guide · static export
PC · disk

Run chkdsk Correctly and Read What It Finds

The online scan tells you whether the filesystem is dirty without a reboot, the offline fix repairs it, and the exit code tells you whether the disk is failing or just messy.

by@guidox updated:10/31/26 time:30 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11, Windows Server 2019 tools:Command Prompt as administrator
TL;DR

Start with **chkdsk C: /scan**, which runs online. Only if it reports problems do **chkdsk C: /spotfix** or a full **/f** at reboot. An exit code of **4 or 5** means damaged metadata, not a slow disk.

Before you start

Requirements

  • Admin rights
  • A backup of anything irreplaceable
  • 30 minutes
Step by step

Instructions

01

Scan online, without a reboot

**/scan** checks the volume while Windows is running and does not lock it. This is the correct first move on a machine you cannot take down.

chkdsk C: /scan
chkdsk C: /scan /perf
02

Read the result in the event log

The scan writes its report to the Application log, not to the console. That entry survives the window closing and gives you the numbers later.

Get-WinEvent -LogName Application | Where-Object ProviderName -match 'Chkdsk|Wininit' |
  Select-Object -First 3 TimeCreated,ProviderName,Message
03

Fix only what is broken

**/spotfix** takes the volume offline for seconds instead of running a full pass. It is the right tool for a dirty bit and a handful of index entries.

chkdsk C: /spotfix
tipA short offline window still needs every app closed and a plan for laptops that might sleep. Plug in the power supply first.
04

Use /f or /r deliberately

**/f** fixes errors and needs an exclusive lock, so it runs at the next boot. **/r** adds a sector scan and can take hours — on an SSD that time is better spent reading SMART data.

chkdsk C: /f
chkdsk D: /r
⚠ warningNever interrupt a running /r pass. A half-repaired filesystem costs more than the errors it was fixing.
05

Know the exit codes

0 no errors, 1 errors fixed, 2 cleanup performed, 3 not checked, 4 or 5 damaged and unrepaired. Only the last two mean the volume needs attention beyond chkdsk.

chkdsk C: /scan
$LASTEXITCODE
chkntfs C:
06

Decide between repair and replacement

Recurring corruption with a clean cable and a healthy controller is the drive telling you something. Read the reliability counters before you trust it with data again.

Get-PhysicalDisk | Select-Object FriendlyName,HealthStatus
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId,Wear,ReadErrorsTotal,WriteErrorsTotal
⚠ warningBack up before a long /r pass, not after. If chkdsk finds bad sectors the data on them is already gone.
Troubleshooting

Common issues

chkdsk runs at every boot

The dirty bit is still set or a scheduled check is pending. Clear it with chkdsk C: /f once, and check the schedule with chkntfs /query C:.

The volume cannot be locked

An open handle from a backup tool or antivirus blocks it. Close them, or accept the offer to schedule the check at the next restart.

The event log has no chkdsk entry

Look under the Wininit provider and widen the filter. On some builds the report lands in the System log instead.

chkdsk reports errors right after a repair

Hardware is the likely cause: cable, controller or the drive itself. Run the SMART check and test the drive in another port.

FAQ

Frequently asked

Does chkdsk repair bad sectors?

It marks them unusable and recovers readable data around them. It cannot restore the content that was on them.

Is chkdsk safe on an SSD?

The scan is. A full /r pass writes nothing extra but takes hours for little gain; check the drive's own counters instead.

How to undo this

chkdsk changes are repairs, not settings. There is nothing to undo; if you scheduled a check and want to skip it, run chkntfs /x C: before the reboot.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress