Windows Event ID 823 – Ntfs: Critical Disk I/O Error Detected

Start by examining the complete Event ID 823 details to identify the affected file and error specifics.

1. Open Event Viewer → Windows Logs → System
2. Filter for Event ID 823 using the filter option
3. Double-click the most recent Event ID 823 entry
4. Note the Description field containing file path and error code
5. Record the Device and Logical Block Address (LBA) information

Use PowerShell to query recent Event ID 823 occurrences:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=823} -MaxEvents 10 | Format-Table TimeCreated, LevelDisplayName, Message -Wrap

Export detailed event information for analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=823} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\Temp\Event823_Analysis.csv" -NoTypeInformation

Execute CHKDSK to scan and repair NTFS file system corruption that may be causing Event ID 823.

1. Open Command Prompt as Administrator
2. Run CHKDSK on the affected drive (typically C:):

chkdsk C: /f /r /x

For detailed scanning with bad sector recovery:

chkdsk C: /f /r /x /b

3. Schedule the scan for next reboot when prompted
4. Restart the system to allow CHKDSK to run
5. Monitor the scan progress and note any errors found

Use PowerShell to check CHKDSK results:

Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Wininit'} | Where-Object {$_.Message -like '*chkdsk*'} | Select-Object TimeCreated, Message

Check physical disk health using SMART attributes to identify potential hardware failures causing Event ID 823.

1. Open Command Prompt as Administrator
2. Run WMIC to check disk health status:

wmic diskdrive get status,model,serialnumber

Use PowerShell to get detailed disk information:

Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, HealthStatus, OperationalStatus, Size

Check SMART data for critical attributes:

Get-StorageReliabilityCounter | Select-Object DeviceId, Temperature, ReadErrorsTotal, WriteErrorsTotal

3. Review HealthStatus for any "Warning" or "Unhealthy" disks
4. Check Temperature values for overheating issues
5. Monitor ReadErrorsTotal and WriteErrorsTotal for increasing error counts

Generate a comprehensive disk health report:

Get-PhysicalDisk | Get-StorageReliabilityCounter | Export-Csv -Path "C:\Temp\DiskHealth_Report.csv" -NoTypeInformation

Update storage controller drivers and disk firmware to resolve compatibility issues causing I/O errors.

1. Open Device Manager → Storage controllers
2. Right-click each storage controller and select Update driver
3. Choose Search automatically for drivers

Use PowerShell to identify storage drivers:

Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like '*storage*' -or $_.DeviceName -like '*SATA*' -or $_.DeviceName -like '*SCSI*'} | Select-Object DeviceName, DriverVersion, DriverDate

Check for Windows Updates that include storage drivers:

Get-WindowsUpdate -Category Drivers | Where-Object {$_.Title -like '*storage*' -or $_.Title -like '*disk*'}

4. Visit the motherboard or storage controller manufacturer's website
5. Download the latest drivers for your specific hardware model
6. Install drivers and restart the system
7. Check BIOS/UEFI for storage controller firmware updates

Verify driver installation success:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-PnP'} -MaxEvents 20 | Where-Object {$_.Message -like '*storage*'}

Perform advanced diagnostics by correlating Event ID 823 with other storage-related events and checking Storage Spaces configuration.

1. Query related storage events for pattern analysis:

$Events = @(823, 824, 825, 829, 830)
foreach ($EventID in $Events) {
    Write-Host "Event ID $EventID occurrences:"
    Get-WinEvent -FilterHashtable @{LogName='System'; Id=$EventID} -MaxEvents 5 -ErrorAction SilentlyContinue | Select-Object TimeCreated, Id, LevelDisplayName
}

Check Storage Spaces pool health if applicable:

Get-StoragePool | Select-Object FriendlyName, HealthStatus, OperationalStatus
Get-VirtualDisk | Select-Object FriendlyName, HealthStatus, OperationalStatus, ResiliencySettingName

2. Analyze disk performance counters for I/O bottlenecks:

Get-Counter "\PhysicalDisk(*)\Avg. Disk sec/Read", "\PhysicalDisk(*)\Avg. Disk sec/Write", "\PhysicalDisk(*)\Current Disk Queue Length" -SampleInterval 5 -MaxSamples 12

Create a comprehensive diagnostic report:

$Report = @{}
$Report.DiskHealth = Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus
$Report.StoragePools = Get-StoragePool | Select-Object FriendlyName, HealthStatus
$Report.RecentEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=823} -MaxEvents 10
$Report | ConvertTo-Json -Depth 3 | Out-File "C:\Temp\Storage_Diagnostic_Report.json"

3. Review Reliability Monitor for hardware failure patterns
4. Check Performance Monitor for sustained high disk queue lengths
5. Consider running manufacturer-specific disk diagnostic tools