How to fix Error 797 on Windows 11

by

Windows 11 Volume Corruption Error 797 Troubleshooting Guide

Why This Error Happens

Error 797 occurs when NTFS detects that one of the volume’s corruption tracking logs ($Corrupt or similar Spotted Verifier logs) was deleted or truncated while it still contained active corruption records that hadn’t been remediated yet. This typically happens due to improper system shutdowns, disk write failures, or third-party disk utilities interfering with NTFS metadata files during a chkdsk cycle. Since the corruption log is the authoritative record of known bad sectors or file system inconsistencies, its premature deletion leaves the volume in an unverified state, forcing Windows to flag it for a mandatory rescan.

Step-by-Step Resolution Guide

  1. Open an elevated Command Prompt or Terminal
    Press Win + X, select Terminal (Admin) or Windows PowerShell (Admin).

  2. Run CHKDSK with the repair flag on the affected volume
    Execute the following, replacing C: with the actual drive letter reported in the error:

   chkdsk C: /scan /perf

This performs an online scan without requiring an immediate restart.

  1. If online scan reports unresolved corruption, schedule an offline repair
   chkdsk C: /f /r /x

Confirm the scheduling when prompted (type Y), then restart the machine so CHKDSK can run before Windows fully boots.

  1. Clear the stale corruption log via fsutil
    After CHKDSK completes, verify and reset the corruption tracking state:
   fsutil repair query C:

If it shows the volume still flagged, run:

   fsutil repair set C: 0

This clears the outdated “detected corruption” flag once the underlying issue is resolved.

  1. Check Event Viewer for confirmation
    Navigate to Event Viewer > Windows Logs > Application, filter by source Wininit or Ntfs, and confirm no new Event ID 797 or 55 (NTFS corruption) entries appear after the scan.

Alternative or Verification Steps

  • Verify the fix: Re-run chkdsk C: /scan — a clean result should return “No further action is required,” and Error 797 should no longer appear in Event Viewer on subsequent boots.
  • Alternative: If corruption persists after repair, back up data immediately and run wmic diskdrive get status (or check via Settings > System > Storage > Disks & volumes > Properties) to rule out failing hardware, since repeated log corruption often indicates a deteriorating physical disk.