windows3-8  Exercise 2: Reading the Disk Events
=================================================================

Verification: Level 1 (run on the author's machine, read-only, no administrator rights).

Prediction (work this out before running the script):

  Before reading the output: which of event 7, 11, 51 and 153 do you expect to point at the drive, and which at the system?

Command (the second half of hardware_check.ps1):

  .\hardware_check.ps1

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  --- What the disk events say, by event ID and disk number (numbers can change when drives are re-plugged)
  7 (bad block): 1402 events, 2026-07-24 to 2026-10-23
      Disk 1: 1050
      Disk 3: 352
  11 (controller error): 128 events, 2026-07-23 to 2026-10-24
      Disk (no number in text): 36
      Disk 1: 92
  51 (error during a paging operation): 326 events, 2026-07-27 to 2026-10-09
      Disk 2: 301
      Disk 3: 25
  153 (I/O retried): 1693 events, 2026-07-24 to 2026-10-23
      Disk 1: 1636
      Disk 2: 57

WHY THIS WORKS AS AN ANSWER
---------------------------
  Events 7 (bad block), 11 (controller error) and 153 (I/O retried) are reports from the storage path about the
  device's answers: they point at the drive, its cable, its port or its power. Event 51 is an error during a paging
  operation: a read or write that memory depended on failed.
  Could any belong to the system drive? None of the counts names Disk 0 (the internal NVMe), but disk numbers change
  when drives are re-plugged and the log names a Disk 3 that is not connected now, so this is an inference.
  What to check first: back up the external drives; find which physical drive each number is (unplug one at a
  time and watch Disk Management); swap the cable and port; run the maker's diagnostic.
  What the counts cannot tell you: which physical drive it is, whether the drive is failing rather than its
  cable or power, and whether any of it relates to the crashes (it is not shown to).
  Common mistakes: trusting "Healthy" in Get-PhysicalDisk over a log full of device errors; assuming the numbers are
  permanent drive labels; and blaming the crashes on the drives without evidence.