chkdsk — Check Disk#

What it is#

chkdsk (Check Disk) is a built-in Windows tool that examines a FAT or NTFS volume for file system metadata errors, cross-linked files, lost clusters, and bad sectors. In read-only mode (no flags) it reports problems without fixing them — useful for a quick health check. The /F flag repairs file system errors; /R also locates and attempts to recover data from bad sectors. When the target volume is the active system drive, chkdsk schedules the scan for the next reboot before Windows mounts the volume. Requires Administrator privileges. The modern PowerShell equivalent is Repair-Volume.

Availability#

chkdsk ships as C:\Windows\System32\chkdsk.exe on every Windows version.

chkdsk /?

Output:

Checks a disk and displays a status report.

CHKDSK [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/B] [/scan] [/spotfix]

Syntax#

chkdsk [volume:] [/F] [/R] [/V] [/X] [/I] [/C] [/B] [/scan] [/spotfix]

Output: (disk status report, then optional repair summary)

Essential options#

Read-only scan#

Running chkdsk without flags scans the specified volume and reports the status without making any changes — safe to run on a live volume, including the system drive.

chkdsk C:

Output:

The type of the file system is NTFS.
Volume label is System.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
  393472 file records processed.                                              File verification completed.
  0 large file records processed.                                          0 bad file records processed.

Stage 2: Examining file name linkage ...
  562258 index entries processed.                                             Index verification completed.
  0 unindexed files scanned.                                             0 unindexed files recovered.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
  48012 data files processed.                                             CHKDSK is verifying Usn Journal...
  36795344 USN bytes processed.                                             Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

 499 GB total disk space.
  47 GB in 237,456 files.
   60 MB in 48,012 indexes.
    0 KB in bad sectors.
 430 MB in use by the system.
  65536 KB occupied by the log file.
 451 GB available on disk.

  4096 bytes in each allocation unit.
 130,892,780 total allocation units on disk.
 118,309,164 allocation units available on disk.

Fixing file system errors (/F)#

/F repairs file system errors found during the scan. If the target volume is mounted (in use), Windows schedules the repair for the next reboot — the scan runs before Windows loads, when no files are open.

chkdsk D: /F

Output:

The type of the file system is NTFS.
Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)

chkdsk C: /F

Output:

Chkdsk cannot run because the volume is in use by another process.
Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Y
This volume will be checked the next time the system restarts.

Bad sector scan (/R)#

/R extends the check to physically read every sector on the disk, attempting to recover data from sectors flagged as bad and adding them to the bad cluster list. This takes significantly longer than /F alone — plan for hours on large drives.

chkdsk D: /R

Output:

The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
...
Stage 4: Looking for bad sectors in user file data ...
 499 GB processed.

Windows has made corrections to the file system.

  3 KB in bad sectors.

Online scan (/scan)#

/scan performs a non-destructive, online scan of an NTFS volume without dismounting it. This allows scanning the system drive or any in-use volume while Windows is running. Requires Windows 8+.

chkdsk C: /scan

Output:

The type of the file system is NTFS.
Volume label is System.

Stage 1: Examining basic file system structure ...
Stage 2: Examining file name linkage ...
Stage 3: Examining security descriptors ...
Stage 4: Looking for bad sectors in user file data ...

Windows has scanned the file system and found no problems.

Scheduling a spotfix (/spotfix)#

/spotfix applies only the fixes identified during a previous /scan at the next reboot, reducing downtime compared to a full /F pass.

chkdsk C: /spotfix

Output:

The volume will be spotfixed the next time the system restarts.

Forcing dismount (/X)#

/X forces the volume to dismount before the check, terminating any open handles. Use this on data volumes that cannot be unmounted interactively. Do not use /X on the system or boot volume (use scheduled repair instead).

chkdsk E: /F /X

Output:

The type of the file system is NTFS.
CHKDSK is verifying files (stage 1 of 3)...
...
CHKDSK found no errors on the disk.

Reading the exit code#

chkdsk exits with a code that can be tested in batch scripts.

@echo off
chkdsk D: /F /R
if errorlevel 3 echo ERROR: Chkdsk could not fix all problems.
if errorlevel 1 echo INFO: Chkdsk made corrections.
if errorlevel 0 echo OK: No errors found.

Output:

INFO: Chkdsk made corrections.

Complete flag reference#

Every documented switch with a short note on when it matters. Many are quietly inherited from older Windows releases — /F and /R predate Windows NT — while /scan, /spotfix, /sdcleanup, /offlinescanandfix, /forceofflinefix, and /perf were added with the Windows 8 NTFS self-healing redesign.

The first time you run chkdsk /? on a Windows 11 / Server 2022 build you will see a slightly different help block depending on whether the focused volume is NTFS or FAT/exFAT — the tool re-prints the relevant switches for that file system.

Understanding the NTFS scan stages#

Verbose runs report four stages. Knowing what each one verifies makes log scraping and failure diagnosis much faster.

Stages 1–3 are mandatory; Stage 4 is the slow part that pushes a 4 TB scan into the 4–8 hour range.

rem Time how long each stage takes by piping output with timestamps
chkdsk D: /scan /perf 2>&1 | findstr /R "Stage Windows"

Output:

Stage 1: Examining basic file system structure ...
Stage 2: Examining file name linkage ...
Stage 3: Examining security descriptors ...
Stage 4: Looking for bad sectors in user file data ...
Windows has scanned the file system and found no problems.

Self-healing and the dirty bit#

Modern NTFS (Windows 8 and later) embeds a background self-healing service that quietly repairs minor inconsistencies without dismounting the volume. When it cannot repair something automatically — typically a corrupt index entry or a flipped bit in a system file — it flags the volume dirty. The classic offline chkdsk /F is now reserved for those exceptional cases.

rem Inspect the dirty bit (set by NTFS or by 'fsutil dirty set')
fsutil dirty query C:

Output:

Volume - C: is NOT Dirty

rem When the bit is set, autochk runs chkdsk before Windows boots.
rem Suppress the prompt for D: only:
chkntfs /X D:

Output:

(no output — exits 0)

rem Re-enable scheduled check for D:
chkntfs /D

Output:

The AUTOCHK behavior is now reset to the default.
All non-system drives will be checked at boot time.

The companion chkntfs.exe does not run chkdsk itself — it manages the AutoChk delay (/T:N), the exclusion list (/X drive), and the boot-time dirty check.

Repair-Volume — the PowerShell equivalent#

Repair-Volume is the modern PowerShell cmdlet that wraps the same NTFS scan-and-repair engine. It is preferable in scripts: it returns objects, accepts pipeline input, and avoids the localization issues that bite chkdsk output parsing. It ships in the Storage module (built into Windows 8 / Server 2012 and later).

# Online scan — equivalent to chkdsk C: /scan
Repair-Volume -DriveLetter C -Scan

Output:

NoErrorsFound

# Apply a spot fix found by a previous scan — equivalent to chkdsk /spotfix
Repair-Volume -DriveLetter C -SpotFix

Output:

NoErrorsFound

# Full offline scan-and-fix — equivalent to chkdsk D: /F /R
Repair-Volume -DriveLetter D -OfflineScanAndFix

Output:

NoErrorsFound

# Get-Volume integrates with Repair-Volume via the pipeline
Get-Volume | Where-Object FileSystemType -eq 'NTFS' | Repair-Volume -Scan

Output:

NoErrorsFound
NoErrorsFound
NoErrorsFound

Repair-Volume returns one of NoErrorsFound, Corruption-FoundButNotFixed, or Corruption-Repaired. Map these for scripts:

$result = Repair-Volume -DriveLetter D -Scan
switch ($result) {
    'NoErrorsFound'             { 'OK'        }
    'Corruption-Repaired'       { 'Repaired'  }
    'Corruption-FoundButNotFixed' { 'NeedsReboot' }
}

Output:

OK

ReFS-specific behaviour#

ReFS (Resilient File System) does not need a chkdsk in the classical sense — integrity streams, metadata checksums, and salvage operations are the design substitute. Running chkdsk /F on a ReFS volume invokes a minimal repair path (/scan) but most options are silently no-ops. Repair on ReFS is driven instead by Storage Spaces Direct and the Get-FileIntegrity / Repair-FileIntegrity cmdlets.

rem chkdsk on ReFS does not perform a full NTFS-style scan
chkdsk R: /scan

Output:

The type of the file system is ReFS.
A disk check has been scheduled.
Windows will now check the disk.
ReFS volumes do not need to be checked offline. Skipping volume checks.

# ReFS health verification: lean on integrity streams
Get-FileIntegrity -FileName 'R:\Data\important.bin'

Output:

FileName               Enabled Enforced
--------               ------- --------
R:\Data\important.bin     True     True

Repair-FileIntegrity -FileName 'R:\Data\important.bin'

Output:

(no output — exits 0; integrity stream verified, alternates pulled if mirrored)

For ReFS volumes that are part of a Storage Spaces Direct cluster, Repair-VirtualDisk and Get-StorageJob are the real recovery tools. chkdsk becomes a fallback, not the primary workflow.

How chkdsk interacts with Volume Shadow Copy#

A chkdsk /F on an NTFS volume invalidates Volume Shadow Copy snapshots stored on that volume because the diff areas are not preserved across structural fixes. If snapshots matter (System Restore, VSS-backed backups), prefer /scan /spotfix — spot-fixes are designed to leave shadow copies intact in most cases.

rem List shadow copies for a volume
vssadmin list shadows /for=C:

Output:

Contents of shadow copy set ID: {a1b2c3d4-e5f6-7890-abcd-ef1234567890}
   Contained 1 shadow copies at creation time: 5/20/2026 06:30:12
      Shadow Copy ID: {f0e1d2c3-b4a5-6789-fedc-ba9876543210}
         Original Volume: (C:)\\?\Volume{...}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3
         Originating Machine: MYHOST

rem Run an online scan that keeps shadow copies intact
chkdsk C: /scan
chkdsk C: /spotfix

Output:

The type of the file system is NTFS.
Stage 1: Examining basic file system structure ...
...
Windows has scanned the file system and found no problems.

The volume will be spotfixed the next time the system restarts.

Resizing the NTFS log (/L)#

The NTFS transaction log ($LogFile) records pending metadata changes. On volumes with very high churn (mail servers, dev workstations doing constant compile cycles) the default 64 MB log can spill and force throttling. /L:size resizes it in KB.

rem Read current log size
chkdsk C: /L

Output:

Current size = 65536 KB

rem Grow log to 256 MB (requires dismount; on system volume, scheduled at next boot)
chkdsk D: /L:262144 /X

Output:

Setting size of file system log to 262144 KB.
The file system log was successfully resized.

The minimum is 2 048 KB; the maximum is volume-dependent (typically 4 GB). Resizing the log does not move existing data — it only changes the maximum size used by future transactions.

Pre-boot AutoChk and chkntfs#

When chkdsk /F is scheduled at boot, autochk.exe runs before the Windows kernel hands off to userland. chkntfs controls this process: you can exclude volumes, change the countdown timer, or query which volumes are scheduled.

rem Query which volumes are scheduled for AutoChk
chkntfs C: D: E:

Output:

The type of the file system is NTFS.
C: is not dirty.
D: is dirty.
You may use the /C option to schedule chkdsk for this drive.
E: is not dirty.

rem Exclude E: from boot-time AutoChk (useful for noisy data volumes)
chkntfs /X E:

Output:

(no output — exits 0)

rem Change AutoChk countdown to 5 seconds (default 10)
chkntfs /T:5

Output:

The AUTOCHK initiation countdown time is set to 5 second(s).

rem Force a scheduled chkdsk for D: at next boot
chkntfs /C D:

Output:

This volume will be checked the next time the system restarts.

rem Reset to defaults (no exclusions, default timer, no scheduled volumes)
chkntfs /D

Output:

The AUTOCHK behavior is now reset to the default.
All non-system drives will be checked at boot time.

Reading the boot-time AutoChk log#

When chkdsk runs at boot, the output scrolls past too quickly to read. Windows records the full transcript to the Application event log under source Wininit (event ID 1001) and (since Windows 8) under Microsoft-Windows-Chkdsk/Operational.

rem Pull the latest Chkdsk boot-time log via wevtutil
wevtutil qe Application /q:"*[System[Provider[@Name='Wininit'] and (EventID=1001)]]" /f:text /c:1 /rd:true

Output:

Event[0]:
  Log Name: Application
  Source: Wininit
  Date: 2026-05-23T03:14:08.123
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: MYHOST
  Description:
    Checking file system on D:
    The type of the file system is NTFS.
    ...
    Windows has checked the file system and found no problems.

# Same data via PowerShell — easier to filter
Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Wininit'] and (EventID=1001)]]" -MaxEvents 1 |
    Select-Object -ExpandProperty Message

Output:

Checking file system on D:
The type of the file system is NTFS.
...
Windows has checked the file system and found no problems.

# Modern Chkdsk operational log (Windows 8+)
Get-WinEvent -LogName Microsoft-Windows-Chkdsk/Operational -MaxEvents 5 |
    Select-Object TimeCreated, Id, Message

Output:

TimeCreated         Id Message
-----------         -- -------
5/23/2026 3:14:08 AM 26000 Chkdsk was executed in scan mode on a volume snapshot.
5/23/2026 3:14:09 AM 26214 Self healing successfully completed on volume D:.

Cross-references: where chkdsk fits in the toolchain#

chkdsk is one tool in a stack of disk-integrity utilities. Use these alongside it.

# Physical-disk SMART health — catches failing drives chkdsk can only paper over
Get-PhysicalDisk | Select FriendlyName, MediaType, OperationalStatus, HealthStatus

Output:

FriendlyName             MediaType OperationalStatus HealthStatus
------------             --------- ----------------- ------------
Samsung SSD 990 PRO 2TB  SSD       OK                Healthy
WDC WD40EFRX-68N32N0     HDD       OK                Warning

Common pitfalls#

1. /F on the system drive schedules a reboot-time scan — the scan cannot run while Windows is using the drive; accept the “check at next restart” prompt and reboot.
2. /R takes hours on large drives — a 4 TB scan can take 4–8 hours; never interrupt midway or you risk partial repairs; plan a maintenance window.
3. errorlevel check order matters in batch — check from highest to lowest (if errorlevel 3 ... if errorlevel 2 ... if errorlevel 1) because errorlevel N is true for any code ≥ N.
4. /scan does not fix — it reports — after /scan finds issues, run /spotfix or /F /R to actually repair them.
5. Repeated bad sectors mean hardware failure — if chkdsk /R finds bad sectors repeatedly across runs, the drive is failing; back up data and replace the drive; chkdsk cannot fix a physically degrading disk. On SSDs, repeated full-surface /R scans also slightly accelerate NAND wear because every cell is read and (for bad ones) written; reserve them for triage, not routine maintenance.
6. chkdsk does not test drive performance — use CrystalDiskMark or winsat disk for throughput benchmarking; chkdsk only checks file system integrity and sector readability.
7. /F invalidates Volume Shadow Copies — running /F on a volume with VSS snapshots destroys them; use /scan /spotfix to keep snapshots, or accept the loss and reboot quickly.
8. chkdsk on ReFS is mostly a no-op — ReFS uses online salvage via Storage Spaces; reach for Repair-FileIntegrity and Repair-VirtualDisk instead.
9. Cancelling at the AutoChk prompt does not always honor the cancellation — the 10-second AutoChk countdown can be bypassed only on volumes that are not the system drive; the system drive scan still runs.
10. Encrypted (BitLocker) volumes must be unlocked first — chkdsk on a locked BitLocker volume returns Cannot open volume for direct access; unlock with manage-bde -unlock before scanning.
11. /X kills open handles without warning — applications holding files on the volume crash; never use /X on a server share without notifying users first.
12. Mounted ISOs and virtual drives can show NTFS but fail /F — the underlying file is read-only; mount the host volume read-write or run chkdsk on the host.
13. /I and /C together miss real corruption — they’re advertised as faster, but skipping index-entry checks and cycle detection can leave bad metadata in place; only use during triage, not as a final repair.
14. Output is localized — on a non-English Windows install, parsing chkdsk text with findstr fails; prefer Repair-Volume (returns enum values, locale-independent) for scripting.
15. AutoChk delay can be too short — on a console-attached server you may want chkntfs /T:30 to give time to press a key and cancel; default is 10 seconds.

Real-world recipes#

Automated overnight scan of a data volume#

@echo off
echo Starting chkdsk on D: at %TIME%
chkdsk D: /F /R > C:\Logs\chkdsk_%COMPUTERNAME%_%DATE:~10,4%%DATE:~4,2%%DATE:~7,2%.log
echo Finished at %TIME%. Exit code: %ERRORLEVEL%

Output:

Starting chkdsk on D: at 23:00:02.34
Finished at 01:34:22.08. Exit code: 0

Online health check on the system drive#

chkdsk C: /scan /perf

Output:

Stage 1: Examining basic file system structure ...
Stage 2: Examining file name linkage ...
Stage 3: Examining security descriptors ...
Stage 4: Looking for bad sectors in user file data ...
Windows has scanned the file system and found no problems.

Schedule system drive repair at next boot#

chkdsk C: /F /R

Output:

Chkdsk cannot run because the volume is in use by another process.
Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Y
This volume will be checked the next time the system restarts.

Fleet health sweep via PowerShell#

Run a non-disruptive /scan against every NTFS volume across a list of hosts and roll up the results.

$hosts = Get-Content C:\Ops\hostlist.txt
$report = foreach ($host in $hosts) {
    try {
        Invoke-Command -ComputerName $host -ScriptBlock {
            Get-Volume |
                Where-Object FileSystemType -eq 'NTFS' |
                ForEach-Object {
                    [PSCustomObject]@{
                        Host       = $env:COMPUTERNAME
                        Drive      = $_.DriveLetter
                        Label      = $_.FileSystemLabel
                        SizeGB     = [math]::Round($_.Size / 1GB, 1)
                        FreeGB     = [math]::Round($_.SizeRemaining / 1GB, 1)
                        ScanResult = (Repair-Volume -DriveLetter $_.DriveLetter -Scan)
                    }
                }
        } -ErrorAction Stop
    }
    catch {
        [PSCustomObject]@{ Host = $host; Drive = '?'; ScanResult = "UNREACHABLE: $($_.Exception.Message)" }
    }
}
$report | Format-Table -AutoSize
$report | Export-Csv -Path C:\Ops\chkdsk_sweep.csv -NoTypeInformation

Output:

Host    Drive Label   SizeGB FreeGB ScanResult
----    ----- -----   ------ ------ ----------
MYHOST  C     System   475.0  237.4 NoErrorsFound
MYHOST  D     Data    1862.4  843.2 NoErrorsFound
SRV01   C     System   237.0   84.1 NoErrorsFound
SRV02   C     System   237.0   34.7 Corruption-Repaired

Dirty-bit watchdog#

Detect volumes whose dirty bit has been set unexpectedly and alert before the next reboot triggers a long offline scan.

$alerts = foreach ($v in Get-Volume | Where-Object DriveLetter) {
    $dirty = (cmd /c "fsutil dirty query $($v.DriveLetter):" 2>$null) -match 'is Dirty\s*$'
    if ($dirty) {
        [PSCustomObject]@{
            Drive = "$($v.DriveLetter):"
            Label = $v.FileSystemLabel
            Note  = 'Dirty bit set — chkdsk will run at next reboot'
        }
    }
}
if ($alerts) {
    $alerts | Format-Table -AutoSize
    # Trigger an online scan now to avoid a reboot-time delay
    $alerts | ForEach-Object { Repair-Volume -DriveLetter ($_.Drive.TrimEnd(':')) -Scan }
}

Output:

Drive Label Note
----- ----- ----
D:    Data  Dirty bit set — chkdsk will run at next reboot

NoErrorsFound

Pre-imaging integrity gate#

Block a backup job until the source volume is verifiably clean.

$drive   = 'D'
$result  = Repair-Volume -DriveLetter $drive -Scan
if ($result -ne 'NoErrorsFound') {
    Write-Error "Volume ${drive}: not clean (state: $result). Refusing to image."
    exit 1
}
Write-Host "Volume ${drive}: verified clean. Proceeding with image."
& wbadmin start backup -backupTarget:\\backupserver\fleet -include:${drive}: -quiet

Output:

Volume D: verified clean. Proceeding with image.
wbadmin 1.0 - Backup command-line tool
(c) Microsoft Corporation. Reserves all rights.
Retrieving volume information...
This will back up volume Data (D:) to \\backupserver\fleet.
The backup operation successfully completed.

Long-scan progress monitor#

chkdsk /R provides limited progress output. Use a background job to time-stamp checkpoints to a log.

$logPath = 'C:\Logs\chkdsk_E_{0}.log' -f (Get-Date -Format yyyyMMdd_HHmmss)
Start-Job -Name chkdsk-E -ScriptBlock {
    param($log)
    cmd /c "chkdsk E: /F /R" 2>&1 | ForEach-Object {
        '{0:yyyy-MM-dd HH:mm:ss}  {1}' -f (Get-Date), $_ |
            Tee-Object -FilePath $log -Append
    }
} -ArgumentList $logPath
Receive-Job -Name chkdsk-E -Keep | Select-Object -Last 5

Output:

2026-05-25 23:00:01  The type of the file system is NTFS.
2026-05-25 23:00:02  Stage 1: Examining basic file system structure ...
2026-05-25 23:14:08  Stage 2: Examining file name linkage ...
2026-05-25 23:29:51  Stage 3: Examining security descriptors ...
2026-05-25 23:33:02  Stage 4: Looking for bad sectors in user file data ...

Sources#

Microsoft Learn — chkdsk command — Full parameter reference (/f /v /r /x /i /c /l[:size] /b /scan /forceofflinefix /perf /spotfix /sdcleanup /offlinescanandfix /freeorphanedchains /markclean), exit codes, HDD-vs-SSD behaviour notes, and Event Viewer / PowerShell recipes for retrieving Chkdsk and Wininit log entries.