Question Samsung 980 Pro - - - Health Status dropped to 61% in CrystalDiskInfo in just a few days ?

[tomdid]

Hello to you all

I'm new on the forum so please, don't hesitate to tell me if I'm in the right place to talk about this.
Since the update to Windows 11 Professional 24H2 and an ene.sys issue, my PC seems to be under the weather.

First, I saw the space on C: shrink unexpectedly. I tested adjustments to the pagefile.sys file, removal of hibernation storage, and deactivation of the ene.sys file.
But my PC didn't seem to appreciate these various steps, and I encountered errors when checking via chkdsk:

• Examination of files in the \FOUND.000\ directory (183) revealed a failure.
• Examination of files and directories revealed a failure.
• Examination of the volume bitmap revealed a failure.

I've had problems with simple operations, even though my configuration is rather robust (extreme slowness of explorer, inability to copy/paste, untimely disconnection of USB devices, etc.). I then encountered display errors, and reinstalled After Effetcs and updated to the latest drivers for my GPU.

Still, some errors such as {A24E410DE-8E2B-4EB8-B34A-6B1B878A5047} This application prevents you from rebooting, or even more strange : t (yes, just t) This application prevents you from rebooting...

Then, a few days ago, I had an error as soon as I booted up, forcing me to repair Windows in Safe Mode.
I tested my hard drives with CrystalDiskInfo (as I work with 2 external SSDs almost all the time) and everything was OK (all internal and external SSDs were marked “good” with a minimum of 95%).

Finally, this morning I had a blue screen with an error 0xc0000218.
And when I rebooted, I went to the usual process of chkdsk + sfc /scannow. Right after that, I tested all my SSD with CrystalDiskInfo and saw that my system SSD drive (SAMSUNG 980 Pro PCIe 4.0 Nvme M. 2) Health Status had dropped to 61% (Good)...

I saw this :
05 - Spare cells available 0000000000000064
0C - Number of emergency stops 00000000000003B5 (=949)
E7 - Percentage used 0000000000000025 (=37%)
0E - Media / data integrity errors 0000000000000004
0F - Error log entries 000000000000002C (=44)

Which doesn't seem too good (I like understatements).

So I guess I have to be very careful with my SSD and will probably have to replace it as soon as possible.
But before going any further, I'd like to hear what the experts have to say about these phenomena. I understand that 24H2 has been fairly criticized for problems with SSDs, drivers and USB ports, and I'm thinking of redoing a clean installation by installing 23H2.

What do you think? Thank you in advance for any ideas or suggestions. I'm starting to freak out because I've got productions in progress and I'd like to avoid making any mistakes.

 

[USAFRet]

What does Samsung Magician say?
(screencap preferred)

 

[USAFRet]

I understand that 24H2 has been fairly criticized for problems with SSDs

24H2 has had ZERO impact on my 1TB 980 Pro.

 

[evermorex76]

The full SMART data is also better, rather than picking and choosing. But it absolutely sounds like that SSD is about to fail. If you aren't performing backups, make copies of your data files NOW. Loss of space means so many blocks have failed that the drive can't even reallocate anything with spares. (You said the space shrunk, but do you mean the total capacity or the amount of free space?) I can't imagine why DiskInfo thinks it's "Good" unless it's solely looking at the number of TB written compared to the TBW rating, or if there is an explicit "lifetime remaining" SMART value in that drive.

What do you mean "deactivation of ene.sys"? 24H2 as far as I know has never KILLED an SSD like this. The issues I'm aware of were only WD/SanDisk drives that didn't have DRAM cache, and that was fixed by firmware updates.

 

[USAFRet]

What do you think? Thank you in advance for any ideas or suggestions. I'm starting to freak out because I've got productions in progress and I'd like to avoid making any mistakes.

You DO have an ongoing series of backups of this drive, right?

'ongoing', like every day, if not more often.

 

[tomdid]

You DO have an ongoing series of backups of this drive, right?

'ongoing', like every day, if not more often.

Hello and thank you very much for your replies

I only use C: for my programs but this SSD is on my main PC and I work as a musician and a motion graphics designer, so my main productions are made on this PC.
But yes, I only work on a separate NVMe SSD (D and also on 2 portable Samsung T7 SSDs.

I have backuped my custom folders on C: and am currently organizing the reinstallation of Windows 11, but I'm more worried by the time I'll have to spend reinstalling everything on my PC

The shrinking disk space on C: is free space (from 320 to 304Gb of free space), but I have changed the values of pagefile.sys because I work on After Effects and thought it would be a good idea.

Here are the results of Samsung Magician :

So it only looks bad on CrystalDiskInfo unless I can't read the ifnos :/

Please don't hesitate to tell me what you think about it.

 

[tomdid]

The full SMART data is also better, rather than picking and choosing. But it absolutely sounds like that SSD is about to fail. If you aren't performing backups, make copies of your data files NOW. Loss of space means so many blocks have failed that the drive can't even reallocate anything with spares. (You said the space shrunk, but do you mean the total capacity or the amount of free space?) I can't imagine why DiskInfo thinks it's "Good" unless it's solely looking at the number of TB written compared to the TBW rating, or if there is an explicit "lifetime remaining" SMART value in that drive.

What do you mean "deactivation of ene.sys"? 24H2 as far as I know has never KILLED an SSD like this. The issues I'm aware of were only WD/SanDisk drives that didn't have DRAM cache, and that was fixed by firmware updates.

Hello and thank you for your message

I just read that 24H2 has been reported as a crash maker for some SSD :
Affected users report recurring crashes with errors such as “CRITICAL_PROCESS_DIED”, “KERNEL_DATA_INPAGE_ERROR” ou “INACCESSIBLE_BOOT_DEVICE” (CyberPowerPC, Droix, Stellarinfo)

And more :
HERE

But I am of course not sure that my problem is related in any way to 24H2.

The shrinking disk space on C: is free space (from 320 to 304Gb of free space, but I have modified the pagefile.sys, and I (still) work with Adobe products as well as music production programs for which I use C:

I have updated the Samsung firmwares but also bought a more recent SSD (Samsung 2Tb 990 Pro.

Indeed, it looks like I'm going to have to replace my actual C: SSD

 

[USAFRet]

The shrinking disk space on C: is free space (from 320 to 304Gb of free space

That is inconsequential.
Possibly the pagefile, or even just temp files.

 

[evermorex76]

The 61% is just because that drive has a TBW rating of 600, and you've written over 180TB, so it has about 61% of it's rated lifespan remaining (but it could die earlier, or last much longer, it's just an expected lifespan but not based on any direct measurement of the storage cells or anything).

I hate that even the manufacturer's utilities don't provide a HUMAN READABLE output for their own SMART values on their own devices, just "raw values" with sometimes obscure names (and third party tools have to guess what their values mean). Temperature is 316 or 326 depending on the sensor. "Percentage used" is 39, which sounds like it's got 61% free space, but it's actually how much of the TBW rating has been used up.

Anyway there appears to be nothing wrong with the drive, so I think you'll have to look elsewhere at the causes of the crashes. Of course installing Windows on a new SSD may resolve the issues but it will probably be a fix to the software, nothing to do with the hardware. Or there could still be a hardware issue that won't be resolved that way.

It's generally fine to just let the pagefile size be managed by Windows. It is only needed when you run out of RAM, so forcing a really big one is pointless, and with an SSD there's hardly any delay in resizing it if Windows needs to do so automatically. After Effects creates its own disk cache file. (No application directly accesses the Windows pagefile; only the OS makes the decision to transfer RAM contents to it.) At best it may be useful to enable the pagefile on more than just your C drive, if you have multiple physical drives, but still just let Windows manage it.

As you can see in the article you linked, those 24H2 issues are ONLY related to Western Digital SSDs, and only models without DRAM (using Host Memory Buffer). There are no issues with 24H2 and SSDs in general.

The filesystem issues you found with chkdsk may be unrelated to your current crashes or may only be a result of the crashes, rather than a result of issues with the drive.

Look through Windows Event Viewer for warnings and errors that may be related. Disk, network, kernel, etc. You can use Nirsoft Bluescreenview to get data on the bluescreen messages and bugcheck codes as well. 0xc0000218 is STATUS_CANNOT_LOAD_REGISTRY_FILE which may be related to the filesystem problems or something else. You may have some buggy drivers installed, or there could be a very rare compatibility issue between 24H2 and the drivers for some hardware component, or even some piece of software on your system. Microsoft ran into A LOT of issues that made them hold the 24H2 update from a lot of systems due to that.

Make sure that all the drivers and software and the BIOS are updated. I couldn't find any information about ene.sys for certain (you might be able to look at the file properties and see a brand) but it seems like it may be related to RGB lighting. Windows 11 has had that feature for some time, but it would also be included in the software for the mainboard, such as Asus Armoury Crate, and maybe there is a buggy/incompatible version. Unless you NEED some features, you generally shouldn't install utilities like that. You may want to run RAM tests (or even just reseat the RAM modules).

 

[evermorex76]

By the way, just in case, if you have BitLocker enabled you may want to turn it off before changing drives and installing Windows again. Otherwise the new install MAY not be able to access the D drive. I believe you'd need to enter the recovery key to access the second drive, and I'd guess you'd need to decrypt and re-encrypt it under the new OS anyway.

 

[tomdid]

By the way, just in case, if you have BitLocker enabled you may want to turn it off before changing drives and installing Windows again. Otherwise the new install MAY not be able to access the D drive. I believe you'd need to enter the recovery key to access the second drive, and I'd guess you'd need to decrypt and re-encrypt it under the new OS anyway.

Thank you very much for your messages and details!

Since my problems appeared after the installation of 24H2, I was thinking about installing Windows 23H2. Wouldn't that be safer?
I will of course update my Bios and I take good note of the Bitlocker thing

 

[evermorex76]

Thank you very much for your messages and details!

Since my problems appeared after the installation of 24H2, I was thinking about installing Windows 23H2. Wouldn't that be safer?
I will of course update my Bios and I take good note of the Bitlocker thing

It might be safer, but eventually you'll have to update, and you don't KNOW that it's a bug with 24H2 specifically or maybe with some other update, or whether just not installing some small piece of software that you currently have won't eliminate the issue. I guess it depends on just how much your time is worth, whether it's going to be "expensive" for you to try a fresh install of 24H2 and get your most important things running so you can work and then find that the problem still happens and you have to wipe and do it again with 23H2.

 

[fzabkar]

The 61% is just because that drive has a TBW rating of 600, and you've written over 180TB, so it has about 61% of it's rated lifespan remaining (but it could die earlier, or last much longer, it's just an expected lifespan but not based on any direct measurement of the storage cells or anything).

I hate that even the manufacturer's utilities don't provide a HUMAN READABLE output for their own SMART values on their own devices, just "raw values" with sometimes obscure names (and third party tools have to guess what their values mean). Temperature is 316 or 326 depending on the sensor. "Percentage used" is 39, which sounds like it's got 61% free space, but it's actually how much of the TBW rating has been used up.

SMART attribute reporting over SATA/PATA is non-standardised, but NVMe is reasonably well defined.

NVM Express Base Specification Revision 1.4 (June 10, 2019):
https://nvmexpress.org/wp-content/uploads/NVM-Express-1_4-2019.06.10-Ratified.pdf

See "Get Log Page – SMART / Health Information Log" on page 122.

Percentage Used: Contains a vendor specific estimate of the percentage of NVM subsystem life used based on the actual usage and the manufacturer’s prediction of NVM life. A value of 100 indicates that the estimated endurance of the NVM in the NVM subsystem has been consumed, but may not indicate an NVM subsystem failure. The value is allowed to exceed 100. Percentages greater than 254 shall be represented as 255. This value shall be updated once per power-on hour (when the controller is not in a sleep state). Refer to the JEDEC JESD218A standard for SSD device life and endurance measurement techniques.

That said, Percentage Used is calculated in a vendor specific way. Temperatures are also calculated in a vendor specific way, as you say.

 

[tomdid]

It might be safer, but eventually you'll have to update, and you don't KNOW that it's a bug with 24H2 specifically or maybe with some other update, or whether just not installing some small piece of software that you currently have won't eliminate the issue. I guess it depends on just how much your time is worth, whether it's going to be "expensive" for you to try a fresh install of 24H2 and get your most important things running so you can work and then find that the problem still happens and you have to wipe and do it again with 23H2.

Hello and thank you very much for your reply

I am especially surprised that it dropped so fast from 99% to 61% and still wonder how I could avoid the same issue in my next clean install.
Is there anything I could do to know what could have caused such a drop so fast?

Before it all happened, I tried to clean C: a few times, but nothing more than chkdsk and scannow, tried to adjust pagefile.sys (which I know is not necessary or even good at all), and suppressed hyberfil.sys but nothing too crazy in my opinion (unless I'm wrong).

I also had a suspicion when I saw random folders appearing in AppData > Roaming
What I found with Process Monitor :
• An executable with a completely random name (2025330-7364-vydvyz.spj2r.exe)
• Created in %LOCALAPPDATA%\Temp\,
• Then disappears from there by itself, leaving an empty folder under %APPDATA%\Roaming%.
And the folders names are (I suppressed them but they're back) :
bjomallhgxqykqgtwftnzxuvqbxnq
bynfpignosgopplxvezzbs
byplloovvfbyqwrutkesn
dedppeordlveeyzybubiiol
evqmcteasumalsurdna
fqzvjmrqqnzocip
... and there are 36 folders.

When they are re-created, they have the exact same name.

Maybe it has nothing to do with the 99% to 61% but I'd rather mention it

If you have any idea, I'd be glad to know it 😉

 

[evermorex76]

I also had a suspicion when I saw random folders appearing in AppData > Roaming
What I found with Process Monitor :
• An executable with a completely random name (2025330-7364-vydvyz.spj2r.exe)
• Created in %LOCALAPPDATA%\Temp\,
• Then disappears from there by itself, leaving an empty folder under %APPDATA%\Roaming%.
And the folders names are (I suppressed them but they're back) :
bjomallhgxqykqgtwftnzxuvqbxnq
bynfpignosgopplxvezzbs
byplloovvfbyqwrutkesn
dedppeordlveeyzybubiiol
evqmcteasumalsurdna
fqzvjmrqqnzocip

Oh that's just malware infesting your computer.

 

[tomdid]

Oh that's just malware infesting your computer.

Oww 🙁

That's what I thought... But I didn't find anything with Windows Defender, AdwCleaner, ESET, nor Malwarebytes.

Would you have any suggestion to help me please ?

 

[fzabkar]

Upload any suspicious files to virustotal.com.

 

[evermorex76]

Oww 🙁

That's what I thought... But I didn't find anything with Windows Defender, AdwCleaner, ESET, nor Malwarebytes.

Would you have any suggestion to help me please ?

They probably are not actually malware, just cached or temporary data from some apps, with randomized named to prevent conflicts. You probably don't have file extensions being displayed, but they are likely .tmp files, and may not actually even contain any data (0 bytes). My own system has them as well. Heaven forbid applications keep their own files to their own folders, or at least a properly named subfolder in Temp. There isn't enough write activity from these to be a cause for early SSD failure, unless one particular app really does write a lot of temp data. You'd have to run a trace app to track all the writes to see what creates the files but I really don't think that's necessary.

I have no solid idea why the health rating would have dropped suddenly if the TBW didn't suddenly increase, and I don't think you were paying attention to that number (though maybe you should keep an eye on that and the health ratings for a while, check them every day). It would have taken some time while constantly writing data at high speed to result in that much data change but if a software component was crashing and just going nuts, I guess it would be possible that it would flood the drive overnight, since you woke up to a bluescreen. If the drive was being hammered at maximum speed with garbage that just got deleted afterward, filling up the pSLC cache so it dropped to native flash speeds, it's about 16 hours with that drive to use up 20% of the drive's rated TBW. You've had more than one event with this so it might have been split across those.

 

[tomdid]

Upload any suspicious files to virustotal.com.

Hello
I am currently trying to get the exe files that launch and disappear (which actually seems quite suspicious) but I still need to solve an issue with ProcMon... It has no end

 

[tomdid]

They probably are not actually malware, just cached or temporary data from some apps, with randomized named to prevent conflicts. You probably don't have file extensions being displayed, but they are likely .tmp files, and may not actually even contain any data (0 bytes). My own system has them as well. Heaven forbid applications keep their own files to their own folders, or at least a properly named subfolder in Temp. There isn't enough write activity from these to be a cause for early SSD failure, unless one particular app really does write a lot of temp data. You'd have to run a trace app to track all the writes to see what creates the files but I really don't think that's necessary.

I have no solid idea why the health rating would have dropped suddenly if the TBW didn't suddenly increase, and I don't think you were paying attention to that number (though maybe you should keep an eye on that and the health ratings for a while, check them every day). It would have taken some time while constantly writing data at high speed to result in that much data change but if a software component was crashing and just going nuts, I guess it would be possible that it would flood the drive overnight, since you woke up to a bluescreen. If the drive was being hammered at maximum speed with garbage that just got deleted afterward, filling up the pSLC cache so it dropped to native flash speeds, it's about 16 hours with that drive to use up 20% of the drive's rated TBW. You've had more than one event with this so it might have been split across those.

Thanks a lot
Well, that's interesting! I've checked my laptop as well and the same empty folders (no exe files in them, only files with no extension in some of them) are there too...
Hitfile Pro found potential things like Chrome add-ons (video download manager), on my two computers.
I'm actually trying to make Process Monitor work to make more investigations.
I'd just like to be sure because it is my production machines and I can't send my clients infected files nor take any chance, although it takes me forever

Very clever thoughts about the CrystalDiskInfo shrinking note. I read a thread about Samsungs 980 pro and 990 pro having problem with Windows 24H2 (sorry if I'm still gnawing on the same old bone 🤓) butI will update my firmwares before I do anything (I still wonder how since I'm running Windows 11 24H2 on my 2 machines but I guess even if there was an issue with it, a simple firmware update couldn't hurt my brand new 990 pro...hopefully 😅

 

[evermorex76]

a simple firmware update couldn't hurt my brand new 990 pro...hopefully

Well now you've guaranteed that they'll be bricked. Even if there are no updates. I assume you do full backups given the use of this machine.

The Samsung 980 Pro and 990 Pro had a major issue with their firmware that was causing drives to die or appear to be in trouble, but that was 2 years ago. I just assumed you wouldn't have such old firmware still. On some drives it would cause the SMART values for the remaining lifetime to plummet. Is your firmware that old? Maybe that's what happened, and maybe there is a certain sequence of events that triggers it. (Samsung's response to this issue, or rather their ardent denial of it initially, is why I won't buy their drives anymore.)

 

[tomdid]

Well now you've guaranteed that they'll be bricked. Even if there are no updates. I assume you do full backups given the use of this machine.

The Samsung 980 Pro and 990 Pro had a major issue with their firmware that was causing drives to die or appear to be in trouble, but that was 2 years ago. I just assumed you wouldn't have such old firmware still. On some drives it would cause the SMART values for the remaining lifetime to plummet. Is your firmware that old? Maybe that's what happened, and maybe there is a certain sequence of events that triggers it. (Samsung's response to this issue, or rather their ardent denial of it initially, is why I won't buy their drives anymore.)

My firmwares are actually that old... I had an "as light as possible" Windows installation because I already use a lot of softwares and plugins so I didn't want to slow down my system with too many assistants (I also have WD and Crucial onboard, and as you mentioned, WD SSDs had issues with 24H2).
I know for sure the perfect balance doesn't exist, so it's always a matter of compromise and well... now I'm screwed with the 980 Pro.

For now, I will install the new 990 Pro and just hope it won't be in trouble. I only have some libraries and preferences on C:, no work at all, so if anything fails, I'll have to install Windows again but all my work is backed up (3x) 😉

 

[evermorex76]

The 980 Pro should be fine once you update the firmware. It won't restore the health but it will prevent any dramatic failures (at least from known bugs), and 61% health isn't BAD, and you know it's not because of actual failing flash blocks or anything like that. That known issue may have been the cause of the crashing, or may not have been. And it may have resulted in some corrupt Windows files, or it may not have actually caused any permanent problems. Since you've got the new drive you could just use the 980 Pro as another backup or moving files, or whatever else, and at least not be worried that it isn't going to be safe to use.

 

[tomdid]

The 980 Pro should be fine once you update the firmware. It won't restore the health but it will prevent any dramatic failures (at least from known bugs), and 61% health isn't BAD, and you know it's not because of actual failing flash blocks or anything like that. That known issue may have been the cause of the crashing, or may not have been. And it may have resulted in some corrupt Windows files, or it may not have actually caused any permanent problems. Since you've got the new drive you could just use the 980 Pro as another backup or moving files, or whatever else, and at least not be worried that it isn't going to be safe to use.

You're absolutely right! Thanks a ton for your help
I will install my new SSD next week hopefully ; I just need to list all my softwares for an easy re-installation on the 990 Pro.

 

[tomdid]

Ow and I was thinking : of course I need a clean install to avoid re-creating the same scenario for my new SSD.

But if the issue I had is only because I did not update my SSD's firmware for at least 2 years, would you say it is reasonable to clone my actual system to the new SSD? Now I'm writing it, I'm really not sure what would be safer 😅