Chkdsk Best Practices

Power failures and system crashes do happen and can corrupt both active and idle files and turn your system to an inconsistent state. Although, Windows 7 NTFS can roll back the uncommitted transactions and returns the file system to a consistent state, you might still need to scan the entire file system for errors.

Windows 7 provides an inbuilt file system check utility called Chkdsk that checks the file system and fixes any problems it discovers. Chkdsk can be run from the command prompt, from windows Explorer or during a system boot up as part of the Autochk process.  It is worth noting that NTFS will first attempt to fix corruptions online using a mechanism called self-healing and if it fails it marks the volume as dirty. Therefore, this mark indicates that the volume is inconsistent. If a volume is marked as dirty and a reboot takes place then Autochk is invoked automatically by the system.

Microsoft recommends running Fsutil before invoking Chkdsk as to query the dirty bit as shown below:

Fsutil dirty query <volume pathname>  ex: C:\>fsutil dirty query C:

Chkdsk execution time depends on the number of files and disk size (with /R and /B) while more RAM helps improve execution time as the process caches file metadata to reduce the disk seek times.  You can run Chkdsk by right clicking on any of the volumes. Double click the Computer icon on your desktop, select the desired disk, right click and select Properties, then click Tools and hit the Check now button.

The options available are to Automatically fix file system errors which corresponds to the command-line option Chkdsk /f and Scan for and attempt recovery of bad sectors which corresponds to Chkdsk /r. The option /r that is, the scan for and attempt to repair bad sectors will significantly increase the execution time. Actually, some of the options available to the command-line tool will also increase the execution time. Note, that most modern hard drives automatically replace bad sectors and have advanced failure reporting mechanisms which makes the /R and /B options redundant in most cases. However, as a last attempt to recover a failing disk these options might help! For a full a list of options and their respective explanation type Chkdsk /? from the command prompt.

Chkdsk can run in 3 different modes which are Read-only, Fix-mode and Bad cluster recovery mode. In read-only mode, Chkdsk does not make any changes to the volume, and the volume is still available to other applications. It normally creates a snapshot of the volume and runs a scan against it, however, if it fails to create a snapshot it runs against the original volume. In this instance it may report false positives! Running Chkdsk without any options such as, Chkdsk c: is in read-only mode and execution time depends mainly on the number of files and not on the volume size. In Fix-mode, Chkdsk locks the volume to prevent other applications from accessing it and this is normally invoked by adding the /F or /X options to the Chkdsk command. Execution in this mode is also dependent on the number of files and not on the volume size. In Bad cluster recovery mode Chkdsk performs the same actions as in fix mode above, but it also runs two additional phases. Chkdsk scans every cluster on the volume and in this mode execution time depends on the number of files and volume size.

The stages or phases that appear when you run Chkdsk belong to the following checks:

  • Stage 1: Checking files – Chkdsk examine the volume’s master file table (MFT) and checks for consistency.
  • Stage 2: Checking indexes (directories) – Chkdsk checks each directory for consistency. It also verifies that the files represented in the directory match the files described in the MFT. In addition, it verifies that there are no cycles in the directory tree.
  • Stage 3: Checking Security Descriptors – Chkdsk checks the NTFS security descriptor stream and related data structures, verifies the security descriptor for each file, and cleans-up unused security descriptors. This phase is run only if the Chkdsk/f option is specified.
  • Stage 4: Verify File Data (only run when /R or /B is specified) – Chkdsk reads the data of every file to see if there are any bad clusters in the file data. Any file with bad clusters is repaired and all bad clusters are added to the NTFS bad cluster list.
  • Stage 5: Verify Free Space (only run when /R or /B is specified) – Chkdsk verifies every free cluster on the volume to see if there are any bad clusters. All bad clusters are added to the NTFS bad cluster list.

Finally, the recommended parameters for Chkdsk are summarized below:

Chkdsk /R can take a significant amount of time to run, and therefore, is only recommended when there is doubt that the disk is failing and this type of scan is needed.

Chkdsk /I /C can fix several file system related errors and can finish quickly.