Why This Error Happens
Error 313 occurs when an application, script, or utility attempts to directly access, rename, delete, or write to a reserved NTFS metadata file (such as $MFT, $LogFile, $Bitmap, or $Secure). These files exist outside the standard file system namespace and are locked by the OS kernel to protect volume integrity, so Windows blocks any direct read/write handle requests to them. This is most commonly triggered by third-party backup tools, disk-imaging software, antivirus scanners, or custom scripts that enumerate the drive root and mistakenly try to process these hidden system files as if they were regular data.
Step-by-Step Resolution Guide
-
Identify the offending process: Open Event Viewer (
eventvwr.msc) → Windows Logs → Application/System, and locate the Error 313 entry. Note the source application and the exact file path referenced (it will contain a$prefix, e.g.,$MFT). -
Update or reconfigure the third-party tool: If a backup, antivirus, or disk-cloning tool triggered the error, check for a pending update from the vendor. Most modern versions include an exclusion list for NTFS metadata files — manually add the root of the affected drive (e.g.,
C:\) to the tool’s exclusion/skip-system-files list. -
Run CHKDSK to rule out corruption: Open Command Prompt as Administrator and run:
chkdsk C: /f /r
Schedule the scan on next restart if prompted, then reboot and allow it to complete. This repairs any underlying MFT or volume bitmap corruption that may cause the OS to defensively block access.
- Disable direct raw volume access in the failing script/app: If you’re running a custom script or command that scans
C:\recursively (e.g., usingrobocopy,xcopy, or PowerShellGet-ChildItem -Force), explicitly exclude system files:
Get-ChildItem -Path C:\ -Force | Where-Object { $_.Attributes -notmatch "System" }
- Check disk health via Storage settings: Go to Settings → System → Storage → Disks & volumes, select the affected drive, and click Properties → Check. Repair any reported errors before retrying the original operation.
Alternative or Verification Steps
- After applying fixes, retry the original operation (backup job, script, or copy task) and confirm Error 313 no longer appears in Event Viewer.
- If the issue persists, boot into Safe Mode and re-run the failing application in isolation — this helps confirm whether a background service (like antivirus real-time scanning) is interfering with file system handles.