STATUS_FILE_INVALID (0xC0000098) – Volume Altered Externally

1. NTFS Corruption on the Boot Drive

This is the one I see 7 times out of 10. The error pops up during boot or when you try to open a file on a drive that was pulled from another machine, a VM snapshot reverted, or a system crashed while writing to disk. The MFT or directory index got stomped.

Fix: Boot from Windows Recovery and run chkdsk

1. Boot from a Windows install USB or recovery drive. Pick Repair your computer → Troubleshoot → Command Prompt.
2. Type chkdsk C: /f /r and hit Enter. If your OS is on D: or another drive, use that letter instead.
3. Let it finish. On a 1TB HDD this can take hours. On an SSD, maybe 10-15 minutes.
4. Restart normally.

If chkdsk finds bad sectors, you've got a dying drive. Replace it and restore from backup. Don't bother with chkdsk on a read-only volume – it won't fix anything. Use /f to force repair.

If you can't boot at all, boot from a Linux live USB and run ntfsfix /dev/sda2 (replace sda2 with your NTFS partition). It's less thorough but can get you back into Windows.

2. Corrupted or Mismatched VSS Shadow Copies

This happens when a backup tool or System Restore creates a snapshot, then the underlying volume changes. The file it's trying to read no longer matches the snapshot metadata. Common after a failed restore or disk resize.

Fix: Delete and rebuild VSS snapshots

1. Open an elevated Command Prompt (Admin).
2. Type vssadmin delete shadows /all and press Enter. This wipes all shadow copies.
3. Now type vssadmin resize shadowstorage /for=C: /on=C: /maxsize=5GB (adjust maxsize to your preference – 5GB is fine for most systems).
4. Reboot. Windows will recreate snapshots on next backup or restore point.

Skip this if you're not using System Restore or any VSS-aware backup (like Windows Backup, Veeam, or Macrium). It won't help. But if you see the error after a failed restore point, this is your fix.

3. File System Filter Driver Gone Rogue

Rarer, but I've seen it with antivirus software (especially McAfee or older Norton), encryption tools, and even OneDrive's placeholder files. The filter driver intercepts file I/O and messes up the volume timestamp or state.

Fix: Boot into Safe Mode and disable the driver

1. Restart and press F8 (Shift+F8 on some systems) during boot. Pick Safe Mode with Networking.
2. If the error doesn't appear in Safe Mode, it's a third-party driver.
3. Open msconfig, go to the Services tab, check Hide all Microsoft services, and disable all remaining services. Reboot normally.
4. If the error goes away, re-enable services one by one until it returns. That's your culprit.
5. For antivirus, temporarily uninstall it completely – not just disable, uninstall. Then reinstall the latest version.

If you can't boot to Safe Mode, use the Recovery Command Prompt and run dism /image:C:\ /remove-package /packagename:… – but that's advanced. Stick with Safe Mode first.

Quick-Reference Summary Table

Start with chkdsk. Skip VSS if you don't use snapshots. And for God's sake, keep a backup – you never know when a drive decides to die on a Tuesday afternoon.