none
BitLocker Error Appears in Event Viewer After Each Bootup

    Question

  • Have a Dell Studio XPS 9100 computer with Windows 7 Prof installed. 

    After each bootup, in the event viewer, the Error Warning of : Error Code: 0x80000010, EventID: 24620, with the following information:

    "Encrypted volume check: Volume information on

    \\?\Volume{d3353cee-e448-11df-acd3-806e6f6e6963} cannot be read". 

    Error started to appear after May 2011 MS Security Updates. However I am not sure that the updates are the cause of this error. Since Windows 7 Prof does not have the BitLocker capability, it is strange that this error would appear. Any help in resolving this error, would be very much appreciated, Sam

    Saturday, July 16, 2011 6:17 PM

Answers

  • Windows 7 is performing a check to see if the volume has been encrypted for use with BitLocker. During this check a read operation is sent to the drive. The drive returns an error indicating it has a bad block and the OS stops mounting the drive.

    From the System event log you will see entries such as:

    Event ID: 7
    Event Type: Error
    Event Source: Disk
    Event Description:  The device, \Device\Harddisk1\DR2, has a bad block.

    Event ID: 24620
    Event Type: Error
    Event Source: Microsoft-Windows-BitLocker-Driver 
    Event Description: Encrypted volume check: Volume information on D: cannot be read.


    You said you ran chkdsk against the OS drive, but this may not be the OS drive - \\?\Volume{d3353cee-e448-11df-acd3-806e6f6e6963}

    Run mountvol from a command prompt with no switches to figure out which drive letter corresponds to that path. The mappings will be listed beneath Possible values for VolumeName along with current mount points are: in the mountvol (no switches) output.

    Once you know which drive it is complaining about, run chkdsk on that drive.

    The mappings are stored in HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices, and Windows will leave entries there even if the device is no longer present on the system in case it is every present again in the future.

    You can run mountvol /r to remove stale entries for stuff that is no longer on the system. I would back up that MountedDevices registry key first just to cover yourself.

    • Proposed as answer by pkn2011 Sunday, July 17, 2011 5:13 PM
    • Marked as answer by Miya YaoModerator Thursday, August 04, 2011 2:33 AM
    Sunday, July 17, 2011 4:34 PM

All replies

  • Hi ScamSam, you said..

    After each bootup, in the event viewer, the Error Warning of : Error Code: 0x80000010,EventID: 24620, with the following information:

     

    Run a command prompt as Administrator and run a check disk on the drive in question, there might be a clue there.    At the prompt type>      chkdsk <enter>

    Sorry I can't recall offhand any of the parameters used with chkdsk though. I wanted to get its help up the other day but couldn't. Luckily my drive returned no errors so I've left it at that for the moment.. 

    Regards, pkn2011

     

    Sunday, July 17, 2011 3:41 AM
  • pkn2011, thanks for your reply.  I recently ran chkdsk and the OS HD was okay (full scan).  Have a good week, Sam. 
    Sunday, July 17, 2011 3:05 PM
  • hI SAM, you said..

    pkn2011, thanks for your reply. I recently ran chkdsk and the OS HD was okay (full scan). Have a good week, Sam.

     

    And to you. Good to see your disk is okay.. btw I rechecked for how to get 'help' and found it's not a parameter of the command - but the command is a parameter of help. weird.

    So type at prompt>  HELP chkdsk <enter>

    Regards, pkn2011

     

    • Edited by pkn2011 Sunday, July 17, 2011 4:02 PM Added CRs
    Sunday, July 17, 2011 3:59 PM
  • Windows 7 is performing a check to see if the volume has been encrypted for use with BitLocker. During this check a read operation is sent to the drive. The drive returns an error indicating it has a bad block and the OS stops mounting the drive.

    From the System event log you will see entries such as:

    Event ID: 7
    Event Type: Error
    Event Source: Disk
    Event Description:  The device, \Device\Harddisk1\DR2, has a bad block.

    Event ID: 24620
    Event Type: Error
    Event Source: Microsoft-Windows-BitLocker-Driver 
    Event Description: Encrypted volume check: Volume information on D: cannot be read.


    You said you ran chkdsk against the OS drive, but this may not be the OS drive - \\?\Volume{d3353cee-e448-11df-acd3-806e6f6e6963}

    Run mountvol from a command prompt with no switches to figure out which drive letter corresponds to that path. The mappings will be listed beneath Possible values for VolumeName along with current mount points are: in the mountvol (no switches) output.

    Once you know which drive it is complaining about, run chkdsk on that drive.

    The mappings are stored in HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices, and Windows will leave entries there even if the device is no longer present on the system in case it is every present again in the future.

    You can run mountvol /r to remove stale entries for stuff that is no longer on the system. I would back up that MountedDevices registry key first just to cover yourself.

    • Proposed as answer by pkn2011 Sunday, July 17, 2011 5:13 PM
    • Marked as answer by Miya YaoModerator Thursday, August 04, 2011 2:33 AM
    Sunday, July 17, 2011 4:34 PM
  • Hi Craig, thanks for your message. I had no idea how to suggest checking the \\?\Volume type of path.

    Regards, pkn2011

     

    Sunday, July 17, 2011 5:12 PM
  • Craig, many thanks for the excellent information. 

     I ran the mountvol  command and it listed all of the volume names with the currect mount points (C, D,E, I, J, K, L, M, and N.   However, there was one exception on this list, it listed a volume name (the one listed in the event viewer error as indicated in my original post)) and with it, had the following information:  NOT MOUNTABLE UNTIL A VOLUME MOUNT POINT IS CREATED. 

    I went into the registry and found mount points ( I hope I am correct in the use of that term!) from C: thru P:, and in addition had seventeen volume names without any partition or volume letters.  Included in this part of the list, was the volume being listed in the event viewer as the BitLocker error.   

    i should note that periodically, I connect an external HD with two volumes G, and H, for backup purposes.  Also, in Disk Management, there are two volumes without any volume letters (one is the Dell Diagnostic and the other the Dell Recovery).

    Any further thoughts would be very much appreciated. 

    P.S  In using the mountvol/r, how do you select the volume to remove before any removal is completed, or is it when using the mount/vol command,  it gives you the oportunity to select which volume name to remove before any removal?? 

    Thanks again for your help, Sam.

    Monday, July 18, 2011 6:56 PM
  • Hi Craig, hope you can review my reply of 18 July 2011.  Your additional help  would be very much appreciated, Sam.
    Sunday, July 24, 2011 3:28 PM
  • Hi there Sam,I can only suggest that, armed with your added info on the subject - try searching for things like mountvol and bitlocker etc, in the Win7 forums generally, especially the Win 7 Hardware forum. There's lots of threads out there on HDs and how to use the system commands to fix them.. See if you can spot something that answers your questions directly.

     

    Regards, pkn2011


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    Sunday, July 24, 2011 4:15 PM
  • pkn2011, thanks very much for your reply.  I have used Google and also did as you suggested but still no clear answer as to how to proceed.  I  also ran the chkdsk for the second internal HD and for the external HD, and did not see any problems with the HDs.  Have a good week, Sam.
    Monday, July 25, 2011 4:07 PM
  • Does this computer have SP1 installed?

    mountvol /r is the full command you would run to clean out unused mount points. You don't specify a particular mount point. Mountvol compares those MountedDevices registry entries to the volumes that are currently present, so it knows which ones to remove.

    Try this:

    1. Disconnect that external drive if it is currently connected.
    2. Back up the MountedDevices registry key, either from Regedit or via command-line:

      reg export HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices MountedDevices.reg

      I don't suspect you'll need this but it never hurts to have a backup of a registry key before you make changes.
    3. Use Mountvol to remove stale entries for mount points that are mapped to locations not currently present on the system:

      mountvol /r
    4. Reboot and then check the System log for a 24620.
    5. Assuming you didn't get a 24620 at this point, reconnect the external drive, reboot, and check for the 24620 again.

    Monday, July 25, 2011 4:52 PM
  • Craig, very much appreciate your detailed and clear reply.  Will try the procedures as you listed, and will provide a status report after I am finiished.  Thanks again, Sam.
    Monday, July 25, 2011 6:14 PM
  • Hi Craig, you said..

    Use Mountvol to remove stale entries for mount points that are mapped to locations not currently present on the system:

    When running the command I only see physical devices listed. If you have Virtual Disks that you want to remove from the system is there a command to do this as well, or is this only possible through UNmapping Network drives.

     

    Regards, pkn2011


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    Monday, July 25, 2011 10:40 PM
  • Craig, made my restore point backup, registry backup and Image backup.  Ran the mountvol /r command but nothing happened.   I must be missing some obvious point!!  

    On the command prompt icon, I selected the Run as Administrator, and had the prompt of c:\windows\system32>.   I first typed in mountvol /r (space between the l and the /), hit enter button but nothing happened.  I rebooted then tried the mountvol/r (no space between the l and /), still nothing happened.  Rebooted, ran the mountvol and the non mounted entry was still there and in the event viewer, still had the same Bitlocker error and the 24620 again.  What obvious step(s) am I missing????  Very much appreciate any further help, Sam.

    Tuesday, July 26, 2011 1:14 AM
  • Hi Sam, do you have an online backup installed? This might be the encrypted data that's appearing.

     

    pkn2011


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    Tuesday, July 26, 2011 1:18 AM
  • And did you say this is Windows 7 with, or without Service Pack 1 installed?
    Tuesday, July 26, 2011 2:09 AM
  • Craig, many thanks for the reply.  Sorry, should have mentioned in my initial post that I have Windows 7 Prof with Service Pack 1 installed.  A couple of months ago, I installed SP1 installed without any problems.  Sam

     

    pkn2011, thanks for your reply also.  I have not used an online backup, Sam

    Tuesday, July 26, 2011 2:50 PM
  • Craig, any further help would be very much apprecited, Sam.

    Thursday, July 28, 2011 8:30 PM
  • Hi Sam, you said..    I have not used an online backup

     

    Well, what about other software that encrypts. Perhaps a Vault. Or a password store. Someone's sent you an encrypted email attachment. Is the encryption stopping you from using any of your devices?

     

    Storm in a teacup mebbe, pkn2011


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    Friday, July 29, 2011 1:36 AM
  • pkn2011, many thanks for your reply. 

    The only encryption I have on the computer is for one folder, using WinZip.  WinZip was installed on the computer when I first received it in October, 2010, and at that time I also created the encrypted folder.   The BitLocker error did not appear until 18 April 2011, shortly after the install of the April MS Security updates.  Regarding the receipt of any encrypted mail, I have not received any with this computer.

    However to make sure that the WinZip encrypted folder is not the cause, I will move it to an external HD (disconnect the external HD) and then see if  that makes any difference  Thanks, again, Sam.

    Friday, July 29, 2011 6:58 PM
  • Hi Sam, you said.. However to make sure that the WinZip encrypted folder is not the cause, I will move it to an external HD (disconnect the external HD) and then see if that makes any difference Thanks, again, Sam.

     

    No worries. Tell us how it all went. pkn2011


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    Friday, July 29, 2011 11:23 PM
  • Hi Craig, you said.. mountvol /r is the full command you would run to clean out unused mount points. You don't specify a particular mount point. Mountvol compares those MountedDevices registry entries to the volumes that are currently present, so it knows which ones to remove

     

    Well I decided to try actually editing the registry - rather than just looking at it. (That catches me up a few years), backed it up in full, backed up the MountedDevices key and connected as many of my Networked Volumes just in case I lost them.

    With one 'mountvol /r' Entered, some 20+ odd lingering \\?\Vol type paths and some old Vaults and a removed physical drive G:\ were now gone. Excellent! So now only 4 drives and 4 \\?\vols remained - and I could tell which correlated with which from the Data field. Also, No disconnected Network shares disappeared- which was worrying me beforehand. And as a bonus it seems to have fixed my Media Devices as listed in Network of my Laptop.

     

    Thanks again, pkn2011


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    Saturday, July 30, 2011 12:33 AM
  • pkn2011, removed the WinZip encrypted folder as I mentioned, but unfortunately it did not stop the BitLocker error.  My gut feeling is that this error has something to do with the April MS Security updates, since it did not appear until shortly after the April updates. 

    Thanks again for your help, Sam.

    P.S. pkn2011, when you ran the command mountvol /r, did you immediately see some response to the command?  When I typed in the mountvol /r command and pressed the enter button, nothing happened or no information appeared as a response.  I entered the command mountvol /r with and without a space between the letter l and the forward slash.  Any comments regarding this, would be appreciated. 

    Saturday, July 30, 2011 2:55 PM
  • Hi Sam, you said. did you immediately see some response to the command?

     

    Well definitely, I was watching from within the registry as the following occurred.. (extract follows)

    With one 'mountvol /r' Entered, some 20+ odd lingering \\?\Vol type paths and some old Vaults and a removed physical drive G:\ were now gone. Excellent! So now only 4 drives and 4\\?\vols remained

    etc.. Lot's of CMDs report very little - if at all. That stems back to the PCs - PRE-multitasking origins..

    Also Re: bitlocker "error" you're only seeing it perhaps as you're checking your event viewer. I don't bother checking the logging really, if fact I try to turn logging off wherever possible.. So for all I know I've got a similar thing happening. As long as everything is working well why stress about some cryptic error message? That's my personal Zen type approach to such things anyways. 8-)

    Singing.. Don't worry, be happy.. Regards, pkn2011


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    Saturday, July 30, 2011 3:29 PM
  • Many Thanks, Sam.
    Saturday, July 30, 2011 5:29 PM
  • ...unfortunately it did not stop the BitLocker error.  My gut feeling is that this error has something to do with the April MS Security updates, since it did not appear until shortly after the April updates.

    I don't understand why this is marked as Answered when you still have the problem? I found this thread after plugging-in a new Seagate external drive today and getting the same error:

    I tried the mountvol /r command, and while it did clean-up the MountedDevices key, and yes ScamSam it took the blink-of-an-eye and showed nothing in cmd.exe, only regedit, after reboot I still get the error when inserting the drive. DiskCheck gave it a clean bill of health, and in fact I've used it several times on another PC with no problem.

    I'm wondering if the fact that it's a 2TB drive is confusing Windows or this other PC somehow; it's also a USB3.0 device plugged-in to a USB2.0 port; maybe the driver doesn't like it...

    EDIT: Well it seems my BitLocker error is gone, and with it a couple of VDS errors also. I did a few things like cleaning-out old drivers showing Hidden Devices in Device Manager, but I suspect it was disabling the Acronis Nonstop Backup Service that did it. Any chance ScamSam you have Acronis installed?
    Friday, August 12, 2011 4:37 PM
  • Maxblack, thanks very much for your post.  I don't have or have ever installed  any Acronis programs on my computer, but do have the Paragon Backup and Recovery 10 Home installed.  However, this was installed when I first received my computer last year and only started to have the BitLocker error  in May of this year.  Also, I have not changed the external HDs since I first received the computer. 

    Your idea in checking for hidden devices  in Device Manager was excellent.  I checked for hidden devices in my computer and the only thing of interest were the "Storage Volumes" had nine Genernic Volume entries and the "Storage Volume Shadow Volume Shadow Copies" had over one hundred and thirty Generic Volume Shadow Copy entries.  Unfortunatelly don't know about the significance of those entries.  I should mention that approxomately five weeks ago had to replace ram memory and this this week, had the motherboard replaced.  These computer repairs seemed to removed most of my unusual computer problems, except for the BitLocker error which is still showing up on the computer during bootup.    Thanks again for your post, Sam.

    Friday, August 12, 2011 5:57 PM
  • Hi!,

    I have 1TB external drive which I used yesterday to enable the bitlocker. since the encryption process was too slow for 600mb data. I left it running over night & morning I checked the system that the process was hung. I ejected the external drive & attached again to check it. It prompt me for password but it gets hung after 20 mins. I notice the event/logs & found that "The device, \Device\Harddisk1\DR2, has a bad block."

    I tried the recovery key too but had the same log "The device, \Device\Harddisk1\DR3, has a bad block."

    Please suggest to get data back.

    Thanks,
    kambleam
    Tuesday, April 10, 2012 9:27 AM
  • Hi!,

    I have 1TB external drive which I used yesterday to enable the bitlocker. since the encryption process was too slow for 600mb data. I left it running over night & morning I checked the system that the process was hung. I ejected the external drive & attached again to check it. It prompt me for password but it gets hung after 20 mins. I notice the event/logs & found that "The device, \Device\Harddisk1\DR2, has a bad block."

    I tried the recovery key too but had the same log "The device, \Device\Harddisk1\DR3, has a bad block."

    Please suggest to get data back.

    Thanks,
    Ajay
    Tuesday, April 10, 2012 9:47 AM
  • Have a Dell Studio XPS 9100 computer with Windows 7 Prof installed. 

    After each bootup, in the event viewer, the Error Warning of : Error Code: 0x80000010, EventID: 24620, with the following information:

    "Encrypted volume check: Volume information on

    \\?\Volume{d3353cee-e448-11df-acd3-806e6f6e6963} cannot be read". 

    Error started to appear after May 2011 MS Security Updates. However I am not sure that the updates are the cause of this error. Since Windows 7 Prof does not have the BitLocker capability, it is strange that this error would appear. Any help in resolving this error, would be very much appreciated, Sam

    Hi Sam, I had this same error myself.

    Apparently if you install Windows 7 on a drive and let the install program partition and format the drive for the Windows OS then windows reserves a 100 MB partition and stores Boot information including bootmgr and BOOTSECT.BAK on this partition but never assigns a drive letter for a mount point. When "BitLocker" scans the drive(s) during boot to see if any of them are Encrypted this 100 MB partition is unreadable which triggers an error.

    To verify this is your problem you can open Control Panel\All Control Panel Items\Administrative Tools\Computer Management; then in the left column click on Storage then click on Disk Management. Once Disk Management displays all the drives in you system, look for a 100MB partition with no mount point (drive letter). Or open a Command Prompt and type “mountvol” like someone else stated.

    C:\Windows\system32>mountvol
    Before assigning drive letter:
    Possible values for VolumeName along with current mount points are:
        \\?\Volume{bde3d243-9a47-11e2-b246-806e6f6e6963}\
            *** NOT MOUNTABLE UNTIL A VOLUME MOUNT POINT IS CREATED ***

    After assigning drive letter (I):
    Possible values for VolumeName along with current mount points are:
        \\?\Volume{bde3d243-9a47-11e2-b246-806e6f6e6963}\
            I:\

    You can either ignore this error or you can Right Click on that partition and assign a drive letter to it and fix the error/stop "BitLocker" form triggering an error.

    Hope this helps.



    • Edited by jfsm2000 Friday, May 31, 2013 2:31 AM
    Friday, May 31, 2013 2:29 AM
  • I had this problem also, every time I booted and I dont even have bitlocker setup.. I looked back and noticed on the same day the problem started to appear I had re installed a program from a back up archive I created on an external hard drive with paragon hard disk manager.The installer file I imported must have been the source of the problem. hope this helps.
    Saturday, February 08, 2014 7:16 AM