Problem description

The File server backup fails with the Unable to query USN Journal error. The error is logged in the PhoenixScanner_<drive>.log file of the file server.

The USN (Change) Journal provides a persistent log of all changes made to the files in the volume. When files, directories, and the other NTFS objects are added, deleted, or modified, the NTFS records all the changes into the USN Journal. One Journal is maintained for each volume on the computer. Each record indicates the type of change and the object changed. The new records are appended to the end of the stream.

Backup programs consult the USN Journal to determine all the modifications made to the set of files. 

The following files contain the changed records:

• PhoenixScanner_<drive>.log
  Line <Line_Number> : level=error ts=<time_Stamp> USNUtil="Unable to query USN Journal." Fault=" The volume change journal is deleted."
  This backup will always be converted to the folder walk as you cannot read the USN.
• Event Viewer (Event ID 55)
  The master file table (MFT) contains a corrupted file record. The file reference number is 0x2900000000f1c5. The name of the file is <filename cannot be determined>.

Resolution

To resolve this error, perform the following steps:

1. For issues with disk or the file system, check with your system administrator and proceed with the following check disk command (command-line utility) in the read-only mode.
   chkdsk <driveletter>:
   If the error persists, proceed with the recovery mode. This mode locates bad sectors and recovers readable information.
2. Query the USN Journal or create it using the following command:
   fsutil.exe usn queryjournal <Drive Name>
   fsutil usn createjournal m=1000 a=100 <Drive Name>
             m=<MaxSize> a=<AllocationDelta>