Windows System Log · Event 140
Event 140: NTFS could not write to its transaction log
NTFS keeps a journal so it can recover if a write is interrupted. Event 140 means it could not write to that journal. The message says corruption may occur, which is alarming and accurate — but the cause is almost always the volume becoming unreachable, not the filesystem itself going wrong.
Also written as Event ID 140 Ntfsntfs 140 corruption may occurtransaction log flush failed
- How oftenUncommon
- Vendor calls itWarning
- LogSystem
- SourceNtfs
What it means for you
On a personal computer
Windows keeps a notebook of what it is about to change on a disk, so it can finish the job if the power goes. This says it could not write in that notebook. Nine times out of ten the drive it names is a USB or network drive that went away. Check that drive before worrying about your main one.
For an analyst
The parenthetical reason at the end of the message is the whole event. 'A device which does not exist was specified' means the volume disappeared — removable media, an unmounted VHD, an iSCSI path that dropped — and is benign in the sense that NTFS is reporting a disconnection, not damage. Anything describing an I/O error or a device not ready points at the storage path and belongs in the same investigation as Events 153 and 129.
The fields that decide it
Everything else in the log line is context.
- VolumeId and DeviceName
- Which volume. DeviceName is a \Device\HarddiskVolumeN path; match it with mountvol or Get-Volume before assuming which drive letter it was.
- The reason in brackets
- The final parenthetical is the actual cause and the field people skip.
-
A device which does not exist was specifiedThe volume went away — removable media, a dismounted VHD, a dropped iSCSI or network path. Common and usually harmless. -
The device is not readyThe disk is present but not responding. Look at Events 153 and 129. -
The request could not be performed because of an I/O device errorA genuine read or write failure on the hardware. -
Insufficient system resources exist to complete the requested serviceMemory or handle exhaustion rather than a disk fault. Investigate load, not storage. - Whether Event 55 follows
- 55 is NTFS reporting corruption it has actually found. 140 warns that corruption is possible; 55 says it happened.
- Volume type
- Whether the volume is a local disk, a mounted image, a virtual disk, or removable media. Mounted VHDs and backup targets produce most of the benign instances.
Common questions
Should I panic about 'Corruption may occur' in Event 140?
No, but do read the rest of the line. That phrase is boilerplate NTFS uses whenever it loses its journal, regardless of why. The reason in brackets at the end tells you whether the volume simply went away — the common, harmless case — or whether the hardware failed a write, which is the case worth chasing.
Event 140 names a volume I do not recognise. How do I identify it?
Use 'mountvol' at an elevated prompt, or Get-Volume in PowerShell, to map \Device\HarddiskVolumeN paths to drive letters. Very often the answer is that it has no letter at all — a system reserved partition, a mounted backup image, or a VHD that has since been dismounted, which explains why the volume was unreachable.
What is the difference between Event 140 and Event 55?
140 is a warning that NTFS could not write its journal, so recovery from an interrupted write may not be possible. 55 is NTFS reporting that it has found actual structural corruption on the volume. 140 says the seatbelt is not fastened; 55 says there has already been a crash. A 55 should always be followed by chkdsk; a 140 on its own often needs nothing.
Do I need to run chkdsk after Event 140?
Only if the volume in question is one you still use and either Event 55 appeared, or the reason in brackets describes a hardware error rather than a missing device. A 140 caused by a USB drive being pulled out needs no action beyond checking whatever was being copied at the time.
Read next
- Escalation of Event 55: NTFS found corruption on a volume NTFS finding real corruption, rather than warning that it might occur.
- Usually comes before Event 157: A disk disappeared without being ejected A disk being surprise removed, the most common reason the transaction log suddenly cannot be written.
- Usually comes before Event 153: A disk read or write had to be retried I/O retries on the same volume, which point at the storage path rather than a disconnection.
- Read alongside Event 51: A paging error on a disk A paging error, which frequently accompanies this when the underlying disk is genuinely failing.
Mentioned by
Vendor documentation
Last reviewed 6 September 2026