Start here
Check a volume without downtime
chkdsk C: /scanIs the volume flagged dirty
fsutil dirty query C:Where did the space go
vssadmin list shadowstorageDisk is read-only or offline
diskpart, attributes diskCluster size and MFT layout
fsutil fsinfo ntfsinfo C:Is the disk dying
Events
7, 51, 153
Modern chkdsk is two steps, not one. Since Windows 8 and Server 2012 the scan runs online while the volume is in use, and only the repair needs the volume offline. The old habit of scheduling a full
/f at boot is rarely the right move on a server.
chkdsk
| Switch | Effect |
|---|---|
/scan | Online scan, volume stays in use. NTFS only. |
/spotfix | Fix the queued problems, needs a brief dismount. NTFS only. |
/perf | Scan as fast as possible, at the cost of everything else. Use with /scan. |
/forceofflinefix | Skip online repair, queue everything for offline. Use with /scan. |
/offlinescanandfix | Full offline scan and repair |
/f | Fix errors, requires an exclusive lock on the volume |
/r | Find bad sectors and recover what is readable. Implies /f and takes hours. |
/b | Clear the bad cluster list and re-test every cluster. Implies /r. NTFS only. |
/x | Force a dismount first, invalidating open handles. Implies /f. |
/i | Lighter index check, faster. NTFS only. |
/c | Skip folder cycle checking, faster. NTFS only. |
/sdcleanup | Collect unused security descriptor data. Implies /f. NTFS only. |
| Situation | Command |
|---|---|
| Routine health check on a live server | chkdsk C: /scan |
| Same, and you want it over quickly | chkdsk C: /scan /perf |
| Apply the fixes found by the scan | chkdsk C: /spotfix |
| Data volume you can dismount now | chkdsk E: /f /x |
| Suspected bad sectors | chkdsk E: /r /x |
| PowerShell equivalent of the online scan | Repair-Volume -DriveLetter C -Scan |
| PowerShell spot fix | Repair-Volume -DriveLetter C -SpotFix |
| PowerShell full offline repair | Repair-Volume -DriveLetter E -OfflineScanAndFix |
/r on a failing disk can finish the job. Reading every sector of a disk that is already throwing event 7 or 153 puts it under exactly the load it cannot take. Image the disk first, then repair the image, not the original.
chkntfs and the dirty bit
| Task | Command |
|---|---|
| Is this volume marked dirty | chkntfs C: |
| Same answer, different tool | fsutil dirty query C: |
| Stop a volume being checked at boot | chkntfs /x C: |
| Put it back in the boot check | chkntfs /d |
| Schedule a check at next boot | chkntfs /c D: |
| Change the countdown before autochk runs | chkntfs /t:15 |
The dirty bit is a flag, not a diagnosis. It means the volume was not dismounted cleanly or that NTFS saw something it wants checked. Excluding the volume with
/x silences the boot check but leaves the flag set, so use it to control a maintenance window, never to make the message go away.
diskpart
| Step | Command |
|---|---|
| See the disks | list disk |
| Pick one, everything after this acts on it | select disk 1 |
| Confirm you picked the right one | detail disk |
| Bring an offline disk up | online disk |
| Clear the read-only flag | attributes disk clear readonly |
| Re-scan after a LUN change | rescan |
| Partitions on the selected disk | list partition |
| Volumes, with letters and labels | list volume |
| Wipe the disk, partition table included | clean |
| Convert an empty disk | convert gpt or convert mbr |
| Create a partition using all the space | create partition primary |
| Create a sized partition, in MB | create partition primary size=51200 |
| Format it | format fs=ntfs quick label="Data" |
| Give it a letter | assign letter=E |
| Grow into free space that follows it | extend |
| Shrink by an amount, in MB | shrink desired=10240 |
| Delete a protected partition | delete partition override |
clean does not ask twice. It destroys the partition table of whatever
select disk last pointed at, and diskpart keeps that selection between commands. Run detail disk and read the size and model out loud before anything destructive. There is no undo and no recycle bin.
The PowerShell equivalents
| Task | Command |
|---|---|
| Disks, with health and partition style | Get-Disk |
| Volumes, with free space | Get-Volume |
| Partitions on one disk | Get-Partition -DiskNumber 1 |
| Bring a disk online and writable | Set-Disk -Number 1 -IsOffline $false then -IsReadOnly $false |
| Initialise a new disk | Initialize-Disk -Number 1 -PartitionStyle GPT |
| Create and letter a partition | New-Partition -DiskNumber 1 -UseMaximumSize -AssignDriveLetter |
| Format it | Format-Volume -DriveLetter E -FileSystem NTFS -NewFileSystemLabel "Data" |
| Grow a partition to the maximum | Resize-Partition -DriveLetter E -Size (Get-PartitionSupportedSize -DriveLetter E).SizeMax |
| Physical disks and media type | Get-PhysicalDisk | Select FriendlyName,MediaType,HealthStatus |
| Wear and error counters | Get-PhysicalDisk -Number 0 | Get-StorageReliabilityCounter |
| Rescan after presenting a new LUN | Update-HostStorageCache |
Use the cmdlets in scripts, diskpart at the console. The cmdlets return objects you can test before acting, which matters when a script is about to format something. diskpart has no such safety net, which is exactly why it is still the faster tool when a human is watching.
fsutil
| Task | Command |
|---|---|
| Cluster size, MFT size and zone | fsutil fsinfo ntfsinfo C: |
| Every drive and its type | fsutil fsinfo drives |
| Volume label, serial and file system | fsutil fsinfo volumeinfo C: |
| Free space in bytes | fsutil volume diskfree C: |
| Which file owns a given cluster | fsutil volume querycluster C: 12345 |
| Dirty bit | fsutil dirty query C: |
| NTFS self-healing state | fsutil repair query C: |
| Create a file of an exact size for testing | fsutil file createnew C:\temp\test.dat 1073741824 |
| Hard links pointing at a file | fsutil hardlink list C:\data\file.txt |
| Is this a junction or a symlink | fsutil reparsepoint query C:\data\link |
| Change journal size and state | fsutil usn queryjournal C: |
| Is TRIM enabled, 0 means yes | fsutil behavior query DisableDeleteNotify |
| 8.3 name creation on a volume | fsutil 8dot3name query C: |
ntfsinfo answers the question behind most “the disk is full” tickets on a file server. A 4 KB cluster with millions of tiny files wastes a surprising amount, and the MFT zone shows how much of the volume the file system itself has reserved.
Shadow copies
| Task | Command |
|---|---|
| Existing snapshots | vssadmin list shadows |
| How much space they are allowed and using | vssadmin list shadowstorage |
| Writers and their state, before blaming the backup | vssadmin list writers |
| Installed providers | vssadmin list providers |
| Cap the space used | vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10% |
| Delete the oldest snapshot | vssadmin delete shadows /for=C: /oldest |
| Create a snapshot, Windows Server only | vssadmin create shadow /for=C: |
Failed writers are not fixed by rerunning the backup. A writer in a failed or timed-out state stays that way until its service restarts, and on a busy server that usually means a reboot. Check
list writers before you spend an evening on the backup software.
Deleting shadows deletes restore points. It frees space immediately and it also removes previous versions users can self-serve, and any application-consistent snapshot a backup depends on. Resize the storage instead when the problem is space.
Space, trim and fragmentation
| Task | Command |
|---|---|
| Analyse without changing anything | defrag C: /A |
| Same, PowerShell | Optimize-Volume -DriveLetter C -Analyze -Verbose |
| Send TRIM to an SSD, no defragmentation | Optimize-Volume -DriveLetter C -ReTrim |
| Defragment a spinning disk | Optimize-Volume -DriveLetter D -Defrag |
| Consolidate free space before shrinking | defrag D: /X |
| Clean up component store growth | dism /online /cleanup-image /startcomponentcleanup |
| What WinSxS is actually costing | dism /online /cleanup-image /analyzecomponentstore |
Where the space actually went, without installing anything:
Get-ChildItem C:\ -Directory | ForEach-Object {
[PSCustomObject]@{
Path = $_.FullName
GB = [math]::Round((Get-ChildItem $_ -Recurse -File -EA 0 | Measure-Object Length -Sum).Sum / 1GB, 1)
}
} | Sort-Object GB -Descending
Do not defragment an SSD.
Optimize-Volume already picks the right operation per media type, which is why it is the safe command to script. Forcing -Defrag on flash only burns write cycles.
Is the hardware failing
| Signal | Where |
|---|---|
| Bad block reported by the driver | System log, event 7 |
| Error during a paging operation | System log, event 51 |
| IO retried on a path | System log, event 153 |
| Device reset, the disk stopped answering | System log, event 129 |
| File system structure corrupt | System log, event 55 from Ntfs |
| Predictive failure, SMART | System log, event 52 |
| Health as Windows sees it | Get-PhysicalDisk | Select FriendlyName,HealthStatus,OperationalStatus |
| Read and write error counters | Get-PhysicalDisk | Get-StorageReliabilityCounter | Select DeviceId,ReadErrorsTotal,WriteErrorsTotal,Wear |
| Rough SMART status | Get-CimInstance -Namespace root\wmi -ClassName MSStorageDriver_FailurePredictStatus |
On a VM, look one layer down. Events 129 and 153 inside a guest usually mean the storage path or the array underneath is struggling, not the virtual disk. Check the ESXi host and the datastore before touching the guest.
FAQ
Do I still need to schedule chkdsk /f at boot?
Rarely. On NTFS,
chkdsk /scan runs online and queues what it finds, and /spotfix then applies the fixes in seconds rather than hours. A full offline check is for a volume that is already refusing to mount or that /scan says needs it.
Shrink volume will not go below half the disk. Why?
Immovable files, typically the page file, hibernation file or a shadow copy, sit near the end of the volume. Disable the page file and hibernation, delete shadow copies, reboot, shrink, then turn them back on.
defrag D: /X helps consolidate the rest.
A new LUN is presented but Windows does not see it.
rescan in diskpart, or Update-HostStorageCache. If it appears offline or read-only, that is the SAN policy: san in diskpart shows it, and attributes disk clear readonly plus online disk fixes the disk itself.
The volume shows far less free space than the files add up to.
Usually shadow copy storage, the component store, or user profiles nobody counted. Check
vssadmin list shadowstorage first, then dism /online /cleanup-image /analyzecomponentstore, then measure folders. Quotas and the recycle bin per user account for most of the rest.
Is it safe to run these on a VMware virtual disk?
Yes, they operate at the guest level. Be aware that shrinking inside the guest does not shrink the VMDK, and that
-ReTrim is what tells thin-provisioned storage the blocks are free, which is how you actually reclaim space on the datastore.