cheat sheet

chkdsk

Scan a FAT or NTFS volume for file system errors and bad sectors, optionally repairing them — the built-in Windows disk health and integrity tool for drives and volumes.

updated 05-26-2026

chkdsk — Check Disk

What it is

chkdsk (Check Disk) is a built-in Windows tool that examines a FAT or NTFS volume for file system metadata errors, cross-linked files, lost clusters, and bad sectors. In read-only mode (no flags) it reports problems without fixing them — useful for a quick health check. The /F flag repairs file system errors; /R also locates and attempts to recover data from bad sectors. When the target volume is the active system drive, chkdsk schedules the scan for the next reboot before Windows mounts the volume. Requires Administrator privileges. The modern PowerShell equivalent is Repair-Volume.

Availability

chkdsk ships as C:\Windows\System32\chkdsk.exe on every Windows version.

cmd

chkdsk /?

Output:

css

Checks a disk and displays a status report.

CHKDSK [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/B] [/scan] [/spotfix]

Syntax

cmd

chkdsk [volume:] [/F] [/R] [/V] [/X] [/I] [/C] [/B] [/scan] [/spotfix]

Output: (disk status report, then optional repair summary)

Essential options

Switch	Meaning
(no flags)	Read-only scan — report errors, no repair
`/F`	Fix file system errors
`/R`	Locate bad sectors and recover readable data (implies `/F`)
`/V`	Verbose — display full path of every file on FAT; cleanup messages on NTFS
`/X`	Force dismount before scan (implies `/F`) — use when the volume is in use
`/I`	Perform less rigorous index check (NTFS only, faster)
`/C`	Skip cycle checking in folder structure (NTFS only, faster)
`/B`	Re-evaluate bad clusters (NTFS only; implies `/R`) — use after replacing a failing drive
`/scan`	Online NTFS scan without dismounting (Windows 8+)
`/spotfix`	Fix issues found by `/scan` at next reboot (Windows 8+)
`/perf`	Use more system resources during `/scan` for faster completion

Read-only scan

Running chkdsk without flags scans the specified volume and reports the status without making any changes — safe to run on a live volume, including the system drive.

cmd

chkdsk C:

Output:

csharp

The type of the file system is NTFS.
Volume label is System.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
  393472 file records processed.                                              File verification completed.
  0 large file records processed.                                          0 bad file records processed.

Stage 2: Examining file name linkage ...
  562258 index entries processed.                                             Index verification completed.
  0 unindexed files scanned.                                             0 unindexed files recovered.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
  48012 data files processed.                                             CHKDSK is verifying Usn Journal...
  36795344 USN bytes processed.                                             Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

 499 GB total disk space.
  47 GB in 237,456 files.
   60 MB in 48,012 indexes.
    0 KB in bad sectors.
 430 MB in use by the system.
  65536 KB occupied by the log file.
 451 GB available on disk.

  4096 bytes in each allocation unit.
 130,892,780 total allocation units on disk.
 118,309,164 allocation units available on disk.

Fixing file system errors (/F)

/F repairs file system errors found during the scan. If the target volume is mounted (in use), Windows schedules the repair for the next reboot — the scan runs before Windows loads, when no files are open.

cmd

chkdsk D: /F

Output:

vbnet

The type of the file system is NTFS.
Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)

cmd

chkdsk C: /F

Output:

css

Chkdsk cannot run because the volume is in use by another process.
Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Y
This volume will be checked the next time the system restarts.

Bad sector scan (/R)

/R extends the check to physically read every sector on the disk, attempting to recover data from sectors flagged as bad and adding them to the bad cluster list. This takes significantly longer than /F alone — plan for hours on large drives.

cmd

chkdsk D: /R

Output:

csharp

The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
...
Stage 4: Looking for bad sectors in user file data ...
 499 GB processed.

Windows has made corrections to the file system.

  3 KB in bad sectors.

Online scan (/scan)

/scan performs a non-destructive, online scan of an NTFS volume without dismounting it. This allows scanning the system drive or any in-use volume while Windows is running. Requires Windows 8+.

cmd

chkdsk C: /scan

Output:

csharp

The type of the file system is NTFS.
Volume label is System.

Stage 1: Examining basic file system structure ...
Stage 2: Examining file name linkage ...
Stage 3: Examining security descriptors ...
Stage 4: Looking for bad sectors in user file data ...

Windows has scanned the file system and found no problems.

Scheduling a spotfix (/spotfix)

/spotfix applies only the fixes identified during a previous /scan at the next reboot, reducing downtime compared to a full /F pass.

cmd

chkdsk C: /spotfix

Output:

perl

The volume will be spotfixed the next time the system restarts.

Forcing dismount (/X)

/X forces the volume to dismount before the check, terminating any open handles. Use this on data volumes that cannot be unmounted interactively. Do not use /X on the system or boot volume (use scheduled repair instead).

cmd

chkdsk E: /F /X

Output:

csharp

The type of the file system is NTFS.
CHKDSK is verifying files (stage 1 of 3)...
...
CHKDSK found no errors on the disk.

Reading the exit code

chkdsk exits with a code that can be tested in batch scripts.

Exit code	Meaning
0	No errors
1	Errors found and fixed
2	Disk cleanup performed (e.g. free space corrected)
3	Errors found but could not be fixed

cmd

@echo off
chkdsk D: /F /R
if errorlevel 3 echo ERROR: Chkdsk could not fix all problems.
if errorlevel 1 echo INFO: Chkdsk made corrections.
if errorlevel 0 echo OK: No errors found.

Output:

makefile

INFO: Chkdsk made corrections.

Complete flag reference

Every documented switch with a short note on when it matters. Many are quietly inherited from older Windows releases — /F and /R predate Windows NT — while /scan, /spotfix, /sdcleanup, /offlinescanandfix, /forceofflinefix, and /perf were added with the Windows 8 NTFS self-healing redesign.

Switch	Volume types	Notes
`/F`	FAT, FAT32, exFAT, NTFS, ReFS	Fix file-system errors. On an in-use volume, schedules the scan for the next reboot.
`/V`	FAT, NTFS	Verbose. On FAT prints every file path; on NTFS prints cleanup messages.
`/R`	FAT, NTFS	Locate bad sectors and recover readable data. Implies `/F`.
`/X`	FAT, NTFS	Force dismount before scan (terminates open handles). Implies `/F`.
`/I`	NTFS only	Skip rigorous index-entry checks. Roughly 2–3× faster, but misses some index corruption.
`/C`	NTFS only	Skip cycle-checking in the folder structure. Faster, but skips orphaned-loop detection.
`/B`	NTFS only	Re-evaluate every cluster previously flagged as bad. Implies `/R`. Use after a drive replacement or imaging restore.
`/L[:size]`	NTFS only	Display current log size, or set it to `size` KB. The default is 65 536 KB; increase on volumes with heavy churn or many small files.
`/scan`	NTFS only	Online scan — never dismounts. Reports problems but does not fix in place.
`/spotfix`	NTFS only	Apply spot-fixes found by `/scan` at next reboot — usually under a minute downtime.
`/sdcleanup`	NTFS only	Garbage-collect unused security descriptors. Implies `/F`.
`/offlinescanandfix`	NTFS only	Run a classic offline scan-and-fix, ignoring the new self-healing engine.
`/forceofflinefix`	NTFS only	Queue all repairs for offline fix instead of attempting online repair. Use with `/scan`.
`/perf`	NTFS only	Use more system resources during `/scan` for faster completion.
`/freeorphanedchains`	FAT/exFAT only	Free orphaned cluster chains instead of restoring them as lost files.
`/markclean`	FAT/exFAT only	Mark the volume clean even if `/F` was not specified, after a successful scan.

The first time you run chkdsk /? on a Windows 11 / Server 2022 build you will see a slightly different help block depending on whether the focused volume is NTFS or FAT/exFAT — the tool re-prints the relevant switches for that file system.

Understanding the NTFS scan stages

Verbose runs report four stages. Knowing what each one verifies makes log scraping and failure diagnosis much faster.

Stage	What it verifies
Stage 1 — basic file system structure	The MFT (Master File Table), volume bitmap, attribute lists, and security descriptors.
Stage 2 — file name linkage	Directory index entries (`$INDEX_ROOT`/`$INDEX_ALLOCATION`) and the parent-child links between MFT records.
Stage 3 — security descriptors	The `$Secure` metafile and individual file ACLs. Add `/sdcleanup` to also garbage-collect unreferenced descriptors.
Stage 4 — bad-sector verification	Only runs with `/R` or `/B`. Reads every cluster, marks unreadable sectors in `$BadClus`, and copies recoverable data into the cluster shadow.

Stages 1–3 are mandatory; Stage 4 is the slow part that pushes a 4 TB scan into the 4–8 hour range.

cmd

rem Time how long each stage takes by piping output with timestamps
chkdsk D: /scan /perf 2>&1 | findstr /R "Stage Windows"

Output:

yaml

Stage 1: Examining basic file system structure ...
Stage 2: Examining file name linkage ...
Stage 3: Examining security descriptors ...
Stage 4: Looking for bad sectors in user file data ...
Windows has scanned the file system and found no problems.

Self-healing and the dirty bit

Modern NTFS (Windows 8 and later) embeds a background self-healing service that quietly repairs minor inconsistencies without dismounting the volume. When it cannot repair something automatically — typically a corrupt index entry or a flipped bit in a system file — it flags the volume dirty. The classic offline chkdsk /F is now reserved for those exceptional cases.

cmd

rem Inspect the dirty bit (set by NTFS or by 'fsutil dirty set')
fsutil dirty query C:

Output:

csharp

Volume - C: is NOT Dirty

cmd

rem When the bit is set, autochk runs chkdsk before Windows boots.
rem Suppress the prompt for D: only:
chkntfs /X D:

Output:

lua

(no output — exits 0)

cmd

rem Re-enable scheduled check for D:
chkntfs /D

Output:

css

The AUTOCHK behavior is now reset to the default.
All non-system drives will be checked at boot time.

The companion chkntfs.exe does not run chkdsk itself — it manages the AutoChk delay (/T:N), the exclusion list (/X drive), and the boot-time dirty check.

Repair-Volume — the PowerShell equivalent

Repair-Volume is the modern PowerShell cmdlet that wraps the same NTFS scan-and-repair engine. It is preferable in scripts: it returns objects, accepts pipeline input, and avoids the localization issues that bite chkdsk output parsing. It ships in the Storage module (built into Windows 8 / Server 2012 and later).

powershell

# Online scan — equivalent to chkdsk C: /scan
Repair-Volume -DriveLetter C -Scan

Output:

code

NoErrorsFound

powershell

# Apply a spot fix found by a previous scan — equivalent to chkdsk /spotfix
Repair-Volume -DriveLetter C -SpotFix

Output:

code

NoErrorsFound

powershell

# Full offline scan-and-fix — equivalent to chkdsk D: /F /R
Repair-Volume -DriveLetter D -OfflineScanAndFix

Output:

code

NoErrorsFound

powershell

# Get-Volume integrates with Repair-Volume via the pipeline
Get-Volume | Where-Object FileSystemType -eq 'NTFS' | Repair-Volume -Scan

Output:

code

NoErrorsFound
NoErrorsFound
NoErrorsFound

Repair-Volume returns one of NoErrorsFound, Corruption-FoundButNotFixed, or Corruption-Repaired. Map these for scripts:

powershell

$result = Repair-Volume -DriveLetter D -Scan
switch ($result) {
    'NoErrorsFound'             { 'OK'        }
    'Corruption-Repaired'       { 'Repaired'  }
    'Corruption-FoundButNotFixed' { 'NeedsReboot' }
}

Output:

code

OK

ReFS-specific behaviour

ReFS (Resilient File System) does not need a chkdsk in the classical sense — integrity streams, metadata checksums, and salvage operations are the design substitute. Running chkdsk /F on a ReFS volume invokes a minimal repair path (/scan) but most options are silently no-ops. Repair on ReFS is driven instead by Storage Spaces Direct and the Get-FileIntegrity / Repair-FileIntegrity cmdlets.

cmd

rem chkdsk on ReFS does not perform a full NTFS-style scan
chkdsk R: /scan

Output:

csharp

The type of the file system is ReFS.
A disk check has been scheduled.
Windows will now check the disk.
ReFS volumes do not need to be checked offline. Skipping volume checks.

powershell

# ReFS health verification: lean on integrity streams
Get-FileIntegrity -FileName 'R:\Data\important.bin'

Output:

python

FileName               Enabled Enforced
--------               ------- --------
R:\Data\important.bin     True     True

powershell

Repair-FileIntegrity -FileName 'R:\Data\important.bin'

Output:

ini

(no output — exits 0; integrity stream verified, alternates pulled if mirrored)

For ReFS volumes that are part of a Storage Spaces Direct cluster, Repair-VirtualDisk and Get-StorageJob are the real recovery tools. chkdsk becomes a fallback, not the primary workflow.

How `chkdsk` interacts with Volume Shadow Copy

A chkdsk /F on an NTFS volume invalidates Volume Shadow Copy snapshots stored on that volume because the diff areas are not preserved across structural fixes. If snapshots matter (System Restore, VSS-backed backups), prefer /scan /spotfix — spot-fixes are designed to leave shadow copies intact in most cases.

cmd

rem List shadow copies for a volume
vssadmin list shadows /for=C:

Output:

yaml

Contents of shadow copy set ID: {a1b2c3d4-e5f6-7890-abcd-ef1234567890}
   Contained 1 shadow copies at creation time: 5/20/2026 06:30:12
      Shadow Copy ID: {f0e1d2c3-b4a5-6789-fedc-ba9876543210}
         Original Volume: (C:)\\?\Volume{...}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3
         Originating Machine: MYHOST

cmd

rem Run an online scan that keeps shadow copies intact
chkdsk C: /scan
chkdsk C: /spotfix

Output:

perl

The type of the file system is NTFS.
Stage 1: Examining basic file system structure ...
...
Windows has scanned the file system and found no problems.

The volume will be spotfixed the next time the system restarts.

Resizing the NTFS log (/L)

The NTFS transaction log ($LogFile) records pending metadata changes. On volumes with very high churn (mail servers, dev workstations doing constant compile cycles) the default 64 MB log can spill and force throttling. /L:size resizes it in KB.

cmd

rem Read current log size
chkdsk C: /L

Output:

ini

Current size = 65536 KB

cmd

rem Grow log to 256 MB (requires dismount; on system volume, scheduled at next boot)
chkdsk D: /L:262144 /X

Output:

perl

Setting size of file system log to 262144 KB.
The file system log was successfully resized.

The minimum is 2 048 KB; the maximum is volume-dependent (typically 4 GB). Resizing the log does not move existing data — it only changes the maximum size used by future transactions.

Pre-boot AutoChk and chkntfs

When chkdsk /F is scheduled at boot, autochk.exe runs before the Windows kernel hands off to userland. chkntfs controls this process: you can exclude volumes, change the countdown timer, or query which volumes are scheduled.

cmd

rem Query which volumes are scheduled for AutoChk
chkntfs C: D: E:

Output:

vbnet

The type of the file system is NTFS.
C: is not dirty.
D: is dirty.
You may use the /C option to schedule chkdsk for this drive.
E: is not dirty.

cmd

rem Exclude E: from boot-time AutoChk (useful for noisy data volumes)
chkntfs /X E:

Output:

lua

(no output — exits 0)

cmd

rem Change AutoChk countdown to 5 seconds (default 10)
chkntfs /T:5

Output:

sql

The AUTOCHK initiation countdown time is set to 5 second(s).

cmd

rem Force a scheduled chkdsk for D: at next boot
chkntfs /C D:

Output:

perl

This volume will be checked the next time the system restarts.

cmd

rem Reset to defaults (no exclusions, default timer, no scheduled volumes)
chkntfs /D

Output:

css

The AUTOCHK behavior is now reset to the default.
All non-system drives will be checked at boot time.

Reading the boot-time AutoChk log

When chkdsk runs at boot, the output scrolls past too quickly to read. Windows records the full transcript to the Application event log under source Wininit (event ID 1001) and (since Windows 8) under Microsoft-Windows-Chkdsk/Operational.

cmd

rem Pull the latest Chkdsk boot-time log via wevtutil
wevtutil qe Application /q:"*[System[Provider[@Name='Wininit'] and (EventID=1001)]]" /f:text /c:1 /rd:true

Output:

yaml

Event[0]:
  Log Name: Application
  Source: Wininit
  Date: 2026-05-23T03:14:08.123
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: MYHOST
  Description:
    Checking file system on D:
    The type of the file system is NTFS.
    ...
    Windows has checked the file system and found no problems.

powershell

# Same data via PowerShell — easier to filter
Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Wininit'] and (EventID=1001)]]" -MaxEvents 1 |
    Select-Object -ExpandProperty Message

Output:

csharp

Checking file system on D:
The type of the file system is NTFS.
...
Windows has checked the file system and found no problems.

powershell

# Modern Chkdsk operational log (Windows 8+)
Get-WinEvent -LogName Microsoft-Windows-Chkdsk/Operational -MaxEvents 5 |
    Select-Object TimeCreated, Id, Message

Output:

swift

TimeCreated         Id Message
-----------         -- -------
5/23/2026 3:14:08 AM 26000 Chkdsk was executed in scan mode on a volume snapshot.
5/23/2026 3:14:09 AM 26214 Self healing successfully completed on volume D:.

Cross-references: where chkdsk fits in the toolchain

chkdsk is one tool in a stack of disk-integrity utilities. Use these alongside it.

Tool	When to use
`chkdsk` / `Repair-Volume`	NTFS / FAT metadata and sector integrity.
`sfc /scannow`	Windows system-file corruption (different from volume corruption).
`dism /Online /Cleanup-Image /RestoreHealth`	Component-store repair when `sfc` fails. See `sections/windows/dism`.
`fsutil dirty`	Inspect / set the NTFS dirty bit. See `sections/windows/fsutil`.
`defrag /A`	Fragmentation report (does not repair). See `sections/windows/defrag`.
`diskpart`	Partition-level operations, GPT/MBR conversion. See `sections/windows/diskpart`.
`mountvol`	Volume-level mount management. See `sections/windows/mountvol`.
`bcdedit`	Boot configuration when boot-time chkdsk corrupts BCD. See `sections/windows/bcdedit`.
`vssadmin list shadows`	Inspect Volume Shadow Copies before running `/F`.
`winsat disk`	Disk performance benchmark (not an integrity check).
`Get-PhysicalDisk` / `Get-Disk`	SMART and physical-disk health.
`df` / `du` / `duf` (Linux)	Space accounting on Linux mounts via WSL. See `sections/linux/df-du-duf`.

powershell

# Physical-disk SMART health — catches failing drives chkdsk can only paper over
Get-PhysicalDisk | Select FriendlyName, MediaType, OperationalStatus, HealthStatus

Output:

diff

FriendlyName             MediaType OperationalStatus HealthStatus
------------             --------- ----------------- ------------
Samsung SSD 990 PRO 2TB  SSD       OK                Healthy
WDC WD40EFRX-68N32N0     HDD       OK                Warning

Common pitfalls

/F on the system drive schedules a reboot-time scan — the scan cannot run while Windows is using the drive; accept the "check at next restart" prompt and reboot.
/R takes hours on large drives — a 4 TB scan can take 4–8 hours; never interrupt midway or you risk partial repairs; plan a maintenance window.
errorlevel check order matters in batch — check from highest to lowest (if errorlevel 3 ... if errorlevel 2 ... if errorlevel 1) because errorlevel N is true for any code ≥ N.
/scan does not fix — it reports — after /scan finds issues, run /spotfix or /F /R to actually repair them.
Repeated bad sectors mean hardware failure — if chkdsk /R finds bad sectors repeatedly across runs, the drive is failing; back up data and replace the drive; chkdsk cannot fix a physically degrading disk. On SSDs, repeated full-surface /R scans also slightly accelerate NAND wear because every cell is read and (for bad ones) written; reserve them for triage, not routine maintenance.
chkdsk does not test drive performance — use CrystalDiskMark or winsat disk for throughput benchmarking; chkdsk only checks file system integrity and sector readability.
/F invalidates Volume Shadow Copies — running /F on a volume with VSS snapshots destroys them; use /scan /spotfix to keep snapshots, or accept the loss and reboot quickly.
chkdsk on ReFS is mostly a no-op — ReFS uses online salvage via Storage Spaces; reach for Repair-FileIntegrity and Repair-VirtualDisk instead.
Cancelling at the AutoChk prompt does not always honor the cancellation — the 10-second AutoChk countdown can be bypassed only on volumes that are not the system drive; the system drive scan still runs.
Encrypted (BitLocker) volumes must be unlocked first — chkdsk on a locked BitLocker volume returns Cannot open volume for direct access; unlock with manage-bde -unlock before scanning.
/X kills open handles without warning — applications holding files on the volume crash; never use /X on a server share without notifying users first.
Mounted ISOs and virtual drives can show NTFS but fail /F — the underlying file is read-only; mount the host volume read-write or run chkdsk on the host.
/I and /C together miss real corruption — they're advertised as faster, but skipping index-entry checks and cycle detection can leave bad metadata in place; only use during triage, not as a final repair.
Output is localized — on a non-English Windows install, parsing chkdsk text with findstr fails; prefer Repair-Volume (returns enum values, locale-independent) for scripting.
AutoChk delay can be too short — on a console-attached server you may want chkntfs /T:30 to give time to press a key and cancel; default is 10 seconds.

Real-world recipes

Automated overnight scan of a data volume

cmd

@echo off
echo Starting chkdsk on D: at %TIME%
chkdsk D: /F /R > C:\Logs\chkdsk_%COMPUTERNAME%_%DATE:~10,4%%DATE:~4,2%%DATE:~7,2%.log
echo Finished at %TIME%. Exit code: %ERRORLEVEL%

Output:

vbnet

Starting chkdsk on D: at 23:00:02.34
Finished at 01:34:22.08. Exit code: 0

Online health check on the system drive

cmd

chkdsk C: /scan /perf

Output:

yaml

Stage 1: Examining basic file system structure ...
Stage 2: Examining file name linkage ...
Stage 3: Examining security descriptors ...
Stage 4: Looking for bad sectors in user file data ...
Windows has scanned the file system and found no problems.

Schedule system drive repair at next boot

cmd

chkdsk C: /F /R

Output:

css

Chkdsk cannot run because the volume is in use by another process.
Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Y
This volume will be checked the next time the system restarts.

Fleet health sweep via PowerShell

Run a non-disruptive /scan against every NTFS volume across a list of hosts and roll up the results.

powershell

$hosts = Get-Content C:\Ops\hostlist.txt
$report = foreach ($host in $hosts) {
    try {
        Invoke-Command -ComputerName $host -ScriptBlock {
            Get-Volume |
                Where-Object FileSystemType -eq 'NTFS' |
                ForEach-Object {
                    [PSCustomObject]@{
                        Host       = $env:COMPUTERNAME
                        Drive      = $_.DriveLetter
                        Label      = $_.FileSystemLabel
                        SizeGB     = [math]::Round($_.Size / 1GB, 1)
                        FreeGB     = [math]::Round($_.SizeRemaining / 1GB, 1)
                        ScanResult = (Repair-Volume -DriveLetter $_.DriveLetter -Scan)
                    }
                }
        } -ErrorAction Stop
    }
    catch {
        [PSCustomObject]@{ Host = $host; Drive = '?'; ScanResult = "UNREACHABLE: $($_.Exception.Message)" }
    }
}
$report | Format-Table -AutoSize
$report | Export-Csv -Path C:\Ops\chkdsk_sweep.csv -NoTypeInformation

Output:

sql

Host    Drive Label   SizeGB FreeGB ScanResult
----    ----- -----   ------ ------ ----------
MYHOST  C     System   475.0  237.4 NoErrorsFound
MYHOST  D     Data    1862.4  843.2 NoErrorsFound
SRV01   C     System   237.0   84.1 NoErrorsFound
SRV02   C     System   237.0   34.7 Corruption-Repaired

Dirty-bit watchdog

Detect volumes whose dirty bit has been set unexpectedly and alert before the next reboot triggers a long offline scan.

powershell

$alerts = foreach ($v in Get-Volume | Where-Object DriveLetter) {
    $dirty = (cmd /c "fsutil dirty query $($v.DriveLetter):" 2>$null) -match 'is Dirty\s*$'
    if ($dirty) {
        [PSCustomObject]@{
            Drive = "$($v.DriveLetter):"
            Label = $v.FileSystemLabel
            Note  = 'Dirty bit set — chkdsk will run at next reboot'
        }
    }
}
if ($alerts) {
    $alerts | Format-Table -AutoSize
    # Trigger an online scan now to avoid a reboot-time delay
    $alerts | ForEach-Object { Repair-Volume -DriveLetter ($_.Drive.TrimEnd(':')) -Scan }
}

Output:

arduino

Drive Label Note
----- ----- ----
D:    Data  Dirty bit set — chkdsk will run at next reboot

NoErrorsFound

Pre-imaging integrity gate

Block a backup job until the source volume is verifiably clean.

powershell

$drive   = 'D'
$result  = Repair-Volume -DriveLetter $drive -Scan
if ($result -ne 'NoErrorsFound') {
    Write-Error "Volume ${drive}: not clean (state: $result). Refusing to image."
    exit 1
}
Write-Host "Volume ${drive}: verified clean. Proceeding with image."
& wbadmin start backup -backupTarget:\\backupserver\fleet -include:${drive}: -quiet

Output:

less

Volume D: verified clean. Proceeding with image.
wbadmin 1.0 - Backup command-line tool
(c) Microsoft Corporation. Reserves all rights.
Retrieving volume information...
This will back up volume Data (D:) to \\backupserver\fleet.
The backup operation successfully completed.

Long-scan progress monitor

chkdsk /R provides limited progress output. Use a background job to time-stamp checkpoints to a log.

powershell

$logPath = 'C:\Logs\chkdsk_E_{0}.log' -f (Get-Date -Format yyyyMMdd_HHmmss)
Start-Job -Name chkdsk-E -ScriptBlock {
    param($log)
    cmd /c "chkdsk E: /F /R" 2>&1 | ForEach-Object {
        '{0:yyyy-MM-dd HH:mm:ss}  {1}' -f (Get-Date), $_ |
            Tee-Object -FilePath $log -Append
    }
} -ArgumentList $logPath
Receive-Job -Name chkdsk-E -Keep | Select-Object -Last 5

Output:

csharp

2026-05-25 23:00:01  The type of the file system is NTFS.
2026-05-25 23:00:02  Stage 1: Examining basic file system structure ...
2026-05-25 23:14:08  Stage 2: Examining file name linkage ...
2026-05-25 23:29:51  Stage 3: Examining security descriptors ...
2026-05-25 23:33:02  Stage 4: Looking for bad sectors in user file data ...

Sources

Microsoft Learn — chkdsk command — Full parameter reference (/f /v /r /x /i /c /l[:size] /b /scan /forceofflinefix /perf /spotfix /sdcleanup /offlinescanandfix /freeorphanedchains /markclean), exit codes, HDD-vs-SSD behaviour notes, and Event Viewer / PowerShell recipes for retrieving Chkdsk and Wininit log entries.

chkdsk — Check Disk

What it is

Availability

Syntax

Essential options

Read-only scan

Fixing file system errors (/F)

Bad sector scan (/R)

Online scan (/scan)

Scheduling a spotfix (/spotfix)

Forcing dismount (/X)

Reading the exit code

Complete flag reference

Understanding the NTFS scan stages

Self-healing and the dirty bit

Repair-Volume — the PowerShell equivalent

ReFS-specific behaviour

How chkdsk interacts with Volume Shadow Copy

Resizing the NTFS log (/L)

Pre-boot AutoChk and chkntfs

Reading the boot-time AutoChk log

Cross-references: where chkdsk fits in the toolchain

Common pitfalls

Real-world recipes

Automated overnight scan of a data volume

Online health check on the system drive

Schedule system drive repair at next boot

Fleet health sweep via PowerShell

Dirty-bit watchdog

Pre-imaging integrity gate

Long-scan progress monitor

Sources

How `chkdsk` interacts with Volume Shadow Copy