Windows Explored

Everyday Windows Desktop Support, Advanced Troubleshooting & Other OS Tidbits

Your Hard Disk is Failing

Posted by William Diaz on October 5, 2011


Sometimes a BSOD is not a sign of a software issue but instead points to a hardware problem and might help explain the symptoms of bad system performance. That was the case recently when a user complained that she was having troubles trying to logon. The workstation was amazingly slow (can slow be amazing?) and then blue-screened on her randomly. My co-worker was handling this but he happens to sit right next to me and I jumped in when I heard the words “blue screen”. I unkindly interjected with “Lets get a minidump.” While he chatted her up, I went about getting her IP, connected via the UNC, went into C:\Windows\Minidump and grabbed the last two mini dumps for that day.

Minidumps excite me. To understand why, you need to have come across a great amount of support calls that usually end up trumping first tier technical support. Often times, these issues are too vague to narrow down if you don’t know how to handle a BSOD, and the incident remains open longer than it needs because it can’t be explained or reproduced immediately. The mini dump provides a means to sometimes quickly resolve what might otherwise become an unexplained system problem.

Minidumps are small, too. Between 64 and 256KB, they only record the smallest set of useful information that could help identify why the system stopped unexpectedly so there would be no problem copying from over a WAN. Once copied over to my workstation, I opened with WinDbg, clicked the !analyze -v  hyper command. Both dumps produced identical results:

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 8a760670, Terminating object
Arg3: 8a7607e4, Process image file name
Arg4: 805d29b4, Explanatory message (ascii)

Debugging Details:
——————

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 8a760670

IMAGE_NAME:  hardware_disk

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAULTING_MODULE: 00000000

PROCESS_NAME:  csrss.exe

EXCEPTION_RECORD:  ba1e79d8 — (.exr 0xffffffffba1e79d8)
ExceptionAddress: 75b7b421
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000008
Parameter[1]: 75b7b421
Parameter[2]: c000000e
Inpage operation failed at 75b7b421, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 – The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000006 – The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  75b7b421

EXCEPTION_PARAMETER3:  c000000e

IO_ERROR: (NTSTATUS) 0xc000000e – A device which does not exist was specified.

EXCEPTION_STR:  0xc0000006_c000000e

FAULTING_IP:
+fc
75b7b421 ??              ???

BUGCHECK_STR:  0xF4_IOERR_C000000E

FOLLOWUP_IP:
+fc
75b7b421 ??              ???

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware_disk

SYMBOL_NAME:  +fc

STACK_COMMAND:  kb

FAILURE_BUCKET_ID:  0xF4_IOERR_C000000E_+fc

BUCKET_ID:  0xF4_IOERR_C000000E_+fc

Followup: MachineOwner
———

BSODs of this type, especially when they happen more than once in a short period (along with sluggish system performance), are usually a clear sign of a failing or failed hard drive. And don’t necessarily rely on the Windows Event Viewer to warn you of this. In the case here, there were no reports of those common disk errors you see with bad blocks. Hard drives can fail for any number of reasons, not specifically because of surface issues on the platter; read/write heads and actuator arms are other points of failure. SMART monitoring may also alert you to this as well if it is running. Waste no time in replacing the drive and trying to retrieve the important data when this is encountered. In fact, you are probably better off removing the drive and attaching it to an enclosure to retrieve data than trying to get it pass a Windows reboot and logon.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: