Chkdsk (Check Disk), ChkNTFS, and Autochk (Auto

Check)
*** and the infamous but mysterious, "dirty bit"
see also: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/enus/chkdsk.mspx?mfr=true
Microsoft Description of autochk, chkdsk, and chkntfs or the Microsoft ChkNTFS
Article
YOU MUST BE USING THE ADMINISTRATOR USER ACCOUNT OR HAVE
ADMINISTRATOR PRIVILEGES TO RUN CHKDSK !!
Chkdsk checks the integrity of your hard drive. The same as with Win98, if you run Chkdsk
from the command line (START/run . . . chkdsk). Chkdsk corrects disk errors only if you specify
the /f switch.
Chkdsk is not the same as Scandisk, although functionally they do the same thing !!! Scandisk
runs within WinXp - while Chkdsk runs in a DOS box, or it can run from the recovery Console.

Chkdsk vs Scandisk
For those of you who can still remember "scandisk" - Windows XP doesn't have ScanDisk !!
However, it does have CHKDSK, which is similar. Unfortunately, the interface of Chkdsk is
very limited - you only see a progress bar and not what is going on until the end, where you
receive a limited report with the Command Prompt Chkdsk - and no report with the Windowsbased Chkdsk..

Chkdsk vs Autochk

Chkdsk runs in Windows as a small box or in a DOS box within Windows, or in the
Recovery console

Autochk runs in the blue boot screen and does the same thing that chkdsk does.

Autochk does essentially the same thing as Chkdsk but will only run during bootup (but during
bootup it will only run if the system detects a cold boot or power off).
NOTE: the boot partition will always be locked.

you can run Chkdsk to simply "check" the partition

you cannot run Chkdsk "directly" with "fix errors" enabled. However, if you try to run it
with "fix errors" on the boot partition, the system will give you the option to run Chkdsk
upon the next reboot and then it will run and fix any errors. You can run Chkdsk with
"fix errors" enabled for any non-bootable partition and it will run without having to
reboot !!

Controlling Autochk using the ChkNTFS command

Forcing Autochk to run and check a Drive upon Reboot
chkntfs /c drive:
Example - suppose you want to check your E drive. You run the following command and then
reboot:
chkntfs /c e:

BootExecute registry entry before chkntfs command:

*

autocheck autochk

BootExecute registry entry after chkntfs command:

/m \??\E: autocheck autochk *

autocheck autochk

(more details on the "BootExecute" registry entry are listed below)

Stopping Autochk from running upon Reboot on a Drive
chkntfs /x drive:
Example - suppose you do not want chkdsk to run on your e drive when you reboot
chkntfs /x e:

BootExecute registry entry before chkntfs command:

autocheck autochk *

BootExecute registry entry after chkntfs command:

autocheck autochk /k:E *

The Dirty bit vs the Registy "Autochk" entry

When you freeze up and have to do a hard reset (cold reboot) - WinXP flags the all hard drives
with open files as dirty. The "Dirty Bit" is set by the file system itself only if it detects a
problem.

If the administrator schedules the command to run the next time the system restarts, Chkdsk does
not set the "Dirty Bit" on an in-use volume in order to check the volume at the next boot. Instead,
it sets a registry entry to tell Autochk to run against that volume:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\BootExecute with value = autocheck autochk *
Additional entries that can be found in BootExecute are:
"BootExecute"
Registry value
/P \??\Volume:

Function
Schedules an unconditional Chkdsk against the volume.

/
Schedules an unconditional Chkdsk against a volume mount point.
p \??\VOLUME{GUID}
/k:Volume *

Excludes Chkdsk from running against the volume.

/m \??\Volume:

Tells Autochk to look only at the dirty bit on the volume, and if set,
run Chkdsk.

Sample command

Resulting registry entry

Chkdsk C: /F

Autocheck autochk /p \??\C:

Chkdsk C:\mountpoint /F

Autocheck autochk /p \??\VOLUME{GUID}

Chkntfs D: E: /X

Autocheck autochk /k:D /k:E *

Chkntfs G: /C

Autocheck autochk /m \??\G:

Chkdsk within Windows:

NOTE: Scandisk is not the same as Chkdsk, although functionally they do the same thing !!!
Chkdsk on your system drive (the drive with Windows on it) will only run during bootup, and
will only run if the system detects a cold boot or power off. However, you can run chkdsk and
even repair the other drives on your system, by dismounting the drive.
Chkdsk /X: A new command parameter that runs Chkdsk /F and forces a volume dismount to
close open file handles on non-system volumes so it can be checked immediately. This eliminates
the need of a potential reboot in order to perform the Chkdsk and repair the volume.
Running chkdsk on any non-system Drive and Fix Errors
Method 1:

1. close all running programs

2. start a DOS box (Start/Run . . . cmd)
3. chkdsk /x n: -where n is the letter of the drive you wish to run chkdsk on (n
cannot be your system drive). This will dismount the drive and then run chkdsk
Method 2:
1. close all running programs
2. double-click My Computer
3. right-click on the drive you want to run scandisk on
4. click the Tools tab and click "Check Now" next to "Error Checking"
5. to fix errors, check the "Automatically fix file system errors" box - and
to run a surface scan, check the "Scan for and attempt recovery of bad sectors"
box
Running Chkdsk on Your System Drive
1. close all running programs
2. double-click My Computer
3. right-click on the drive you want to run scandisk on
4. click the Tools tab and click "Check Now" next to "Error Checking"
5. to fix errors, check the "Automatically fix file system errors" box - and
to run a surface scan, check the "Scan for and attempt recovery of bad sectors"
box
6. reboot and Chkdsk will run during the boot process before Windows starts
The ChkNTFS Command
You would think that this only works on NTFS drives - but it works on ALL drives. Displays or
specifies whether automatic system checking is scheduled to be run on a FAT, FAT32, or NTFS
volume when the computer is started.

Syntax
chkntfs volume: [...]

chkntfs [/d]
chkntfs [/t[:time]]
chkntfs [/x volume: [...]]
chkntfs [/c volume: [...]]

Parameters
volume: [...]
Required. Specifies the drive letter (followed by a colon), mount point, or volume
name. Displays a message that identifies the file system of the specified volume.
If automatic file checking is scheduled to be run, this parameter displays a
message indicating whether the volume has been corrupted, which requires you to
run chkdsk.
/d
Restores all chkntfs default settings, except the countdown time for automatic file
checking. Default behavior is to check all volumes when the computer is started.
/t[:time]
Changes the Autochk.exe initiation countdown time to the specified amount of
time entered in seconds. If you do not specify :time, /t displays the current
countdown time.
/x volume: [...]
Excludes the specified volume from being checked when the computer starts,
even if the volume is marked as requiring chkdsk.
/c volume: [...]
Schedules the specified volume to be checked when the computer starts.
/?
Displays help at the command prompt.

Remarks

To run chkntfs, you must be a member of the Administrators group.

Although you can set the Autochk.exe initiation countdown time to zero, you
cannot cancel a potentially time-consuming automatic file check if you set it to
zero.

Examples
To display the Autochk.exe initiation countdown time, type:
chkntfs /t

When changing the Autochk.exe initiation countdown time, type the time in seconds. For
example, to change the countdown time to 30 seconds, type:
chkntfs /t:30
The /x command-line option is not accumulative. If you type it more than once, the most recent
entry overrides the previous entry. To exclude multiple volumes, list them all in one command.
For example, to exclude both the E: and F: volumes, type:
chkntfs /x e: f:
To exclude the F: volume only, type:
chkntfs /x e:
chkntfs /x f:
The /c command-line option is accumulative. If you want to check the specified volume only,
reset the defaults to clear any previous commands, exclude all volumes from being checked, and
then schedule automatic file checking on the desired volume.
For example, to schedule automatic file checking on the D: volume only, type:
chkntfs /d
chkntfs /x c: d: e:
chkntfs /c d:

The mysterious "Dirty Bit"

No one knows where the dirty bit is located, and Microsoft won't say !! Using chkntfs to force
autochk to run upon reboot merely sets an entry in the registry - it does NOT set the dirty bit.
The command, FSUTIL (see
https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/enus/fsutil.mspx?mfr=true) will allow you to do two things to any NTFS drive (it will not work on
FAT32 drives !!):

query the dirty bit - see if it is set or not - Example:

Start/Run . . . cmd
fsutil dirty query c: )

set the dirty bit - Example: Start/Run . . . cmd

fsutil dirty set c:

NOTE: fsutil will NOT reset the dirty bit - the only one way to do this is to either run chkdsk
within Windows, or let Autochk run upon reboot
Diskeeper will NOT run with the dirty bit set !! You will get the following message:

What if the Dirty Bit won't go away ??

More than a few people have encountered this:
1. a drive partition has the dirty bit set
2. so when they reboot, Windows insists on running Autochk to check a drive - it checks the
drive and all is well. Just running that check is supposed to clear the dirty bit
3. but the next time they reboot, again Windows checks the drive !! Again, all is well and
the drive reports no errors
4. they get into Windows and run "fsutil dirty query driver_letter:" and they are told that the
dirty bit is set
5. they try booting with a WinXP CD and go into "Repair" mode to run chkdsk /r (supposed
to do a thorough check and also check the surface) - but it does not help
6. and so on . . . and so on . . .
There is no apparent way for them to clear the dirty bit. Microsoft has never released the
location of the dirty bit, so they are stuck. Here is the only way to fix the problem:

Method 1) if the drive in question is not your boot drive goto Start/Run . . . msconfig, click the
"Starup" tab, and uncheck all items. Then reboot, hit CTRL-Alt-Delete to get into Windows
Task Manager, and shut down as many tasks as possible. The point here is to free up your drive.
Then Start/Run . . . cmd
chkdsk /x /f drive:
If it completes successfully this will usually remove the dirty bit. To check it, enter the following
command:
fsutil dirty query drive:
reboot to test
Method 2) run Kelly's reg edits to first Disable autochk from running upon reboot, then reboot,
and run this reg file to or re-enable disk checking upon reboot - this will refresh the entries in
your registry to make sure thewy are correct
Method 2) run Partition Magic - try resizing the C: partition a little smaller, create another
partition
from the unallocated space, then delete this partition and reclaim the space
back into C:
Method 3) if all else fails - this WILL WORK !! move all the files off the drive, reformat the
drive, and then move the files back

Autochk bootup routine and the "dirty bit" (also called the
"chkdsk flag")
When the system is shut down improperly or stops responding, Autochk runs against any
volumes that are marked as being "dirty". At least, I know this is done with NTFS, and I think it
is also done with FAT32 since my drives are FAT32 and the system does run Autochk whenever I
run into problems and have to do a cold boot. Autochk will not initiate a check of any partitions
if none of them are flagged !! Autochk is set to run during bootup because of the registry entry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager . . .
BootExecute
The BootExecute entry tells Windows what to run upon bootup. By default, its value is
"autocheck autochk *" - this tells Windows to run Autochk on any drive whose dirty bit is set
You can cancel Autochk within the first few seconds by hitting an key. However, each time you
stop chkdsk, the system "remembers" that it still needs to run Autochk due to the flagged
partition and will try to run it the next time you reboot. This continues forever, each time you
reboot, until you allow Autochk to run and to complete.

Stopping Autochk
It is a pain that even when you suspect your drives are fine - you still must allow Autochk to
continue, since even if you hit a key to skip it, it will continue to try to run upon every reboot
until you actually allow it to run. As we mentioned before - there are workarounds:

Run chkntfs with the /x option - this is the best workaround. You can exclude the drive
from being checked by using the chkntfs /x command (although it does not reset the dirty
bit). You can use this for one or more drives, as follows:
1. Start/run . . . cmd
2. chkntfs /x n: m: etc.
-where n, m, etc are the letters of the drive/s you want to
exclude from being checked upon reboot

run chkdsk /f within Windows to reset the dirty bit - but this is even more hassle than
letting Autochk run and only works on non-system drives

Chkdsk Command-Line Options

- they differ depending on whether you are at a command prompt (in a DOS box in Windows),
or in the Recover Console !!

Chkdsk from the Command Prompt

Syntax
chkdsk [volume:][[Path] FileName] [/f] [/v] [/r] [/x] [/i] [/c] [/l[:size]]
Parameters
volume: Specifies the drive letter (followed by a colon), mount point, or volume name.
[Path] FileName Specifies the location and name of a file or set of files that you want chkdsk to
check for fragmentation. You can use wildcard characters (that is, * and ?) to specify multiple
files.
/f Fixes errors on the disk. The disk must be locked. If chkdsk cannot lock the drive, a message
appears that asks you if you want to check the drive the next time you restart the computer.
/v

Displays the name of each file in every directory as the disk is checked.

/r

Locates bad sectors and recovers readable information. The disk must be locked.

/x Use with NTFS only. Forces the volume to dismount first, if necessary. All open handles to
the drive are invalidated. /x also includes the functionality of /f.

/i Use with NTFS only. Performs a less vigorous check of index entries, reducing the amount
of time needed to run chkdsk.
/c Use with NTFS only. Skips the checking of cycles within the folder structure, reducing the
amount of time needed to run chkdsk.
/l[:size] Use with NTFS only. Changes the log file size to the size you type. If you omit the
size parameter, /l displays the current size.
/?

Displays help at the command prompt.

Chkdsk from the Recovery Console

chkdsk [drive:] [/p] [/r]
- Used without parameters, chkdsk displays the status of the disk in the current drive.
- to "fix" the drive, you MUST use the /r option !!! The /p option does not make changes !!
drive:

Specifies the drive that you want chkdsk to check.

/p Performs an exhaustive check even if the drive is not marked for chkdsk to run. This
parameter does not make any changes to the drive.
/r

Locates bad sectors and recovers readable information. Implies /p.

The chkdsk command requires the file Autochk.exe. If it cannot find it in the startup directory (\
%systemroot%\System32, by default), it will attempt to locate it on the Windows Installation
CD. If you have a multiboot computer, be sure you are issuing this command from the drive
containing Windows.