How to know bit-rot has occurred on ReFS?

Question

I have read that ReFS has a built-in checksum mechanism. Automatic bit-rot repair seems to be done only when redundancy is used (Storage Space).

If there is an ReFS volume without redundancy, I think the system at least can still detect bit-rot has occurred. So, how does the ReFS file system inform the user, in such a case? It should be still helpful just to be able to know that bit-rot has occurred even without automatic repair.

Are there APIs or built-in utilities to know the list of bit-rotten files?

Answer 1

ReFS will log an event to the event log:

Event Viewer/Application and Services Log/Microsoft/Windows/DataIntegrityScan

• Log Name: Microsoft-Windows-DataIntegrityScan/Admin
• Source: Microsoft-Windows-DataIntegrityScan
• Event ID: 54
• Level: Warning

• Description:

  File data inconsistency was detected and was repaired successfully. File name: M:\VirtualMachines\WindowsServer2012R2_Prod.vhd; range offset: 0x3A8314000; range length: 0x4000 bytes; repaired: 0x4000 bytes; status: STATUS_SUCCESS.

You can create a custom event view and filter by source, selecting the ReFS source. This isn't really the best implementation on Microsoft's part if you're not using a mirrored storage spaces volume, the System event log overwrites itself, and the event will be lost.

Source - Kate Li (Microsoft Contingent Staff): https://social.technet.microsoft.com/Forums/lync/en-US/99c5a067-a8f1-4ab8-b28c-25d0d8cd45b0/refs-salvage-log-entry-for-defective-files-scrubbing-process-configuration?forum=w8itprogeneral

Running the Data Integrity Scan scheduled task will scan all files on a ReFS volume:

• Task Scheduler/Task Scheduler Library/Microsoft/Windows/Data Integrity Scan
  • Data Integrity Scan
  • Data Integrity Scan for Crash Recovery

But I can only assume works if you have a storage spaces volume, as on my 24TB (with >7TB of data) hardware RAID 6 volume it exits immediately. Otherwise the files are only scanned as they are accessed in real time, and only the blocks which are actually being read rather than the entire file.

On desktop PCs the tasks are disabled by default:

But on server machines, the monthly task is enabled by default.