4iT IT Support Sydney | Your Reliable Sydney IT Support Partner

Knowledge Base

How to Find CHKDSK Results in Windows Event Viewer

To find CHKDSK results in Windows, open Event Viewer and look in the Application log for events from the source “Wininit” (for a check disk that ran at startup) or “Chkdsk” (for a scan of a non-system volume). Wininit logs the full chkdsk report under Event ID 1001, so you can read exactly what the scan found and fixed without having watched it run.

Windows Event Viewer open on a monitor showing a log of events

Key facts

  • CHKDSK results are written to the Windows Application log, not saved as a separate file.
  • A boot-time check disk logs under the source “Wininit”, Event ID 1001.
  • A scan of a non-system drive while Windows is running logs under the source “Chkdsk”.
  • You can filter the Application log by source to find the report quickly.
  • PowerShell’s Get-WinEvent can pull the same report straight to the screen.

How do you find CHKDSK results in Event Viewer?

Event Viewer keeps the chkdsk report in the Application log, and filtering by source gets you there fastest. Press the Windows key, type eventvwr, and open Event Viewer. Expand Windows Logs and select Application. In the Actions pane on the right, click “Filter Current Log”, and in the “Event sources” box choose Wininit (or Chkdsk for a non-system drive). Click OK, then open the most recent matching event to read the full report, including the number of files processed and any errors found and corrected.

How do you read CHKDSK results with PowerShell?

PowerShell pulls the chkdsk report to the screen in one command, which is handy on a server or over a remote session. Run this in an elevated PowerShell window:

Get-WinEvent -FilterHashtable @{logname="Application"; id=1001} | Where-Object {$_.ProviderName -match "wininit"} | Format-List TimeCreated, Message

That returns the time of the scan and the full text of the report. It is the quicker option when you just want the result and do not need to click through the Event Viewer interface.

Why are CHKDSK results not saved as a file?

Windows logs chkdsk output to the Event Log rather than a text file because a boot-time check runs before the normal desktop and file system are fully available, so there is nowhere convenient to write a file. Logging to the event system, which is designed to capture exactly this kind of early-boot information, is the reliable place to put it. The upshot is that if you missed the report scrolling past during startup, it is not lost; it is sitting in the Application log waiting for you. (This trips people up constantly, so it is worth knowing.)

Frequently asked questions

What is the difference between the Wininit and Chkdsk sources?

The source tells you how the scan ran. Wininit logs a check disk that ran during Windows startup, which is what happens when chkdsk is scheduled against the system drive. The Chkdsk source logs a scan you ran manually against a non-system drive while Windows was already running. Both contain the same style of report.

How do I know if CHKDSK found problems?

Read the report in the event. It states how many files were processed and, importantly, whether any errors were found and whether they were repaired. Phrases such as “Windows has made corrections to the file system” mean problems were found and fixed; a clean report lists no corrections. Repeated errors across runs can signal a failing drive.

Can I export the CHKDSK report?

Yes. In Event Viewer, right-click the event and choose “Save Selected Events” to export it, or copy the event text directly. With PowerShell you can pipe the output to a text file by adding | Out-File chkdsk-report.txt to the command, which is useful when you need to send the result to someone.

Repeated disk errors are often the first warning of a drive that is about to fail, and on a business machine that means a backup you can actually restore from matters. If your backups have never been tested, happy to take a look.

Brett Muscio

About the author

Brett Muscio is the Director of 4iT Support Pty Ltd, a managed services provider based in Castle Hill, NSW. He works with SME clients across Sydney, Melbourne, and Brisbane on managed IT support, backup and disaster recovery, and Windows administration, with on-site support across the Sydney metro area and remote delivery nationally. Connect on LinkedIn.

 

Scroll to Top