How to fix Error 798 on Windows 11

by

Troubleshooting Guide: Error 798 – Volume Corruption Log Cleared by CHKDSK

Why This Error Happens

Error 798 is an informational/warning event logged by the NTFS file system driver indicating that CHKDSK detected and cleared entries in the volume’s corruption tracking log ($Corrupt) because they no longer represented active corruption. This typically occurs when self-healing NTFS successfully repairs minor inconsistencies during an online scan, or when a previous corruption entry was already resolved but the log wasn’t cleaned up until the next CHKDSK pass. While the event itself is largely benign, it can indicate underlying disk health issues or improper shutdowns that triggered the initial corruption flags.

Step-by-Step Resolution Guide

  1. Verify the current disk state by opening an elevated Command Prompt (Run as Administrator) and executing:
   chkdsk C: /scan

Replace C: with the affected volume letter. This performs an online scan without dismounting the volume.

  1. Review Event Viewer logs to confirm no new corruption events have occurred:
  • Navigate to Event Viewer > Windows Logs > Application
  • Filter by Source: Microsoft-Windows-Ntfs and Event ID: 798
  • Check the timestamp against recent CHKDSK operations to confirm this is a one-time cleanup event.
  1. Run a full offline CHKDSK to ensure the volume is completely clean:
   chkdsk C: /f /r

This will prompt a restart if the volume is in use (e.g., the system drive). Allow the scan to complete fully during boot.

  1. Check disk hardware health using built-in diagnostics:
   wmic diskdrive get status

Or use winsat disk -drive c to assess performance and rule out failing hardware as the root cause of recurring corruption flags.

  1. Update storage drivers via Device Manager (devmgmt.msc → Disk Drives → right-click your drive → Update Driver) to rule out driver-level bugs causing false corruption flags.

Alternative or Verification Steps

  • Verify the fix: Re-run chkdsk C: /scan after a few days of normal usage. If no new Event ID 798 or related NTFS error codes (55, 130, 140) appear in Event Viewer, the volume is stable.
  • Alternative: If Error 798 recurs frequently, back up your data immediately and run Get-PhysicalDisk | Get-StorageReliabilityCounter in PowerShell to check for SMART attributes indicating impending drive failure.