did you ever figure out what was going on? I'm having the exact same problem, also with a Seagate 5tb drive. Weird

     

Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.