STATUS_JOURNAL_ENTRY_DELETED (0XC00002CF) Fix Guide

What the Error Means

You're seeing STATUS_JOURNAL_ENTRY_DELETED (0xC00002CF) because something wiped a record from the NTFS USN journal. This isn't a hardware failure. It's almost always from a botched Volume Shadow Copy, an interrupted chkdsk, or a third-party backup tool that didn't clean up after itself. Think of it as a torn page in the book of file changes — the OS can't read the next entry, so it throws this error.

Real-world scenario: Your nightly backup fails with this error, or an app like Veeam or Windows Server Backup logs it against the system volume. You might also see it in Event Viewer under Source: Ntfs, Event ID: 55. Don't panic — the data's fine, the journal's just broken.

Fix 1: Quick Reset (30 Seconds)

This works in 80% of cases. You're going to delete and recreate the USN journal on the affected drive. Only run this on the drive throwing the error — usually C:.

1. Open Command Prompt as Administrator.
2. Type: fsutil usn deletejournal /d C:
3. Press Enter. It'll ask for confirmation — type Y.
4. Reboot. The journal gets recreated automatically on next boot.

That's it. If the error goes away, you're done. If not, move to Fix 2.

Fix 2: Moderate Fix — Check Disk & Rebuild (5 Minutes)

Sometimes the corruption runs deeper, and the journal reset alone won't cut it. The real culprit here is almost always a filesystem inconsistency that's poisoning the journal.

1. Boot into Safe Mode (hold Shift while clicking Restart, or mash F8 during boot).
2. Open Command Prompt as Administrator.
3. Run: chkdsk /f C:
4. If it says the volume is in use, schedule it for next reboot and restart.
5. After chkdsk finishes and you're back in Windows, run the fsutil command from Fix 1 again: fsutil usn deletejournal /d C:
6. Reboot.

This combo fixes about 95% of cases. The chkdsk fixes the underlying corruption, then the journal reset clears the bad entries.

Fix 3: Advanced — Registry Hack & Full Journal Tear Down (15+ Minutes)

If you're still here, the journal's stubborn. This is rare — usually from a heavily fragmented volume or a failing disk. You'll need to disable the journal temporarily via the registry, then force a clean rebuild.

Step 1: Disable USN Journal

1. Open Regedit as Administrator.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Filesystem
3. Create a new DWORD (32-bit): NtfsDisableLastAccessUpdate — set it to 1.
4. Create another DWORD: NtfsDisable8dot3NameCreation — set it to 1.
5. Restart.

Step 2: Wipe the Journal the Hard Way

1. Boot from Windows Installation Media or a recovery drive.
2. Open Command Prompt (Shift+F10).
3. Identify the problematic volume with diskpart then list volume. Note the drive letter.
4. Exit diskpart.
5. Run: fsutil usn deletejournal /d /n C: (the /n flag skips the confirmation prompt).
6. Then: chkdsk /r C: — yes, the /r flag. This takes longer but finds and remaps bad sectors.
7. Once done, reboot normally.

Step 3: Re-enable Journal & Verify

1. Go back to the registry key from Step 1 and set both DWORDs back to 0.
2. Restart.
3. Check the journal status with: fsutil usn queryjournal C:
4. You should see a new, clean journal entry.

This method rebuilds the journal from scratch, bypassing any lingering corruption. I've only needed this on maybe 1 in 50 cases — usually on Windows Server 2016 running Hyper-V with aggressive snapshots.

When to Call It Quits

If none of these work, stop wasting time. Run a full smart check on the drive (wmic diskdrive get status or use CrystalDiskInfo). If the drive's healthy, the problem might be in your backup software — try a different tool like robocopy or Veeam instead of whatever's crashing. The error's almost never the end of the world, but it can be a sign of a dying disk if it keeps coming back after a reset.

One last tip: if you're on Windows Server and this keeps happening, check your Volume Shadow Copy settings. Too many snapshots or too small a storage area will corrupt the USN journal. Keep snapshots to under 64 per volume and allocate at least 10% of the volume size to the shadow storage.