This chapter covers the chkdsk utility, a critical tool for diagnosing and repairing file system integrity issues on Windows systems. For the CompTIA A+ 220-1102 exam, chkdsk is a key command for Objective 3.1 (Given a scenario, use the appropriate Microsoft Windows 10/11 troubleshooting tools). You can expect 1-2 questions that test your knowledge of chkdsk syntax, options, and when to use it. Mastering chkdsk is essential for any IT support professional, as file system corruption is a common cause of system instability and data loss.
Jump to a section
Imagine a large library with thousands of books on shelves, but the librarian suspects some books are misplaced, damaged, or the catalog system has errors. The librarian decides to perform an inventory audit. First, she creates a map of where every book should be based on the catalog (the file system metadata). Then she walks through every aisle, checking each book against the map. If a book is in the wrong place (a cross-linked file), she notes it. If a book is damaged (bad sector), she tries to read it; if it's unreadable, she marks that spot as unusable. If a book is missing but the catalog says it should be there (orphaned file), she may remove the catalog entry or try to recover the book. The librarian can run the audit in read-only mode (just report issues) or with repair mode (fix issues by moving books, marking shelves, or updating the catalog). This is exactly what chkdsk does: it scans the file system metadata, compares it to the actual disk structure, and optionally repairs inconsistencies. The 'library map' is the Master File Table (MFT) in NTFS; the 'aisles' are clusters; and the 'repair' actions include fixing index entries, recovering readable data from bad sectors, and marking bad clusters as unusable.
What is chkdsk and Why Does It Exist?
chkdsk (Check Disk) is a command-line utility in Windows that verifies the logical integrity of a file system and optionally repairs errors. It works on FAT12, FAT16, FAT32, and NTFS volumes. The primary purpose is to detect and correct issues like:
Bad sectors on the hard disk
Cross-linked files (two files pointing to the same cluster)
Lost clusters (clusters marked as allocated but not referenced by any file)
Directory tree errors
File system metadata corruption (e.g., Master File Table entries)
Windows automatically runs chkdsk at boot if the system detects a dirty bit (a flag indicating potential corruption) on a volume. This happens after an improper shutdown, disk errors, or when the file system is inconsistent.
How chkdsk Works Internally
When chkdsk runs, it performs several phases:
Phase 1: Checking files – chkdsk examines the Master File Table (MFT) on NTFS volumes or the File Allocation Table (FAT) on FAT volumes. It verifies that each file entry is consistent and that the file names, timestamps, and attributes are valid. It checks for orphaned files (entries with no parent directory) and corrects them.
Phase 2: Checking indexes – For NTFS, chkdsk verifies the directory indexes (B-trees). It ensures that all directory entries are valid and that the file references point to existing MFT entries. It also checks for duplicate index entries.
Phase 3: Checking security descriptors – On NTFS, chkdsk validates security descriptors (permissions) associated with files and directories. It checks for inconsistencies in the security descriptor stream.
Phase 4: Checking file data – chkdsk reads each file's data clusters and verifies that they are not cross-linked or lost. It also checks for bad clusters by attempting to read each sector. If a sector fails, it marks the cluster as bad and, if possible, relocates the data to a good cluster.
Phase 5: Checking free space – chkdsk scans free space to ensure no clusters are incorrectly marked as allocated or free.
During these phases, chkdsk uses a temporary log file to record changes. If interrupted, it can resume from the last checkpoint.
Key Options and Syntax
The basic syntax is:
chkdsk [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/L[:size]] [/B] [/scan] [/perf] [/spotfix]Commonly used switches: - /F – Fixes errors on the disk. This switch locks the volume if necessary (requires exclusive access). If the volume is in use (e.g., system drive), chkdsk schedules the scan at next reboot. - /R – Locates bad sectors and recovers readable information. Implies /F. This is the most thorough scan. - /X – Forces the volume to dismount first if necessary. All open handles to the volume become invalid. Useful for non-system volumes. - /I – (NTFS only) Performs a less vigorous check of index entries, reducing chkdsk duration. Use on large volumes where speed is important. - /C – (NTFS only) Skips checking of cycles within the folder structure, reducing time. - /L[:size] – (NTFS only) Changes the log file size to the specified kilobytes. If size is omitted, displays current size. - /B – (NTFS only) Re-evaluates bad clusters on the volume. Useful after replacing a failing disk. - /scan – (NTFS only) Runs an online scan (no need to dismount). Can be used with /perf for more resources. - /spotfix – (NTFS only) Disables fix on dismount; only logs issues.
If you run chkdsk without /F or /R, it displays a summary of errors but does not fix them. For example:
chkdsk C:This shows the file system type, volume label, and a report of errors (if any).
When to Use chkdsk
Common scenarios:
After an unexpected shutdown or blue screen
When files become corrupted or inaccessible
When a disk shows signs of failure (e.g., clicking sounds, slow performance)
When Windows prompts you to run chkdsk at boot
As part of regular maintenance (though modern SSDs reduce the need)
Interaction with Other Tools
SFC (System File Checker) – Repairs system files; chkdsk repairs file system structures. Often used together: first run chkdsk, then SFC.
DISM (Deployment Imaging Service and Management Tool) – Repairs Windows image; used before SFC if corruption is severe.
Event Viewer – chkdsk logs events (Event ID 1001) with details of findings.
PowerShell – Can run chkdsk via Repair-Volume cmdlet. For example:
Repair-Volume -DriveLetter C -OfflineScanAndFixDefault Values and Timers
The dirty bit is a flag in the volume's superblock. When set, Windows runs autochk.exe at next boot.
The default log file size for NTFS is 65536 KB (64 MB).
The /F switch schedules chkdsk to run at next reboot if the volume is in use.
chkdsk /R can take hours on large drives (e.g., 1 TB HDD). Use /I and /C to speed up on large NTFS volumes.
Trap Patterns on the Exam
Candidates often confuse chkdsk with SFC. Remember: chkdsk fixes file system issues; SFC fixes system file integrity.
Another trap: thinking chkdsk /R repairs bad sectors. It actually recovers data from bad sectors and marks them as bad; it does not repair the physical media.
The /X switch is often forgotten; it forces dismount, which may cause data loss if applications have open files.
The /F switch is required to actually fix errors; without it, chkdsk only reports.
Advanced: NTFS-specific Behavior
NTFS is a journaling file system. chkdsk uses the $LogFile to replay or undo transactions. If the log file is corrupted, chkdsk may need to rebuild it. The /L switch changes the log file size, which can improve performance for volumes with many changes.
On SSDs, running chkdsk /R is generally safe but can cause unnecessary writes. Use /F instead unless you suspect bad sectors (uncommon on SSDs).
Summary of Command Examples
Check volume D: without fixing:
chkdsk D:Fix errors on volume C: (schedules at reboot):
chkdsk C: /FForce dismount and fix volume E: immediately:
chkdsk E: /X /FLocate bad sectors and recover data on volume F:
chkdsk F: /RPerform quick index check on a large NTFS volume:
chkdsk G: /I /CRe-evaluate bad clusters on volume H:
chkdsk H: /BRun online scan with performance priority:
chkdsk C: /scan /perfIdentify the Need for chkdsk
The first step is recognizing symptoms that indicate file system corruption. Common signs include: applications crashing with file access errors, Windows reporting 'The file or directory is corrupted and unreadable', system hang during file operations, or Windows automatically scheduling a disk check at boot. Also, Event Viewer may show disk-related errors (Event ID 55, 57, 153). The user should note the drive letter and whether the system drive is affected. If the system drive is involved, chkdsk will require a reboot to run exclusively.
Open Command Prompt as Administrator
To run chkdsk with repair options, you need elevated privileges. Right-click the Start button and select 'Command Prompt (Admin)' or 'Windows PowerShell (Admin)'. Alternatively, type 'cmd' in the search, right-click, and choose 'Run as administrator'. A User Account Control (UAC) prompt will appear; click Yes. This step is critical because without admin rights, chkdsk /F and /R will fail with 'Access denied'.
Run chkdsk in Read-Only Mode First
Before making any repairs, it's wise to scan the volume without fixing to understand the extent of corruption. Type `chkdsk C:` (replace C: with the target drive) and press Enter. chkdsk will perform a read-only analysis and display a summary, including the file system type, volume label, and any errors found. This step does not require exclusive access and can run on a live volume. The output includes the number of files, folders, and the status of each phase. If no errors are reported, you can skip repair. If errors are found, proceed to the next step.
Schedule or Execute Repair with /F or /R
If the read-only scan reveals errors, run chkdsk with the /F switch to fix them: `chkdsk C: /F`. For the system drive, Windows will prompt 'Would you like to schedule this volume to be checked the next time the system restarts?' Type Y and reboot. For non-system drives, chkdsk will lock the volume, fix errors, and release it. If you suspect bad sectors, use /R instead: `chkdsk C: /R`. /R implies /F, so it will also fix logical errors. /R performs a more thorough scan and can take significantly longer. During the scan, chkdsk displays progress as a percentage. Do not interrupt the process.
Review the chkdsk Log and Verify Fixes
After chkdsk completes (either at boot or immediately), review the results. For boot-time scans, Windows displays the results on the screen before loading the desktop. You can also find the log in Event Viewer under Windows Logs > Application, with Source 'Wininit' or 'chkdsk'. The log includes details of errors found and fixed, such as 'Correcting errors in the Master File Table (MFT)' or 'Recovering orphaned file'. After the repair, verify that the original problem is resolved (e.g., file access, system stability). If the issue persists, consider running SFC or DISM, or testing the disk with manufacturer diagnostics.
In enterprise environments, chkdsk is a first-line diagnostic tool for file system issues. Here are three common deployment scenarios:
Scenario 1: Recovering a Server After an Unexpected Shutdown A file server running Windows Server 2019 loses power due to a UPS failure. Upon reboot, the server enters a chkdsk scan automatically because the dirty bit is set. The administrator observes the scan progress via remote console. If the scan fails or hangs, the administrator may boot into Safe Mode and run chkdsk with /R. In production, this can take hours on a large RAID array (e.g., 10 TB). To minimize downtime, administrators often use the /I and /C switches to speed up the scan on large NTFS volumes. After chkdsk completes, the server should be monitored for further errors. If corruption recurs, it may indicate failing hardware.
Scenario 2: Troubleshooting a User's Corrupted Home Directory
A user reports that they cannot open several files in their home folder on a network drive. The IT helpdesk technician runs chkdsk X: /F (where X: is the mapped drive) from an elevated command prompt. If the drive is in use, the technician must schedule the scan or force dismount with /X. After repair, the user can access the files. If files are still corrupted, the technician may restore from backup. In this scenario, chkdsk often fixes directory index errors that cause 'File not found' even though the file exists.
Scenario 3: Preparing a Disk for Decommissioning
Before retiring a hard drive, an IT team runs chkdsk /R to recover any readable data from bad sectors. This is part of a data migration process. The team uses a script that runs chkdsk on all drives and logs the results. If chkdsk reports many bad sectors, the drive is flagged for replacement. This proactive approach prevents data loss. On SSDs, chkdsk /R is less common because SSDs have a limited number of write cycles, and bad sectors are typically handled internally by the drive's firmware.
Common Mistakes: - Running chkdsk on a volume that is heavily used, causing performance degradation. - Using /X on a drive with open files, leading to data loss. - Assuming chkdsk fixes physical bad sectors; it only marks them as bad. - Not running chkdsk before other tools like SFC, which may fail if the file system is corrupt.
What the 220-1102 Exam Tests on chkdsk
CompTIA A+ 220-1102 Objective 3.1 expects you to know:
The purpose of chkdsk: to check the integrity of the file system and fix logical errors.
The difference between /F and /R: /F fixes errors; /R locates bad sectors and recovers readable data (implies /F).
That chkdsk can be run from the command prompt or via the graphical interface (right-click drive > Properties > Tools > Check).
That the system drive requires a reboot to run chkdsk with /F or /R.
That chkdsk is used for file system corruption, not for malware or hardware failure (though it can help identify failing disks).
Common Wrong Answers and Why Candidates Choose Them
Choosing SFC instead of chkdsk – Candidates confuse System File Checker (sfc /scannow) with chkdsk. SFC repairs Windows system files; chkdsk repairs the file system structure. If the question mentions 'corrupted file system' or 'bad sectors', the answer is chkdsk.
Thinking chkdsk /R repairs bad sectors – /R recovers data from bad sectors and marks them as bad; it does not repair the physical media. Candidates often choose 'Repairs bad sectors' as the function of /R.
Believing chkdsk can run on a system drive without a reboot – Unless you specify /F or /R, chkdsk can run in read-only mode without rebooting. But for repairs, the system drive must be rebooted. The exam may ask: 'Which switch forces chkdsk to run at next boot?' Answer: /F or /R.
Using /X unnecessarily – /X forces dismount and can cause data loss. Candidates may think it's required for all repairs, but it's only needed when the volume is in use and you want immediate repair.
Specific Numbers and Values to Memorize
chkdsk /F and /R require administrator privileges.
The dirty bit triggers autochk at boot.
Default log file size: 65536 KB (64 MB) for NTFS.
chkdsk /R can take hours on large drives.
Event ID 1001 logs chkdsk results.
Edge Cases and Exceptions
chkdsk on a FAT32 volume does not have phases 3 and 4 (security descriptors and file data check) because FAT does not support those features.
On SSDs, chkdsk /R is not recommended for regular use because it causes unnecessary writes.
If chkdsk hangs or fails, boot into Safe Mode or Windows Recovery Environment (WinRE) and run it from there.
The /B switch re-evaluates bad clusters; useful after replacing a failing disk.
How to Eliminate Wrong Answers
If the scenario involves 'system files missing or corrupted', choose SFC, not chkdsk.
If the scenario involves 'disk not accessible due to bad sectors', choose chkdsk /R.
If the scenario involves 'logical file system errors after improper shutdown', choose chkdsk /F.
If the question asks about 'repairing the Windows image', choose DISM.
By understanding the underlying mechanism—chkdsk works on the file system structure, not on individual files—you can confidently select the correct tool.
chkdsk is used to check and repair file system integrity on FAT and NTFS volumes.
The /F switch fixes logical errors; /R locates bad sectors and recovers readable data (implies /F).
chkdsk /R does not repair bad sectors; it marks them as unusable and attempts data recovery.
chkdsk requires administrator privileges for repair operations.
For the system drive, chkdsk /F or /R schedules a scan at next reboot.
The /X switch forces a volume dismount; use with caution to avoid data loss.
chkdsk /I and /C speed up scans on large NTFS volumes by skipping certain checks.
The dirty bit triggers automatic chkdsk at boot after an improper shutdown.
chkdsk logs results to Event Viewer under Windows Logs > Application with Source 'Wininit'.
Do not confuse chkdsk with SFC: chkdsk fixes file system, SFC fixes system files.
On SSDs, prefer /F over /R to reduce write wear.
The /B switch re-evaluates bad clusters; useful after replacing a failing disk.
These come up on the exam all the time. Here's how to tell them apart.
chkdsk /F
Fixes logical file system errors only.
Does not scan for bad sectors.
Faster than /R; typically completes in minutes.
Does not attempt data recovery from bad sectors.
Recommended for routine repairs after improper shutdown.
chkdsk /R
Fixes logical errors AND locates bad sectors.
Attempts to recover readable data from bad sectors.
Much slower; can take hours on large drives.
Marks bad clusters as unusable.
Used when bad sectors are suspected (e.g., disk errors in Event Viewer).
chkdsk
Checks file system integrity (MFT, FAT, directory structure).
Repairs logical file system errors.
Works on any volume (system or data).
Options: /F, /R, /X, /I, /C, /B.
Logs results to Event Viewer (Event ID 1001).
SFC (System File Checker)
Checks integrity of Windows system files.
Replaces corrupted system files from cache.
Works only on system drive (Windows folder).
Syntax: sfc /scannow, sfc /verifyonly.
Logs results to CBS.log in %windir%\Logs\CBS.
Mistake
chkdsk /R repairs physical bad sectors on the hard drive.
Correct
chkdsk /R does not repair physical bad sectors. It attempts to read data from bad sectors and, if successful, writes it to a good sector. The bad sector is then marked as unusable so the operating system avoids it. Physical bad sectors are permanent defects in the magnetic medium and cannot be repaired by software.
Mistake
Running chkdsk on an SSD will damage the drive.
Correct
Running chkdsk on an SSD is safe and does not damage the drive. However, using /R (which performs extensive reads and writes) is not recommended for regular maintenance because it increases write amplification and reduces the lifespan of the SSD. For SSDs, use /F to fix logical errors without the full surface scan.
Mistake
chkdsk must always be run from the command prompt.
Correct
chkdsk can also be run from the graphical interface: right-click the drive in File Explorer, select Properties > Tools > Check (under Error checking). This runs chkdsk in read-only mode unless you choose to 'Scan and repair drive'. However, the command line offers more options and is often required for advanced troubleshooting.
Mistake
chkdsk /F fixes all disk problems, including hardware failures.
Correct
chkdsk /F only fixes logical file system errors. It cannot fix hardware failures such as a failing motor, head crash, or electronic failure. If a disk has physical damage, chkdsk may report bad sectors, but it cannot repair the hardware. Backup and replacement are needed.
Mistake
You can run chkdsk /F on any volume without affecting open files.
Correct
chkdsk /F requires exclusive access to the volume. If the volume is in use, chkdsk will prompt to schedule the scan at next reboot. Using /X forces a dismount, which closes all open files and can cause data loss if applications have unsaved data.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
chkdsk /F fixes logical file system errors (e.g., cross-linked files, lost clusters, directory errors). chkdsk /R does everything /F does, plus it scans the entire disk for bad sectors, attempts to recover readable data from those sectors, and marks bad clusters as unusable. /R is more thorough but takes much longer. Use /F for routine repairs; use /R when you suspect physical disk damage.
Yes, you can run chkdsk C: (without /F or /R) in read-only mode while Windows is running. It will report errors but not fix them. To repair, you must use /F or /R, and Windows will prompt you to schedule the scan at the next system restart because the drive is in use.
After a boot-time chkdsk, the results are displayed on the screen during boot. To view them later, open Event Viewer, navigate to Windows Logs > Application, and look for events with Source 'Wininit' (for boot-time scans) or 'chkdsk' (for online scans). The event ID is typically 1001. You can also type 'chkdsk C:' in an elevated command prompt to see the last scan summary (if the volume is not dirty).
Yes, chkdsk works on SSDs and is safe. However, because SSDs handle bad sectors internally via spare area, running /R (surface scan) is generally unnecessary and causes extra writes. For SSDs, use /F to fix logical errors. Also, SSDs are less prone to file system corruption due to their lack of moving parts and advanced error correction.
If chkdsk appears stuck (no progress for hours), you can press a key (e.g., Enter) to see if it responds. If not, you may need to force restart (hold power button). After reboot, run chkdsk with the /I and /C switches to skip some checks and speed up the process. Alternatively, boot into Safe Mode or Windows Recovery Environment (WinRE) and run chkdsk from there.
No, chkdsk cannot recover deleted files. It only repairs the file system structure. Deleted files can sometimes be recovered using specialized data recovery software, but chkdsk is not designed for that purpose. If you accidentally delete a file, stop using the drive immediately and use a recovery tool.
The dirty bit is a flag in the volume's superblock that indicates the file system may be inconsistent. When Windows detects an improper shutdown or a file system error, it sets the dirty bit. At the next boot, Windows runs autochk.exe (a version of chkdsk) to check the volume and clear the dirty bit. You can check the dirty bit status with `fsutil dirty query C:`.
You've just covered chkdsk Tool Usage — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?