Fix ERROR_EA_FILE_CORRUPT 0X00000114 quick

This error is a pain. Let me save you the headache.

ERROR_EA_FILE_CORRUPT (0X00000114) shows up when Windows tries to access extended attributes on an NTFS volume and finds them corrupted. It usually hits when copying files, running a backup, or after a hard crash. The extended attributes file — $Extend — gets scrambled, and Windows won't touch it.

Here's the fix that works 9 times out of 10. Skip the sfc /scannow noise — it won't touch this.

Step 1: Run chkdsk /f on the affected drive

Open Command Prompt as Administrator. Run this:

chkdsk C: /f

Replace C: with the drive showing the error. If it's your system drive, it'll ask to schedule on next reboot — type Y and restart.

Why this first? chkdsk repairs the NTFS metadata that governs the $Extend folder. The /f flag fixes errors on the disk — it's the same flag I've used since Windows 2000. Wait for it to finish. This can take a while on a big drive.

Step 2: Delete the corrupted $Extend folder (if chkdsk didn't fix it)

Sometimes chkdsk marks the folder as bad but doesn't delete it. You'll still see the error. Here's how to nuke it:

Boot from a Windows installation USB or recovery environment.
Press Shift+F10 to open Command Prompt.
Figure out your drive letter. It's often not C: in the recovery environment. Run diskpart, then list volume to find it. Let's say it's D:.
Run: attrib -r -s -h D:\$Extend — this strips the read-only, system, and hidden flags.
Then: rd /s /q D:\$Extend — deletes it.
Reboot.

Warning: Deleting $Extend removes all extended attributes. That includes file metadata like zone identifiers (the "downloaded from internet" flag) and some search indexing data. Your files remain intact, but you might lose thumbnails or security descriptors. For most people, that's fine.

Step 3: Reboot and test

After chkdsk finishes (or you deleted $Extend), restart normally. Try the operation that triggered the error. If it's gone, you're done. If not — move to the less common fixes below.

Less common variations — when the above isn't enough

1. NTFS logfile corruption

Sometimes the problem isn't $Extend itself but the NTFS logfile ($LogFile). In rare cases, chkdsk can't replay the log. You need to force it:

chkdsk /f /r C:

The /r flag does a surface scan and fixes bad sectors. It's slower but catches what /f misses.

2. Hardware-level sector errors

If chkdsk reports "unrecoverable error" or the drive clicks, the disk itself is failing. Pull any data you can immediately. Run wmic diskdrive get status — if it says "Bad", replace the drive. No amount of software fixing will help.

3. Antivirus or third-party filter drivers

I've seen Symantec Endpoint Protection and certain backup agents hold extended attributes open, preventing repair. Boot into Safe Mode with Networking and try the chkdsk again. If it works, uninstall that software.

4. System Restore points referencing corrupted EA

Shadow copies can store copies of the bad EAs. If the error pops up when you try to access Previous Versions or restore points, delete them via System Properties > System Protection > Configure > Delete. Then rerun chkdsk.

Prevention — stop it from happening again

Never force power off. Hard crashes are the #1 cause of $Extend corruption. If you must, use the power button — but hold it for 10 seconds only as a last resort.
Keep NTFS volumes healthy. Run chkdsk /f quarterly. I schedule it via Task Scheduler on all my servers.
Monitor drive health. Use CrystalDiskInfo or wmic to check SMART attributes. If reallocated sector count or pending sectors increase, replace the drive before it corrupts data.
Back up extended attributes if you rely on them (e.g., in development or forensic environments). Use fsutil or icacls to export permissions — those are stored in EAs.
Disable unnecessary third-party filter drivers. Backup software and antivirus often hook into EA operations. If you don't need them, uninstall or disable.

That's it. 0x00000114 is nasty but fixable. One drive, one chkdsk, one deletion — and you're back. If you're still stuck after this, the drive hardware is likely toast. Replace it.