{"id":41799,"date":"2025-06-22T18:38:22","date_gmt":"2025-06-22T09:38:22","guid":{"rendered":"https:\/\/jouhou.main.jp\/?p=41799"},"modified":"2026-01-23T19:46:36","modified_gmt":"2026-01-23T10:46:36","slug":"windows%e3%82%a4%e3%83%99%e3%83%b3%e3%83%88%e3%83%ad%e3%82%b0%e8%a7%a3%e6%9e%90%ef%bc%9antfs%e3%83%95%e3%82%a1%e3%82%a4%e3%83%ab%e7%a0%b4%e6%90%8d%e3%81%a8%e5%be%a9%e6%97%a7%e7%b7%a8","status":"publish","type":"post","link":"https:\/\/jouhou.main.jp\/?p=41799","title":{"rendered":"Windows\u30a4\u30d9\u30f3\u30c8\u30ed\u30b0\u89e3\u6790\uff1aNTFS\u30d5\u30a1\u30a4\u30eb\u7834\u640d\u3068\u5fa9\u65e7\u7de8"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t
\r\n
\r\n
\r\n
\u6700\u77ed\u30c1\u30a7\u30c3\u30af<\/div>\r\n
\r\n
\u30a4\u30d9\u30f3\u30c8\u30ed\u30b0\u304b\u3089\u300cNTFS\u7834\u640d\u304b\u300d\u300c\u4fdd\u5b58\u5148\u306e\u969c\u5bb3\u304b\u300d\u3092\u6700\u77ed\u3067\u5207\u308a\u5206\u3051<\/div>\r\n
\u76f4\u3059\u3088\u308a\u5148\u306b\u3001\u5f71\u97ff\u7bc4\u56f2\u3068\u300c\u89e6\u3063\u3066\u3088\u3044\u72b6\u614b\u304b\u300d\u3092\u78ba\u8a8d\u3057\u3066\u3001\u6700\u5c0f\u5909\u66f4\u3067\u53ce\u675f\u3055\u305b\u307e\u3059\u3002<\/div>\r\n <\/div>\r\n <\/div>\r\n\r\n
\r\n
\r\n
\r\n 1<\/span>\r\n <\/div>\r\n
\r\n
30\u79d2\u3067\u4e89\u70b9\u3092\u7d5e\u308b\uff08\u8aad\u3080\u3060\u3051\u3067OK\uff09<\/div>\r\n
\u300c\u3069\u306e\u30dc\u30ea\u30e5\u30fc\u30e0\u3067\u300d\u300c\u8ab0\u304c\u300d\u300c\u3069\u306e\u64cd\u4f5c\u3067\u6b62\u307e\u3063\u305f\u304b\u300d\u3092\u5148\u306b\u56fa\u5b9a\u3059\u308b\u3068\u3001\u5fa9\u65e7\u306e\u624b\u9806\u304c\u30d6\u30ec\u307e\u305b\u3093\u3002<\/div>\r\n 
PowerShell\uff08\u7ba1\u7406\u8005\uff09\r\n1) \u76f4\u8fd1\u306eNTFS\/\u30c7\u30a3\u30b9\u30af\u7cfb\u30a4\u30d9\u30f3\u30c8\u3060\u3051\u62fe\u3046\r\nGet-WinEvent -FilterHashtable @{LogName='System'} |\r\n  Where-Object {$_.ProviderName -in 'Ntfs','Disk','storahci','stornvme','storport','volsnap','Microsoft-Windows-Kernel-Power'} |\r\n  Select-Object TimeCreated,Id,ProviderName,LevelDisplayName,Message -First 25\r\n\r\n2) \u5bfe\u8c61\u30c9\u30e9\u30a4\u30d6\u306e\u6697\u53f7\u5316\u3084\u72b6\u614b\u3092\u78ba\u8a8d\r\nmanage-bde -status\r\nfsutil dirty query C:<\/pre>\r\n        <\/div>\r\n      <\/div>\r\n    <\/div>\r\n\r\n    
\r\n      
\r\n        
\r\n          2<\/span>\r\n        <\/div>\r\n        
\r\n          
\u4e89\u70b9\u5225\uff1a\u4eca\u5f8c\u306e\u9078\u629e\u3084\u884c\u52d5<\/div>\r\n          
\u30ed\u30b0\u306e\u50be\u5411\u306b\u5408\u308f\u305b\u3066\u300c\u3084\u308b\u3053\u3068\u300d\u3092\u6700\u77ed\u3067\u9078\u3073\u307e\u3059\u3002\u8ff7\u3063\u305f\u3089\u201c\u66f8\u304d\u8fbc\u307f\u3092\u5897\u3084\u3055\u306a\u3044\u201d\u5074\u3078\u3002<\/div>\r\n\r\n          
\r\n            
A) Ntfs\/Disk\u7cfb\u304c\u9023\u767a\u30fbI\/O\u30ea\u30c8\u30e9\u30a4\u304c\u898b\u3048\u308b\uff08\u4fdd\u5b58\u5148\u306e\u969c\u5bb3\u5bc4\u308a\uff09<\/div>\r\n            
\u512a\u5148\uff1a\u66f8\u304d\u8fbc\u307f\u505c\u6b62 \u2192 \u72b6\u614b\u628a\u63e1 \u2192 \u53ef\u80fd\u306a\u3089\u30af\u30ed\u30fc\u30f3\/\u30a4\u30e1\u30fc\u30b8\r\nPowerShell\r\nGet-PhysicalDisk | Select FriendlyName,HealthStatus,OperationalStatus,Size\r\nwmic diskdrive get status,model,serialnumber\r\nchkdsk C: \/scan   \uff08\u307e\u305a\u306f\u30aa\u30f3\u30e9\u30a4\u30f3\u8a3a\u65ad\uff09<\/pre>\r\n          <\/div>\r\n\r\n          
\r\n            
B) \u76f4\u524d\u306e\u505c\u96fb\/\u5f37\u5236\u7d42\u4e86\u306e\u3042\u3068\u304b\u3089\u767a\u751f\uff08\u8ad6\u7406\u7834\u640d\u30fb\u6574\u5408\u6027\u5d29\u308c\u5bc4\u308a\uff09<\/div>\r\n            
\u512a\u5148\uff1a\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u78ba\u4fdd \u2192 \u5909\u66f4\u306f\u6700\u5c0f\u3067\u4fee\u5fa9\u5224\u65ad\r\nPowerShell\r\nGet-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'} |\r\n  Select TimeCreated,Id,Message -First 10\r\n\r\nsfc \/scannow\r\ndism \/online \/cleanup-image \/restorehealth\r\nchkdsk C: \/scan<\/pre>\r\n          <\/div>\r\n\r\n          
\r\n            
C) \u7279\u5b9a\u30d5\u30a9\u30eb\u30c0\u3060\u3051\u8aad\u3081\u306a\u3044\/\u30a2\u30af\u30bb\u30b9\u62d2\u5426\u304c\u6df7\u5728\uff08\u6a29\u9650\u30fb\u6697\u53f7\u5316\u30fb\u30a2\u30d7\u30ea\u8981\u56e0\u5bc4\u308a\uff09<\/div>\r\n            
\u512a\u5148\uff1a\u5bfe\u8c61\u7bc4\u56f2\u306e\u7279\u5b9a \u2192 \u8aad\u307f\u53d6\u308a\u512a\u5148\u3067\u9000\u907f\r\nwhoami\r\nicacls \"C:\\\u5bfe\u8c61\u30d5\u30a9\u30eb\u30c0\" \r\ncipher \/c \"C:\\\u5bfe\u8c61\u30d5\u30a1\u30a4\u30eb\"\r\nwevtutil qe Application \/q:\"*[System[(Level=2 or Level=3)]]\" \/c:30 \/f:text<\/pre>\r\n          <\/div>\r\n\r\n          
\r\n            
D) \u76f4\u3057\u305f\u3064\u3082\u308a\u304c\u518d\u767a\u3059\u308b\uff08\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\/\u30b1\u30fc\u30d6\u30eb\/\u30c9\u30e9\u30a4\u30d0\/\u30d5\u30a1\u30fc\u30e0\u7591\u3044\uff09<\/div>\r\n            
\u512a\u5148\uff1a\u30ed\u30b0\u306e\u540c\u6642\u523b\u76f8\u95a2 \u2192 \u30cf\u30fc\u30c9\/\u30c9\u30e9\u30a4\u30d0\u5074\u306e\u624b\u5f53\u3066\u5224\u65ad\r\nPowerShell\r\nGet-WinEvent -FilterHashtable @{LogName='System'} |\r\n  Where-Object {$_.ProviderName -in 'stornvme','storahci','storport','WHEA-Logger','Disk'} |\r\n  Select TimeCreated,Id,ProviderName,Message -First 40<\/pre>\r\n          <\/div>\r\n\r\n        <\/div>\r\n      <\/div>\r\n    <\/div>\r\n\r\n    
\r\n      
\r\n        
\r\n          3<\/span>\r\n        <\/div>\r\n        
\r\n          
\u9078\u629e\u3084\u884c\u52d5\u3059\u308b\u524d\u306b\uff1a\u5f71\u97ff\u7bc4\u56f2\u30921\u5206\u3067\u78ba\u8a8d\uff08\u3084\u308a\u904e\u304e\u9632\u6b62\uff09<\/div>\r\n          
\u300c\u5bfe\u8c61\u30dc\u30ea\u30e5\u30fc\u30e0\u300d\u300c\u6642\u9593\u5e2f\u300d\u300c\u66f8\u304d\u8fbc\u307f\u3092\u5897\u3084\u3059\u4f5c\u696d\u304b\u300d\u3092\u898b\u3048\u308b\u5316\u3057\u3066\u304b\u3089\u9032\u3081\u308b\u3068\u3001\u4e8b\u6545\u304c\u8d77\u304d\u306b\u304f\u3044\u3067\u3059\u3002<\/div>\r\n          
1) \u3069\u306e\u30dc\u30ea\u30e5\u30fc\u30e0\u304c\u602a\u3057\u3044\u304b\r\nmountvol\r\nwmic logicaldisk get name,filesystem,freespace,size\r\n\r\n2) \u76f4\u8fd1\u306e\u7570\u5e38\u306e\u6642\u523b\u3092\u56fa\u5b9a\uff08\u524d\u5f8c5\u301c10\u5206\uff09\r\nGet-WinEvent -FilterHashtable @{LogName='System'} |\r\n  Select TimeCreated,ProviderName,Id,LevelDisplayName -First 80\r\n\r\n3) \u30d0\u30c3\u30af\u30a2\u30c3\u30d7\/\u30b9\u30ca\u30c3\u30d7\u30b7\u30e7\u30c3\u30c8\u306e\u6709\u7121\uff08\u3042\u308b\u306a\u3089\u5148\u306b\u78ba\u4fdd\uff09\r\nvssadmin list shadows\r\nwbadmin get versions<\/pre>\r\n        <\/div>\r\n      <\/div>\r\n    <\/div>\r\n\r\n    
\r\n      
\u5931\u6557\u3059\u308b\u3068\u3069\u3046\u306a\u308b\uff1f\uff08\u3084\u308a\u304c\u3061\u306a\u30df\u30b9\u3068\u8d77\u3053\u308a\u5f97\u308b\u7d50\u679c\uff09<\/div>\r\n