Data Loss, multiple Event-ID's: 50, 140 and 153

Please do not down-play this post. This is a deep concern which is resulting in data not being saved. Two reference images are included or attached at/near the bottom. You can see via the included 'Reliability Monitor' image, things have recently quieted down. Then all of a sudden on 20231112, quite a few 'Event Viewer' entries are made. Here are three samples:

TimeCreated : 10/30/2023 4:46:33 PM
ProviderName : Ntfs
Id : 50
Message : {Delayed Write Failed} Windows was unable to save all the data for the file D:\$Mft. The data has
been lost. This error may be caused by a failure of your computer hardware or network connection.
Please try to save this file elsewhere.
-------------------------------------------------

TimeCreated : 10/30/2023 4:46:33 PM
ProviderName : Microsoft-Windows-Ntfs
Id : 140
Message : The system failed to flush data to the transaction log. Corruption may occur in VolumeId: D:,
DeviceName: \Device\HarddiskVolume13.

Failure status: A device which does not exist was specified.

Device GUID: {88701e30-76ad-11ee-8051-00410ebf35be}
Device manufacturer: SABRENT
Device model:
Device revision: 0104
Device serial number: DB9876543213F
Bus type: USB

Adapter serial number:
-------------------------------------------------

TimeCreated : 10/28/2023 6:35:32 AM
ProviderName : disk
Id : 153
Message : The IO operation at logical block address 0x1000 for Disk 2 (PDO name: \Device\00000095) was retried.

---

The above 'Event Viewer' entries are indicating data loss for both --files that are actively being written, as well as, files already being stored; not actively being written to. The machines hardware: A laptop, one internal SSD, three internal 3.5" HDD's connected via three separate Sabrent Docking-Station's and their respective USB cables. These disk and Ntfs entries are only associated with two of the USB connected HDD's: one 8\TB Seagate SkyHawk being written to constantly 24/7 --and an 8\TB WD_Red (NAS), accessed on-demand; storage.

QUESTION(s): How to isolate the problem? MotherBoard\USB, Sabrent D-Station or the OS. I very much doubt it's any of the HDD's from two different OEM's, and class of drive, generating the same 'Event Viewer' warnings. But then again, here I am posting because,'I don't Know'.

NOTE: There is no intention to update the OS unless, there is documentation confirming, said update will resolve a symptom/problem we are actively experiencing. Reason: since early Sept-2023, this is the third --same make\model laptop that has been swapped-out. Through trail and error, we have found --most of the previous issues we've experienced, have been post 'Windows Update'. This current install is from the OEM recovery image, without allowing the machine Inet access.

This current OS install is thee-most stable Win-11 has ever been.

NOTE-02: No available spare machine or other parts to swap via trail and error.

Respectfully

Query01 said:

QUESTION(s): How to isolate the problem? MotherBoard\USB, Sabrent D-Station or the OS. I very much doubt it's any of the HDD's from two different OEM's, and class of drive, generating the same 'Event Viewer' warnings. But then again, here I am posting because,'I don't Know'.

Click to expand...

i) Does all the Event ID 153 always complain about the same logic block address, in each error message that you read? Or does the error messages appear with randomly different messages?

ii) Open a CMD prompt Window and run CHKDSK on the suspected disk drive. For example, chkdsk D: /f. What message does CHKDSK produce?

iii) Swap HDDs and try them in different one of your Docking Stations and see where the error repeats. For example, you might see that the same Docking Station produces the errors, regardless of which HDD it contains. Or, you might see that one particular HDD always produces the errors, regardless of which docking station is used. Therefore, trying different HDDs in different Docking Stations will help you diagnose where the fault is being issued.

Knowing answers to these questions will help you find the issue of the fault.

@iko22 I have not abandoned this posting. I'm juggling this hardware between two machines addressing 'this' data-loss issue and --data-recovery of a 4\TB hdd. Nothing is going smoothly or as expected. Please be patient with me while I try to finish-up this data-recovery; after-which I'll get back to this post.

Respectfully

iko22 said:

i) Does all the Event ID 153 always complain about the same logic block address, in each error message that you read? Or does the error messages appear with randomly different messages?

Click to expand...

... different 'logic block addresses', on the same disk. I'll respond to ii) and iii), after the data-recovery releases that disk, which is the same disk involved with Event-ID 153.

iko22 said:

ii) Open a CMD prompt Window and run CHKDSK on the suspected disk drive. For example, chkdsk D: /f. What message does CHKDSK produce?

chkdsk

Reference article for the chkdsk command, which checks the file system and file system metadata of a volume for logical and physical errors.

learn.microsoft.com

Click to expand...

@iko22 please see attached results.

iko22 said:

iii) Swap HDDs and try them in different one of your Docking Stations and see where the error repeats. For example, you might see that the same Docking Station produces the errors, regardless of which HDD it contains. Or, you might see that one particular HDD always produces the errors, regardless of which docking station is used. Therefore, trying different HDDs in different Docking Stations will help you diagnose where the fault is being issued.

Click to expand...

@iko22 This (swap) is going to take some time to accomplish for the following reason(s): Not all of these entries are constant; may be intermittent. If you remember, within the image showing "Reliability Monitors' Report", the system was fairly quiet\stable for a few days, then all of a sudden --this flurry of events, mentioned in the title of this post. Since the timestamp of the above events, I had moved this combination "Sabrent Docking Station\disk 2" -aka- "WD_RED (D:)" from box-01, to another machine, box-02, in order to conduct --other unrelated task.​

Once moved, the combination is now identified as "Sabrent Docking Station\disk 2" -aka- "WD_RED (E:). By comparison, please review the attached file named Event-ID_153_comparison_.txt. If I'm following iko22's train of thought, these 153 retries, may be a factor as to why the Event-ID 50 (lost data), is being generated. At this point in time, while the combination was moved to box-02, even though the 153's continue, their were no Event-ID 50 (lost data) generated while connected to box-02.

A few hours before drafting this post, I returned the combination back to box-01; waiting for log activity. I need to be certain the issue remains with the original combination after the return back to box-01. Unless someone has a more concrete method.

Looking at your results posted in Posts #4, #5 and #6 the results indicate that errors occur at different logical addresses and on different disks. I would suggest that those results indicate a problem with the actual docking station that you are using.

iko22 said:

Looking at your results posted in Posts #4, #5 and #6 the results indicate that errors occur at different logical addresses and on different disks. I would suggest that those results indicate a problem with the actual docking station that you are using.

Click to expand...

Would you have a recommendation that could help me confirm its the station vs the laptop or OS? I have recently returned one of these stations. Confirmed defective by swapping things around, however my pocket ($$.xx), as well as my program\work are taking a serious hit with the data loss and down-time (swapping).

My goal is to present the OEM of the confirmed defective device with hard evidence. Or, should I consider this confirmation it's not Windows Eleven and open a thread on a hardware forum?

Query01 said:

Confirmed defective by swapping things around, however my pocket ($$.xx), as well as my program\work are taking a serious hit with the data loss and down-time (swapping).

My goal is to present the OEM of the confirmed defective device with hard evidence. Or, should I consider this confirmation it's not Windows Eleven and open a thread on a hardware forum?

Click to expand...

If I understood your presentation, then I would conclude that this is already pretty hard evidence, but you could try to repeat tests on a different OS/laptop and see if the issue symptoms repeats.
Either way, I would suspect if you told the OEM what you have already done, that they would take the matter seriously and accept return of the device.

@Query01

Get CrystalDiskInfo, here...



Get the ZIP (portable) version and run it, directing it at the disk in question.
Post a screen shot of the results.
If there's a problem with the disk or it's connections... it will show up in CrystalDiskInfo.


This is one of my hard drives...

@iko22 Alright then, @Ghot understood

Ghot said:

@Query01

Get CrystalDiskInfo, here...

Download

[2024/05/01] CrystalMark Retro 1.0.2 – Manual / History Standard Edition 2 themes / 27MB ZIP (XP-) INSTALLER (Vista-) Source Code Aoi Edition 2 themes / 27MB ZIP (XP-) INSTALLER (Vista-) [2025/03/04] CrystalDiskInfo 9.6.2 – Manual / History Aoi Edition 4 themes / 43MB ZIP (XP-) INSTALLER...

crystalmark.info

Get the ZIP (portable) version and run it, directing it at the disk in question.
If there's a problem with the disk or it's connections... it will show up in CrystalDiskInfo.

Click to expand...

Yes, although CHKDSK did not show any errors.