Short answer: chkdsk C: /f, run in a Command Prompt or PowerShell window opened as Administrator, checks the file system on drive C: and repairs what it finds. chkdsk C: /r does the same and also reads every sector to find bad ones. Without a switch chkdsk only reports. Windows cannot lock its own system drive, so a repair of C: offers to run at the next restart: answer Y and reboot.
chkdsk C: # read-only check: reports, changes nothing
chkdsk C: /scan # online scan (NTFS): the volume stays in use
chkdsk C: /f # repair the file system; on C: it runs at the next restart
chkdsk D: /r # /f plus a read of every sector, for a suspect diskThe switches below follow Microsoft’s chkdsk reference and work the same on Windows Server 2016 and later and on Windows 10 and 11. After the cheat sheet: the restart on the system drive, how to read the report, the online repair that avoids most downtime, and where chkdsk ends and sfc and DISM begin.
chkdsk commands: every switch at a glance
| Command | What it does |
|---|---|
chkdsk C: | Read-only check. Reports problems, fixes nothing |
chkdsk C: /f | Fixes file system errors. Has to lock the volume, so on C: it runs at the next restart |
chkdsk C: /r | Everything /f does, plus it locates bad sectors and recovers readable data from them |
chkdsk D: /x | Dismounts the volume first and invalidates every open handle to it; includes /f |
chkdsk D: /b | Clears the list of bad clusters and rescans every cluster; includes /r. For a volume imaged onto a new disk (NTFS only) |
chkdsk C: /scan | Online scan while the volume stays in use; what cannot be fixed online is queued (NTFS only) |
chkdsk C: /scan /forceofflinefix | Scans online but queues every defect for offline repair instead of fixing it (NTFS only) |
chkdsk C: /scan /perf | Scans faster with more system resources, slowing everything else on the server (NTFS only) |
chkdsk C: /spotfix | Fixes only the defects a scan queued; the volume goes offline briefly (NTFS only) |
chkdsk C: /offlinescanandfix | Takes the volume offline for a full scan and fix |
chkdsk C: /sdcleanup | Garbage-collects unneeded security descriptor data; implies /f (NTFS only) |
chkdsk C: /f /i /c | Skips part of the index check (/i) and the folder cycle check (/c) to save time (NTFS only) |
chkdsk C: /v | Lists every file as it is checked |
chkdsk C: /l | Shows the size of the NTFS log file; /l:SIZE changes it |
chkdsk E: /f /freeorphanedchains | Frees orphaned cluster chains instead of recovering their contents (FAT, FAT32, exFAT) |
chkdsk E: /markclean | Marks the volume clean if no corruption was found, even without /f (FAT, FAT32, exFAT) |
chkdsk /f /r /x is the combination you see copied everywhere, and it is redundant: Microsoft’s reference says that /r and /x each include /f, so chkdsk C: /r does the same job. /x only matters on a data volume that programs hold open. It dismounts the volume and cuts their handles, which a database or a file share will not take well, so stop those services first.
How to run chkdsk (and “Access Denied”)
chkdsk needs Administrator rights; Microsoft names membership in the local Administrators group as the minimum. In a normal prompt it stops at once:
Access Denied as you do not have sufficient privileges or
the disk may be locked by another process.
You have to invoke this utility running in elevated mode
and make sure the disk is unlocked.Right-click the Start button and choose Terminal (Admin) or Windows PowerShell (Admin), depending on the version, and confirm the prompt. chkdsk is an ordinary program, so the same command works in cmd and PowerShell. If you are logged in over Remote Desktop as the built-in Administrator account, as on most Windows VPS plans, every window already runs elevated.
Repairing C: with a check at the next restart
Windows always has files open on its system drive, so /f, /r or /x cannot lock C: and chkdsk offers to run before Windows starts instead:
The type of the file system is NTFS.
Cannot lock current drive.
Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N) Y
This volume will be checked the next time the system restarts.Answering Y only schedules the check. Confirm that it is queued, then restart when it suits you:
chkntfs C: # reports that C: is scheduled to be checked
shutdown /r /t 0 # restart nowThe check runs before Windows loads, and current versions show it as Scanning and repairing drive (C:) with a percentage. Microsoft notes that chkdsk restarts the computer by itself after checking a boot partition, so expect two restarts in a row. If the screen offers to skip the check with a key press, leave the keyboard alone; chkntfs /t shows how many seconds that countdown lasts. Remote Desktop is unavailable for the whole time and only answers again once Windows is back at the login screen.
Cancel a scheduled check
chkntfs /x C: # skip C: at the next start
chkntfs /d # later: restore the default boot-time checking
fsutil dirty query C: # has Windows itself flagged the volume?Per Microsoft’s chkntfs reference, /x excludes a volume even when it is marked as needing chkdsk, and it stays in force until chkntfs /d. Forget the second line and Windows never checks C: at boot again, not even after a crash. fsutil dirty query answers Volume - C: is NOT Dirty on a volume Windows has not flagged; a dirty volume is checked at the next start whether you scheduled it or not.
How to read chkdsk output
A read-only run on a healthy NTFS volume looks like this. The stage names and summary lines are the ones current Windows versions print; the counts depend on the volume, and the per-phase timing lines are left out:
The type of the file system is NTFS.
Volume label is Windows.
WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.
Stage 1: Examining basic file system structure ...
262400 file records processed.
File verification completed.
Stage 2: Examining file name linkage ...
340802 index entries processed.
Index verification completed.
Stage 3: Examining security descriptors ...
Security descriptor verification completed.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Windows has scanned the file system and found no problems.
No further action is required.
125194239 KB total disk space.
33057920 KB in 166123 files.
110356 KB in 39203 indexes.
0 KB in bad sectors.
389911 KB in use by the system.
65536 KB occupied by the log file.
91570516 KB available on disk.
4096 bytes in each allocation unit.
31298559 total allocation units on disk.
22892629 allocation units available on disk.- Stage 1 checks the file records in the Master File Table, one per file and folder.
- Stage 2 checks the folder indexes that link names to those records; files that lost their folder are reconnected here.
- Stage 3 checks the security descriptors (the permissions), then the USN change journal.
- Stages 4 and 5 appear only with
/ror/b: they look for bad clusters in file data and in free space, read every sector and take most of the time. - The verdict:
found no problems; after a repair,Windows has made corrections to the file system.; in read-only mode with errors,Windows found problems with the file system.and a request to run chkdsk with/F. KB in bad sectorsshould be 0. On a physical disk, anything else means the drive has given up on sectors: back up first, before you go further.
Microsoft warns that a read-only run on a volume in use can report spurious errors, because chkdsk cannot lock it. A read-only check of C: that lists problems is a reason to run chkdsk C: /scan, not proof of corruption.
Exit codes for scripts
| Exit code | Meaning |
|---|---|
| 0 | No errors were found |
| 1 | Errors were found and fixed |
| 2 | Disk cleanup (such as garbage collection) was performed, or was not performed because /f was not given |
| 3 | The disk could not be checked, errors could not be fixed, or they were not fixed because /f was not given |
chkdsk D: /scan
echo %ERRORLEVEL% # in cmd
$LASTEXITCODE # in PowerShellFind the report of a boot-time check
The check at boot scrolls past before anyone reads it, but Windows saves the report in the Application event log, under the source Wininit for the boot-time run and Chkdsk for a run inside Windows. In Event Viewer (eventvwr.msc), filter Windows Logs → Application by those two sources, or ask PowerShell for the newest one:
Get-WinEvent -FilterHashtable @{LogName="Application"} |
Where-Object { $_.ProviderName -match "wininit|chkdsk" } |
Select-Object -First 1 | Format-List TimeCreated, ProviderName, MessageGet-WinEvent returns the newest event first. Append | Out-File C:\chkdsk.txt to keep the report.
How long does chkdsk take?
What sets the time depends on the switch:
/f,/scanand/spotfixwork through the file system’s metadata, so their time grows mostly with the number of files, not with the capacity of the disk. Microsoft warns that/fcan take a long time on a disk with millions of files. A server’s system volume with a few hundred thousand files is usually done in minutes./rand/bread every sector, used or free, so they scale with the capacity and the speed of the disk. For large hard disks Microsoft’s reference calls runs of many hours not uncommon; an SSD or NVMe drive reads the same capacity far faster./spotfixneeds the shortest offline window, because it fixes only what an earlier scan recorded.
Progress is uneven, and stages 4 and 5 can sit on one percentage for a long time over a bad stretch of disk. Microsoft does not recommend interrupting chkdsk, but says that cancelling it should not leave the volume more corrupt than before, and that another run repairs what is left. A check that used to be quick and now crawls is a hint that the disk is failing, not that chkdsk is slow.
Online repair: /scan, /spotfix and Repair-Volume
Since Windows 8 and Windows Server 2012, NTFS can be checked while it is in use. /scan checks the volume online and fixes what it can on the spot. What needs the volume offline is recorded in the $corrupt system file, and /spotfix then repairs only those entries, so the offline part is short instead of a full check. On C:, /spotfix still waits for a restart.
chkdsk C: /scan # online; the server keeps running
chkdsk C: /spotfix # only if the scan queued repairs; on C: answer Y and restartThat is the order for a production server: scan while it is in service, and plan a restart only if the scan says it needs one.
The same in PowerShell: Repair-Volume
Repair-Volume from the Storage module runs the same repairs. According to Microsoft’s Repair-Volume reference, -Scan is chkdsk /scan, -SpotFix is chkdsk /spotfix and -OfflineScanAndFix is chkdsk /f.
Get-Volume -DriveLetter C | Format-List HealthStatus, OperationalStatus
Repair-Volume -DriveLetter C -Scan
Repair-Volume -DriveLetter D -SpotFix
Repair-Volume -DriveLetter D -OfflineScanAndFixA clean volume answers NoErrorsFound. Repair-Volume also takes -FileSystemLabel for a volume without a letter, such as System Reserved, -CimSession to work on another server, and -AsJob to run a long repair in the background. For scripts and remote checks that beats parsing chkdsk’s text.
chkdsk vs sfc vs DISM
The three are often pasted together as if they did the same thing. They look at different layers:
| Tool | Checks | Repairs from | Use it when |
|---|---|---|---|
chkdsk | The file system: file records, folders, permissions; with /r the sectors underneath | The file system's own structures; nothing is downloaded | Files or folders vanish, Windows reports a corrupt volume, a check ran after a crash |
DISM /RestoreHealth | The component store (WinSxS), the copy of Windows that sfc repairs from | Windows Update, or a source you name | sfc cannot fix some files, or updates keep failing |
sfc /scannow | Protected Windows system files | The component store | System tools crash or Windows features misbehave after a bad update |
Run chkdsk first: sfc and DISM read Windows’ files through the file system, and a damaged one feeds them bad data. Then DISM, then sfc:
chkdsk C: /scan
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannowsfc ends with one of four lines: Windows Resource Protection did not find any integrity violations., that it found corrupt files and successfully repaired them, that it found corrupt files but was unable to fix some of them, or that it could not perform the requested operation. The details are in C:\Windows\Logs\CBS\CBS.log. On a server without access to Windows Update, DISM fails with 0x800f081f (the source files could not be found). Mount the installation ISO of the same Windows version and point DISM at it:
(Mount-DiskImage -ImagePath C:\iso\server.iso -PassThru | Get-Volume).DriveLetter # here D
DISM /Get-WimInfo /WimFile:D:\sources\install.wim # find the index of your edition
DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:2 /LimitAccessCommon chkdsk errors and what to do
| Message | Meaning | Fix |
|---|---|---|
Access Denied as you do not have sufficient privileges | The prompt is not elevated, or another program has the disk locked | Open an elevated prompt. How to run chkdsk |
Chkdsk cannot run because the volume is in use by another process. | /f, /r or /x on a volume with open files | On C:, answer Y and restart. On a data volume, stop the services using it or add /x. The restart check |
Cannot open volume for direct access. | Another program holds the volume exclusively, often backup, antivirus or encryption software, or the disk is failing | Pause that software and try again, or schedule the check at boot; if it persists, check the disk's health |
The type of the file system is RAW. CHKDSK is not available for RAW drives. | Windows finds no file system it knows: a damaged boot sector or partition table, or a volume that was never formatted | chkdsk cannot help. Do not format if you need the data; restore from a backup or work on a copy of the disk with recovery tools |
Windows found problems with the file system. | A read-only run found errors, or the volume was in use | Run /scan, then /spotfix or /f. Online repair |
| A check runs at every boot | Something marks the volume dirty again and again | Check fsutil dirty query, then look for disk and NTFS errors in the System log (below) |
For the last row, list the recent storage events. Errors from the source disk such as event 7 (a bad block), 51 (an error during a paging operation) or 153 (an I/O operation was retried) point at the hardware, not at chkdsk:
Get-WinEvent -LogName System -MaxEvents 5000 |
Where-Object { $_.ProviderName -match "disk|ntfs" } |
Select-Object -First 20 TimeCreated, Id, ProviderName, MessageBack up first if the disk itself may be failing
Get-PhysicalDisk | Format-Table FriendlyName, MediaType, HealthStatus, OperationalStatus
Get-PhysicalDisk | Get-StorageReliabilityCounter |
Format-List DeviceId, ReadErrorsUncorrected, Temperature, Wear, PowerOnHours
robocopy D:\data E:\rescue /E /R:1 /W:1 /LOG:C:\rescue.logA HealthStatus other than Healthy, or a growing ReadErrorsUncorrected, means replace the disk rather than repair it. robocopy retries a failed file a million times by default; /R:1 /W:1 makes it try once and move on, so the copy gets around the bad spots. Once the data sits on a new disk, Microsoft recommends chkdsk /b after imaging a volume onto it, to clear the bad cluster list it inherited. In a virtual machine the reliability counters usually stay empty, because the guest sees a virtual disk, not the drives underneath.
chkdsk on a Windows VPS
Three things are different on a virtual server.
- Remote Desktop is gone during the boot check. On a VMHeaven Windows VPS, the VNC console in the panel shows the boot screen in your browser and does not depend on the server’s network, so you can watch
Scanning and repairing driverun and log in when it is done. If RDP still does not answer afterwards, work through Remote Desktop can’t connect. - Take a snapshot first. The VPS panel takes snapshots, and one taken before
chkdsk /fis your way back if a repair goes wrong. A hard stop from the panel is also the classic way to end up with a dirty volume, so shut Windows down from inside when you can. /rrarely makes sense. The virtual disk sits on replicated NVMe storage, where a failing sector on a physical drive is the storage cluster’s problem, not Windows’./scan,/spotfixand/fcover what a VPS needs;/rmostly adds time.
The Windows VPS plans run Windows Server 2022 or 2019, and you log in as Administrator over Remote Desktop; the steps are in how to connect to RDP. On a dedicated server the disks are physical, so the backup advice above applies in full.
Frequently asked
What is the difference between chkdsk /f and chkdsk /r?
/f fixes errors in the file system's structures: file records, folders and security descriptors. /r does everything /f does and also reads every sector of the volume to find bad ones and recover readable data, so it takes much longer, especially on a large hard disk.
Do I need chkdsk /f /r /x?
No. Microsoft's reference says /r and /x each include /f, so chkdsk C: /r covers it. /x only adds a forced dismount, which matters on a data volume that programs hold open, not on the system drive, which is checked at the next restart anyway.
How do I run chkdsk on the C: drive?
Run chkdsk C: /f in a Command Prompt or PowerShell opened as Administrator, answer Y when chkdsk says the volume is in use, and restart. The check runs before Windows starts, and the computer restarts once more by itself when it is done. On a server, watch it in the provider's console, because Remote Desktop is unavailable meanwhile.
Should I run chkdsk or sfc first?
chkdsk first, because sfc and DISM read Windows files through the file system. Then DISM /Online /Cleanup-Image /RestoreHealth to repair the component store, then sfc /scannow to repair the system files from it.