Log Dejargonizer

Windows System Log · Event 98

Event 98: A volume was checked and is healthy

NTFS ran its background integrity check on a volume and found nothing wrong. It is the all-clear message, not a warning — people find it because they are searching after a crash and a message full of GUIDs looks alarming.

Also written as Event ID 98 NtfsNtfs 98 volume healthyHarddiskVolume is healthy

What it means for you

On a personal computer

Good news, oddly formatted. Windows checked one of your drives, found no problems, and wrote it down. It appears after a restart, after an unexpected shutdown, and periodically as part of routine maintenance. Nothing needs doing.

For an analyst

Useful as a negative control during storage triage: an Event 98 for a volume proves the online self-healing scan completed against it and found no corruption at that moment. It does not prove the underlying device is healthy — NTFS integrity and device reliability are different questions, and Event 98 answers only the first.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      System
Source:        Microsoft-Windows-Ntfs
Event ID:      98
Level:         Information
Computer:      DESKTOP-WKS042

Volume \\?\Volume{00000000-0000-0000-0000-000000000000} (\Device\HarddiskVolume4) is healthy.  No action is needed.

The fields that decide it

Everything else in the log line is context.

Volume identifier
Given as a volume GUID and a \Device\HarddiskVolumeN path rather than a drive letter, which is why the message looks impenetrable. Map it with `mountvol` or `Get-Volume | Select-Object DriveLetter, UniqueId, FileSystemLabel`.
Level
Always Information. If your filter is showing this as a warning, the filter is wrong.
Frequency
The diagnostic detail. Occasional entries after boots and maintenance windows are normal; the same volume every second is a known fault pattern and the event is then telling you about a stuck check, not about the disk.

Ordinary reasons this happens

Most of the time it is one of these.

  • Routine maintenance. The Spot Verifier service and the scheduled ProactiveScan task check volumes online and record the result.
  • A restart after an unexpected shutdown, where NTFS verifies the volume before bringing it fully online.
  • A volume being mounted — external drives and VHDs produce one each time they are attached.
  • Storage Spaces or a backup product mounting and dismounting snapshot volumes, each of which is checked.
  • A previous Event 55 having been resolved: after corruption is repaired, the next scan writes an Event 98 for the same volume.

What to do next

  1. Confirm the level is Information. If it is, there is no problem to triage.
  2. Translate the volume path to a drive letter if you want to know which disk it refers to: `Get-Volume | Select-Object DriveLetter, FileSystemLabel, UniqueId` and match the GUID.
  3. If the entries repeat continuously, check whether a backup or virtualisation product is mounting and dismounting a volume in a loop — that is the usual cause, and the fix is in that product, not in Windows.
  4. Look for Event 55 or Event 140 for the same volume nearby. Those are the events that report actual NTFS problems; an Event 98 for the same volume afterwards is confirmation the problem cleared.
  5. Check the online scan state with `fsutil repair query C:` before deciding to schedule an offline chkdsk. Event 98 means the online check passed, which usually makes an offline chkdsk unnecessary.

Queries to run

powershell Recent health confirmations. Compare the timestamps against your restarts. 
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Ntfs'; Id=98} -MaxEvents 50 | Select-Object TimeCreated, Message
powershell Maps the volume GUID in the event to a drive letter and shows Windows' own health verdict alongside it. 
Get-Volume | Select-Object DriveLetter, FileSystemLabel, HealthStatus, UniqueId
powershell Shows whether NTFS self-healing is enabled for the volume, which is what produces Event 98 in the first place. 
fsutil repair query C:
wevtutil Pulls the NTFS all-clear alongside the two NTFS problem events, which is the comparison that actually answers 'is this volume fine'. 
wevtutil qe System "/q:*[System[Provider[@Name='Microsoft-Windows-Ntfs'] and (EventID=98 or EventID=55 or EventID=140)]]" /c:30 /rd:true /f:text

Common questions

Is Ntfs Event 98 'volume is healthy' a problem?

No. It is the opposite — it is NTFS confirming that a background integrity check found no corruption on that volume. It is logged at Information level. People usually arrive at it because they are reading the System log after a crash and the GUID-heavy wording looks like an error.

Which drive does Event 98 refer to?

The event identifies the volume by GUID and by a \Device\HarddiskVolumeN path, neither of which is a drive letter. Run `Get-Volume | Select-Object DriveLetter, FileSystemLabel, UniqueId` and match the GUID from the event against UniqueId, or run `mountvol` with no arguments to list volume GUIDs against their mount points.

Does Event 98 mean chkdsk ran?

Not a full chkdsk. Modern Windows checks NTFS metadata online while the volume stays in use — the Spot Verifier service flags suspected problems and a scheduled scan verifies them. Event 98 is the result of that online process. A full offline chkdsk logs separately, under the Wininit source in the Application log.

Why do I get Event 98 every second?

That is not the disk failing; it is something mounting and dismounting a volume repeatedly. Backup software taking snapshots in a loop, a virtual disk being attached and detached, or a removable device with an intermittent connection all produce it. Find what is cycling the volume rather than trying to silence the event.

Read next

Vendor documentation

Last reviewed 7 September 2026