What does NTSTATUS 0xC00000E9 (STATUS_UNEXPECTED_IO_ERROR) mean?

STATUS_UNEXPECTED_IO_ERROR

FsRtl normalized an otherwise unsupported I/O exception

STATUS_UNEXPECTED_IO_ERROR is intentionally a lossy wrapper. When an I/O error is outside the standard set accepted by an FsRtl filter path, Windows can convert it to this status so the filter handles the exception safely. The original lower-level I/O reason is therefore more informative than this final code when it is still available.

Diagnostic priority

• Capture the first exception or I/O status before filter normalization, together with the file object, operation, device stack, and filter drivers involved.
• Correlate storage, filesystem, network redirector, encryption, antivirus, or minifilter events only when they participate in that specific I/O path.
• Do not infer sparse-file, EFS, or reparse-point corruption from this status alone.

Recovery boundary

Fix the underlying I/O fault identified earlier in the path. If only this wrapper remains, reproduce with tracing at the filter/device boundary rather than treating the generic replacement as the root cause.

References

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Using NTSTATUS values