What does Windows error code 1181 (ERROR_JOURNAL_ENTRY_DELETED) mean?

 
Previous Next
ERROR_POTENTIAL_FILE_FOUND ERROR_VRF_CFG_ENABLED

ERROR_JOURNAL_ENTRY_DELETED

The requested USN journal entry has already been removed.

ERROR_JOURNAL_ENTRY_DELETED has value 1181 (0x49D). A change-journal consumer supplied a starting USN that precedes the first record still available in the current NTFS journal. The checkpoint may once have been valid, but journal trimming, deletion, or recreation made that history inaccessible.

Typical sequence leading to 1181

  • an indexer or backup agent remains offline long enough for the journal to wrap
  • journal maximum size and allocation delta are too small for the volume change rate
  • an administrator deletes and recreates the journal
  • a snapshot or cloned system restores an old checkpoint against newer volume state
  • the application saves the USN but not the corresponding journal ID and volume identity

Confirm the gap before recovering

Query the current journal with FSCTL_QUERY_USN_JOURNAL. Record its journal ID, FirstUsn, NextUsn, lowest valid USN, maximum size, and allocation delta. Compare these values with the persisted journal ID and requested start position. This determines whether the failure is ordinary retention loss or a switch to a different journal generation.

Correct recovery model

Incremental processing cannot reconstruct changes that are no longer present. Establish a new complete baseline of the directory tree or data set, save the current journal identity and checkpoint, and then resume incremental reads. Marking the missing interval as processed would create silent omissions in a backup, antivirus scan, search index, or replication database.

Telemetry that helps capacity planning

  • time since the last successful read and duration of consumer downtime
  • distance between the requested USN and current FirstUsn
  • volume size, journal capacity, and recent change rate
  • full-scan duration and number of objects re-baselined
  • whether journal identity changed or only old records aged out

These measurements show whether the journal is undersized, the polling interval is excessive, or outages routinely exceed retention.

Retry policy

Retrying the same start USN cannot restore deleted records. A retry is appropriate only after the caller changes strategy: begin at a valid position after a full reconciliation, or wait for a separate baseline operation to complete. Do not hide repeated 1181 results behind indefinite backoff.

Difference from adjacent journal states

ERROR_JOURNAL_NOT_ACTIVE means the volume has no active journal. ERROR_JOURNAL_DELETE_IN_PROGRESS describes a temporary deletion phase. Error 1181 says a journal is available, but the requested historical entry is outside its retained range.

Example

A file synchronization service stores USN 850000 and is stopped for several weeks. On restart, the volume reports FirstUsn 1320000. A read beginning at the old checkpoint returns 1181. The service performs a complete comparison, stores the current journal ID with a new USN, and only then resumes change-driven synchronization.

References

Looking for a different code? Search another status or error code.