Ntfs

Event	Title	Channel	Sample	Rule
55	A corruption was discovered in the file system structure on volume DriveName.	System	N	Y
130	The file system structure on volume VolumeId has now been repaired.	System	Y	N
131	The file system structure on volume VolumeId cannot be corrected.	System	N	N
132	Too many repair events have occurred in a short period of time.	System	N	N
133	Skipped posting of TotalCount repair events.	System	N	N

Event ID 55: A corruption was discovered in the file system structure on volume DriveName.

Channel: System

Message #

A corruption was discovered in the file system structure on volume %1.

%8

Fields #

Name	Description	Rules
`DriveName` UnicodeString
`DeviceName` UnicodeString
`CorruptionState` HexInt32
`HeaderFlags` HexInt32
`Severity` UnicodeString
`Origin` UnicodeString		1 detection rule
`Verb` UnicodeString
`Description` UnicodeString		2 detection rules
`Signature` HexInt32
`Outcome` UnicodeString
`SampleLength` UInt16
`SampleData` Binary
`SourceFile` HexInt32
`SourceLine` UInt16
`SourceTag` UInt32
`AdditionalInfo` HexInt32
`CallStack` AnsiString

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

NTFS Vulnerability Exploitation source high: This the exploitation of a NTFS vulnerability as reported without many details via TwitterT1499, T1499.001

Event ID 130: The file system structure on volume VolumeId has now been repaired.

Channel: System
Level: Warning

Message #

The file system structure on volume %2 has now been repaired.

Fields #

Name	Description
`VolumeIdLength` UInt16
`VolumeId` UnicodeString
`RepairDetail` UnicodeString
`RepairDataLength` UInt16
`RepairData` Binary

Example Event #

{
  "system": {
    "provider": "Ntfs",
    "guid": "{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}",
    "event_source_name": "",
    "event_id": 130,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-28T11:11:49.8428150+00:00",
    "event_record_id": 1821,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 4368
    },
    "channel": "System",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeIdLength": "2",
    "VolumeId": "C:",
    "RepairDetail": "25008: Start repair on 05/28/2026 at 11:11:49:821\n\n25017: Processing repair verb IndexEntry: 0x10000000013df, \"$I30\", \"bb3a785178f443fda931098a5a9a306b.db.ses\"\nFlags: 0x32, 0x0\n26065: Deleting index entry bb3a785178f443fda931098a5a9a306b.db.ses in index 0x10000000013df of file 0x3000000010fae.\n25009: End repair on 05/28/2026 at 11:11:49:837\n",
    "RepairDataLength": "152",
    "RepairData": "0D000000FFFFFFFFFFFFFFFFE300170006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  },
  "message": "The file system structure on volume C: has now been repaired."
}

Event ID 131: The file system structure on volume VolumeId cannot be corrected.

Channel: System

Message #

The file system structure on volume %2 cannot be corrected.
Please run the chkdsk utility on the volume %2.

Fields #

Name	Description
`VolumeIdLength` UInt16
`VolumeId` UnicodeString
`RepairDetail` UnicodeString
`RepairDataLength` UInt16
`RepairData` Binary

Event ID 132: Too many repair events have occurred in a short period of time.

Channel: System

Message #

Too many repair events have occurred in a short period of time.
Temporarily suspending posting of further repair events.

Event ID 133: Skipped posting of TotalCount repair events.

Channel: System

Description

Skipped posting of TotalCount repair events. Repair event posting will now be resumed.

Message #

Skipped posting of %1 repair events.  Repair event posting will now be resumed.
 Here are the skipped posting repair events count by repair verbs:
 BadFRS: %2
 OrphanChildFRS: %3
 BadClusters: %4
 BadFreeClusters: %5
 CrossLink: %6
 SDEntry: %7
 InvalidSecurityId: %8
 IndexAttribute: %9
 IndexSubtree: %10
 IndexOffset: %11
 IndexEntry: %12
 IndexOrder: %13
 Connect: %14
 BreakCycle: %15
 FRSAllocate: %16
 Others: %17

Fields #

Name	Description
`TotalCount` UInt32
`BadFrsCount` UInt32
`OrphanChildFRSCount` UInt32
`BadClustersCount` UInt32
`BadFreeClustersCount` UInt32
`CrossLinkCount` UInt32
`SDEntryCount` UInt32
`InvalidSidCount` UInt32
`IndexAttributeCount` UInt32
`IndexSubtreeCount` UInt32
`IndexOffsetCount` UInt32
`IndexEntryCount` UInt32
`IndexOrderCount` UInt32
`ConnectCount` UInt32
`BreakCycleCount` UInt32
`FRSAllocateCount` UInt32
`OthersCount` UInt32

Provenance

ETW provider GUID dd70bc80-ef44-421b-8ac3-cd31da613a4e

Defined in ntfs.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3328, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB