I have just tested the same method as you and reviewed results. If I open Event Viewer
and navigate to Windows Logs
> Applications
I can find the desired results.
The event ID I received was 26213
and 26212
. Following this, I was able to run a standard custom filter:
I cannot post an image. I would imagine you can make a custom filter by yourself anyway to prove this. It may be benefitial to see if the logs have anything to do with the above EventID's or you may need to search for a list of ID's (the parameters are logged with different ID's I believe)
Here is a powershell script you can run to locate the file, then paste it to your desktop.
get-winevent -FilterHashTable @{logname="Application"; id="26212"}| ?{$_.providername –match "CHKDSK"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt
I can confirm that the source is not wininit
anymore, but Chkdsk
itself.
Let me know if I have covered everything. I am sure someone here will correct me if I am wrong.