Remove From My Forums

Which disk does \Device\Harddisk<X>\DR<Y> relate to?

Question
2

Sign in to vote
Windows 7

Hi,

I'm trying to get a definitive statement on how to map event log errors that reference this:

\Device\Harddisk<X>\DR<Y> where X and Y are numbers (not the same)

onto the actual hard disk. My question is: what exactly are X and Y? To be clear: I don't want to know how to run chkdsk. What I would like to know is what X and Y exactly relate to?

Let's look at previous non-answers:

1. http://social.technet.microsoft.com/Forums/windowsserver/en-US/2e3d2e68-a4e7-49b7-9d70-7b70c166a1c9/how-to-find-out-which-hdd-is-deviceharddiskdr-

Three "answers" were given in the above thread:

       Unplug USB drives until the error goes away. This is a) clearly not a practical answer (especially if you don't have USB drives!). And b) it doesn't answer the question of how the numbering in the event log error relates to the installed drives.
       http://support.microsoft.com/kb/159865. This article points to registry settings that disappeared in Windows 2000.
       "Y and X are the same". That is just plain wrong.

So, the above thread was not actually answered. (The "unplug USB devices" was oddly, marked as an answer.)

2. http://forum.sysinternals.com/the-device-deviceharddisk0d-has-a-bad-block_topic19288.html

Same question and lots of posts about how to fix the problem. But, the final post (helpful at last but not from Microsoft unfortunately) does say that "X" is simply the disk number in disk manager. Is this right? Also, what is "Y"?

3. http://www.storageforum.net/forum/showthread.php/8783-The-driver-detected-a-controller-error-on-Device-Harddisk1-DR1

This incorrectly states that Y is the disk number. How do I know this is incorrect? I for example, see "DR5" in the error but I only have 3 disks! The first post above also complains of the same problem, so we are no nearer knowing what Y actually is.

4. http://windowssecrets.com/forums/showthread.php/137928-Which-disk-is-this-Device-Harddisk2-DR2

The answer here is a very generic "look in disk manager". But, this does not actually answer the question.

5. http://windowssecrets.com/forums/showthread.php/137928-Which-disk-is-this-Device-Harddisk2-DR2

Same problem but no answer provided.

6. http://www.techsupportforum.com/forums/f149/the-driver-detected-a-controller-error-on-device-harddisk1-dr-639571.html

The answer here is that Y should be a number, which indeed it is, but that doesn't really help answer the question.

I'm hoping that someone from MS here will post a definite statement (and not ask me for more details of "my" error, post links to 13 year old technet articles, or explain how to run chkdsk). J

TIA

Mark
Sunday, July 7, 2013 9:52 AM

Answers

3

Sign in to vote
"For Y, i need more time to research it to make sure what it really means."

I am still awaiting the research results.

You could download and run WinObj from http://technet.microsoft.com/en-us/sysinternals/bb896657.aspx. Under Device it lists your storage devices. You will find that Y is a number that gets dynamically assigned to each drive. When you go through the following sequence then you will see that the number keeps changing:

Plug flash disk A into USB port x. Press F5 to refresh the display.
Unplug it.
Plug flash disk B into USB port x.
Unplug it.
Plug flash disk A into USB port x.

WinObj will show you a different value for Y each time.
- Marked as answer by Vincent Wang-MCSC Thursday, August 29, 2013 8:15 AM
Friday, August 16, 2013 10:55 PM

All replies

1

Sign in to vote

After opening the error event in the Event Viewer, click the Details tab to see the details below. Right at the end you will find the drive letter that the error message refers to.
- System
- Provider
[ Name] volsnap
- EventID 33
[ Qualifiers] 16390
Level 4
Task 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2013-06-29T11:33:50.602874700Z
EventRecordID 276171
Channel System
Computer ACORN
Security
- EventData
\Device\HarddiskVolumeShadowCopy4
C:

Sunday, July 7, 2013 10:47 AM
0

Sign in to vote

Thx. So, what do X and Y refer to in the error?

Sunday, July 7, 2013 11:38 AM
1

Sign in to vote
Thx. So, what do X and Y refer to in the error?
You would have to examine the detailed event logger message (if it is still available). To get an authoritative and generalised answer you will have to wait until an expert on the subject contributes towards this thread or else do your own research (which could be time consuming).
- Marked as answer by Vincent Wang-MCSC Monday, July 8, 2013 8:08 AM
- Unmarked as answer by M.a.r.k.T. _ Monday, July 8, 2013 9:10 AM
Sunday, July 7, 2013 12:42 PM
0

Sign in to vote

To get an authoritative and generalised answer you will have to wait until an expert on the subject contributes towards this thread or else do your own research (which could be time consuming).

TVM. Yes, that's what I'm after: a generic answer.

Monday, July 8, 2013 6:50 AM
0

Sign in to vote

I unmarked the two comments marked as answers because the original question was "My question is: what exactly are X and Y? ... What I would like to know is what X and Y exactly relate to?" As clarified above (but clearly not clear enough) - I don't need to know how to diagnose specific corrupt disks, it is a generic question.

I have attempted to reseacrh this myself and have come up with the links above, but no authoritative answer so far. Clearly the numbers X and Y mean something deterministic, it's just a question of what? (I don't look forward to having to deliberately corrupt data on various hard drives / volumes and then waiting until there's an event log error. That seems like a rather eccentric way of finding out what X and Y are!)

Monday, July 8, 2013 10:30 AM
2

Sign in to vote

Hi,

I'm trying to involve someone familiar with this topic to further look at this issue. There might be some time delay.

Regards,

Vincent Wang
TechNet Community Support

Tuesday, July 9, 2013 7:37 AM
3

Sign in to vote

Hi,

For x, IT represent disk number, you can get it from diskmgmt.msc.

For Y, i need more time to research it to make sure what it really means.

Expect for "DR", usually we also can see the "volume" "partition". I will update here for any results.

Thanks,
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Wednesday, July 10, 2013 11:21 AM
1

Sign in to vote
Vincent and Leo, many thanks for investigating this, it is very much appreciated.

It is good to hear it confirmed that X is the disk number as seen in Disk Manager.
- Edited by M.a.r.k.T. _ Wednesday, July 10, 2013 11:31 AM Vincent and Leo
Wednesday, July 10, 2013 11:30 AM
1

Sign in to vote

Hi,

Thanks for your confirmation.

Now do you have any questions on this case? Please let me know ASAP.

Regards,
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Friday, August 16, 2013 5:41 AM
0

Sign in to vote

"For Y, i need more time to research it to make sure what it really means."

I am still awaiting the research results.

Friday, August 16, 2013 5:23 PM
3

Sign in to vote
"For Y, i need more time to research it to make sure what it really means."

I am still awaiting the research results.

You could download and run WinObj from http://technet.microsoft.com/en-us/sysinternals/bb896657.aspx. Under Device it lists your storage devices. You will find that Y is a number that gets dynamically assigned to each drive. When you go through the following sequence then you will see that the number keeps changing:

Plug flash disk A into USB port x. Press F5 to refresh the display.
Unplug it.
Plug flash disk B into USB port x.
Unplug it.
Plug flash disk A into USB port x.

WinObj will show you a different value for Y each time.
- Marked as answer by Vincent Wang-MCSC Thursday, August 29, 2013 8:15 AM
Friday, August 16, 2013 10:55 PM
1

Sign in to vote

Hi, thanks for the reply. WinObj has definitely shed some light on it. But, it's also showing me something odd. E.g. Disk0 has two partitions on it: the usual 100 MB system reserved and the rest of the drive.

WinObj shows 3 partitions:

DR0, device

Partition0, SymbolicLink, \Device\Harddisk0\DR0

Partition1, SymbolicLink, \Device\HarddiskVolume3

Partition2, SymbolicLink, \Device\HarddiskVolume4

So, if I have an error referring to \Device\Harddisk0\DR0, which partition is it referring to?

Or, is it not referring to any partition, just somewhere on the whole drive?

Friday, August 30, 2013 4:28 PM
1

Sign in to vote

Sorry, you have reached the limit of my interest in this matter. You'll have to work out the rest by yourself.

Friday, August 30, 2013 8:02 PM
0

Sign in to vote

I'll leave WinObj as the answer as it does shed light on the matter, though unfortunately, we are still in a state of not knowing what the DRx means and whether it relates to partition or not - all we know if that it changes dynamically. Even MS seem not to know, so I'm guessing that only the programmer knows! If I were to guess, it appears to be a numerical counter starting at 0 and which point to drives not partitions and which increments with each new drive including plugged USB drives. If so, from a administrator's perspective, it is of no value that I can see and the error in the OP only refers to a drive, not a partition.

Friday, September 6, 2013 9:36 AM
1

Sign in to vote

Thanks for the post, help me so much to understand some logs.

The DR'Number' appears to be related to the entire disk, because each "Harddisk'number'" has only one DR'number', even if there is more than one partition.

To find the disk, I am using diskpart.

PS: if I disconnect the disk, and reconnect again, not only the DR'number' is changed, the symlink "\device\harddiskvolume'number'" is changed too... If I restart the computer, the numbers start at zero again.

*Sorry for my english

Wednesday, February 19, 2014 4:09 PM
1

Sign in to vote

Yes that was my conclusion. Which means that \Device\Harddisk<X>\DR<Y> only tells you which disk not which partition is at fault.

Wednesday, February 19, 2014 4:12 PM
0

Sign in to vote

in Harddisk<X>, the X refers to the disk number found in Disk Management.

if the error is Harddisk0, then open Disk Management and find the disk labeled Disk 0

in DR<Y>, Y is referring to a partition on the disk.

Saturday, June 21, 2014 12:26 AM
0

Sign in to vote

Not on my Win7 Pro 64-bit. What's after \Device\Harddisk3\DR3 is:

030080000100000000000000070004C0000100009C0000C00000000000000000000000000000000055B0970100000000FFFFFFFF0100000058000084020000000020101240032040000000003C00000000000000000000002873AA0B80FAFFFF0000000000000000D0A2020C80FAFFFF6056E80B80FAFFFF50E1A3F500000000880000000000F5A3E150000000080000700003000000000A00000000110000000000000000000000

which is not hex for X:

Monday, September 1, 2014 4:34 PM
1

Sign in to vote

:)

Agreed: Y does not relate to the partition number as per the previous discussions established.

Tuesday, September 9, 2014 1:14 PM
1

Sign in to vote
The NT Device Namespace is what is being displayed in winobj.exe.

For each hard disk there is one 'HardDiskx'.
For each 'HardDiskx' there is one 'DRy'.
That 'DRy' is the NT Device Namespace device entry for the hard disk (note the 'Type' column).
That 'DRy' is NOT the NT Device Namespace device entry for any logical partition on the hard disk - those are covered below.

This is why when you get disk device error events (as opposed to partition error events) in the System event log they often use the nomenclature 'HardDiskx'.

For each 'HardDiskX' there is always one 'Partition0' entry.
That 'Partition0' entry is only a symbolic link (note the 'Type' column).
That symbolic link 'Partition0' points to disk device by its 'DRY' number. So it is just another way to refer to 'DRy'. 'Partition1' and any symbolic links greater than '1' point to NT Device namespace devices representing actual logical partitions on the disk device, as their names would otherwise imply. 'Partition0' is an exception. Why do they have 'Partition0' at all? Maybe its an older, or perhaps newer, way to call that device in the NT Device Namespace name. Heh, I don't know...
- Proposed as answer by RickG76989 Friday, May 22, 2015 1:24 PM
Tuesday, March 31, 2015 7:19 PM
0

Sign in to vote

It is perhaps arrogant of me to imagine that I can shed some light on what you actually want to know without even actually answering your question, but how's this:

Search online for a Windows port of good old "dd" by John Newbigin. The latest version i found is version 0.6beta3. This is my first post and i'm not allowed to post the link, but i found it at( www dot chrysocome dot net slash dd) . It has this amazingly useful "--list" option, which tells you everything you are asking about on the particular machine whose elevated command prompt you type it into. Below this you will find the output from dd on my machine right now. Without knowing what X and Y (or any of the other numbers) refers to, I can still match up the various expressions avilable, including "drive Letter'. Hope this helps.

C:\windows\system32>dd --list
rawwrite dd for windows version 0.6beta3.
Written by John Newbigin <jn@it.swin.edu.au>
This program is covered by terms of the GPL Version 2.

Win32 Available Volume Information
\\.\Volume{4447b799-cffc-11e4-824e-806e6f6e6963}\
link to \\?\Device\HarddiskVolume1
fixed media
Mounted on \\.\e:

\\.\Volume{b9bbbc44-92aa-4f2b-854f-27fe309986fd}\
link to \\?\Device\HarddiskVolume3
fixed media
Mounted on \\.\f:

\\.\Volume{02223229-375a-91a4-da20-71ada3731f05}\
link to \\?\Device\HarddiskVolume4
fixed media
Mounted on \\.\c:

\\.\Volume{181673b0-0d7e-01d1-d039-0b0cbf86e800}\
link to \\?\Device\HarddiskVolume31
removeable media
Mounted on \\.\k:

\\.\Volume{1dfbf6cc-6493-11e5-830f-382c4a72d004}\
link to \\?\Device\HarddiskVolume27
removeable media
Mounted on \\.\n:

\\.\Volume{4447b79b-cffc-11e4-824e-806e6f6e6963}\
link to \\?\Device\HarddiskVolume7
fixed media
Mounted on \\.\d:

\\.\Volume{8a0ce94a-e6c2-11e4-8277-806e6f6e6963}\
link to \\?\Device\CdRom0
CD-ROM
Mounted on \\.\g:

NT Block Device Objects
\\?\Device\CdRom0
size is 2147483647 bytes
\\?\Device\Harddisk0\Partition0
link to \\?\Device\Harddisk0\DR0
Fixed hard disk media. Block size = 512
size is 500107862016 bytes
\\?\Device\Harddisk0\Partition1
link to \\?\Device\HarddiskVolume1
\\?\Device\Harddisk1\Partition0
link to \\?\Device\Harddisk1\DR1
Fixed hard disk media. Block size = 512
size is 3000592982016 bytes
\\?\Device\Harddisk1\Partition1
link to \\?\Device\HarddiskVolume2
Fixed hard disk media. Block size = 512
size is 134217728 bytes
\\?\Device\Harddisk1\Partition2
link to \\?\Device\HarddiskVolume3
Fixed hard disk media. Block size = 512
size is 3000453038080 bytes
\\?\Device\Harddisk2\Partition0
link to \\?\Device\Harddisk2\DR2
Fixed hard disk media. Block size = 512
size is 500107862016 bytes
\\?\Device\Harddisk2\Partition1
link to \\?\Device\HarddiskVolume4
\\?\Device\Harddisk2\Partition2
link to \\?\Device\HarddiskVolume5
Fixed hard disk media. Block size = 512
size is 208666624 bytes
\\?\Device\Harddisk2\Partition3
link to \\?\Device\HarddiskVolume6
Fixed hard disk media. Block size = 512
size is 106928640 bytes
\\?\Device\Harddisk3\Partition0
link to \\?\Device\Harddisk3\DR3
Fixed hard disk media. Block size = 512
size is 1000204886016 bytes
\\?\Device\Harddisk3\Partition1
link to \\?\Device\HarddiskVolume7
\\?\Device\Harddisk4\Partition0
link to \\?\Device\Harddisk4\DR27
Removable media other than floppy. Block size = 512
size is 1977614336 bytes
\\?\Device\Harddisk4\Partition1
link to \\?\Device\HarddiskVolume31
Removable media other than floppy. Block size = 512
size is 1972371456 bytes
\\?\Device\Harddisk5\Partition0
link to \\?\Device\Harddisk5\DR23
Removable media other than floppy. Block size = 512
size is 4005560320 bytes
\\?\Device\Harddisk5\Partition1
link to \\?\Device\HarddiskVolume27

Virtual input devices
/dev/zero (null data)
/dev/random (pseudo-random data)
- (standard input)

Virtual output devices
- (standard output)
/dev/null (discard the data)

------------------------------------------------------------------------------------------------------

Friday, October 23, 2015 7:51 PM
0

Sign in to vote

Very nice!

Friday, October 23, 2015 9:12 PM
0

Sign in to vote

I am trying to decode \Device\Harddisk2\DR2 on my machine

WinObj - HardDisk2 = \Device\HardDiskVolume7 (Partition1)

dd - no entry for \Device\HardDiskVolume7??

mark

Friday, December 2, 2016 4:28 PM
0

Sign in to vote
After opening the error event in the Event Viewer, click the Details tab to see the details below. Right at the end you will find the drive letter that the error message refers to.
- System
- Provider
[ Name] volsnap
- EventID 33
[ Qualifiers] 16390
Level 4
Task 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2013-06-29T11:33:50.602874700Z
EventRecordID 276171
Channel System
Computer ACORN
Security
- EventData
\Device\HarddiskVolumeShadowCopy4
C:

Not all events include this in the details. I currently have a Windows 2012 server with multiple Event ID 51 warnings for \Device\Harddisk2\DR2. There is no information in the details showing a mount path.
- Edited by MichaelJMcNally Wednesday, May 10, 2017 1:28 PM forgot to quote
Tuesday, May 9, 2017 8:41 PM
0

Sign in to vote

Nice tool. However, on my Win2k12 server, I was showing a warning on \Device\harddisk2\DR2 . Running "dd --list" showed \Device\HarddiskVolume2\ as mounted on C:

Disk manager showed Disk 2 as an external USB drive, mounted as I:

Dismounting and restarting the external drive cleared the error. So in this case, it looks like the value given by dd --list did not match disk number as shown by Windows.

Really though, my hat is off to Microsoft for obfuscating the event log message so much that it caused a TechNet forums poster with over 28,000 points to throw their hands up and bail.

Tuesday, May 9, 2017 9:24 PM
0

Sign in to vote

Drive 'X' or 'Y' are use For a Recuparation Sytem in case of ...

Don't take care of...

Monday, November 13, 2017 6:31 PM
0

Sign in to vote

Most of the KB Articles have gone away, resulting in a HTTP 404 error. Why are they not cleaned up?
In God We Trust. All others bring data from a reputable source.

Tuesday, June 12, 2018 4:05 PM

Products

Resources

Solutions

Updates

Trials

Related Sites

Training

Certifications

Other resources

Support options

More support

Not an IT pro?

Answered by:

Which disk does \Device\Harddisk<X>\DR<Y> relate to?

Question

Answers

All replies