CHKDSK is a file system tool, not a disk tool, and that distinction decides whether it saves your afternoon or ends your recovery. This page explains what each switch does, what the repair actually consists of, what ends up in the found.000 folder and why, and the one rule worth remembering: on a drive that is physically failing, a repair pass is the most damaging thing you can run.
Read this before you type the command. CHKDSK repairs the file system and cannot touch the hardware, so on a failing disk it destroys recoverable data while trying to help. If that has already happened, a single drive is £300 + VAT with the diagnostic free.
Most people arrive here with a command somebody on a forum told them to run. Here is what those switches do, in order of how much they can cost you, so you can decide with your eyes open rather than after the fact.
Read-only. It examines the file system and reports what it thinks is wrong without changing anything, and it is the only form on this list that is safe on a drive you care about. If you want to know whether there is a problem, this is the command. It is also the one nobody quotes on forums.
Fixes errors, which means writing to the volume. It deletes index entries it cannot resolve, truncates records that look wrong, and rebuilds structures to be internally consistent rather than correct. On a healthy disk after a bad shutdown that is genuinely useful. On a failing one it is destructive.
Everything /f does, plus a full surface scan that reads every sector on the volume and moves data out of any it considers bad. On a large modern disk that is hours of continuous heavy reading, which is the single worst workload you can give a drive that is already struggling to answer.
Dismounts the volume first, forcing anything using it to let go. It is often paired with /f out of habit. It does not make the repair safer, it just guarantees the repair goes ahead, so it removes the last thing standing between an impatient decision and a written change.
The newer online forms on NTFS. Scan runs while Windows is using the volume and queues problems rather than fixing them; spotfix takes the volume offline briefly and applies that queue. Gentler than a full pass, and still a write. Same rule applies: not on hardware that is failing.
When the volume is in use, Windows offers to run the check at boot instead, and most people say yes and forget. If the disk is unwell, that reboot is exactly when the damage happens, unattended, with a countdown you can still cancel by pressing a key. Cancel it if the drive has been misbehaving.
NTFS keeps a master table describing every file: where it starts, how long it is, which directory lists it, which security settings apply. CHKDSK compares those records against each other and against the map of which clusters are in use, and it fixes disagreements. Two files claiming the same clusters, a directory listing a record that no longer exists, a record with no directory pointing at it, a used-space map that does not match reality — all classic material, and on a healthy disk it is a sensible tool that does a useful job in a few minutes.
What it cannot do is repair hardware. It has no way of fixing a failing head assembly, a corrupt firmware area, a controller board on the way out or a surface that is losing its coating. Faced with any of those it will keep asking the drive to answer, over and over, because from its point of view the hardware is simply being slow.
Repair here means making the structure internally consistent. It does not mean restoring it to what it was. If a directory record cannot be resolved, the fix is to delete the entry. If a file record looks wrong, the fix is to truncate the file. If data clusters exist that no directory claims, they are written into numbered files in a folder called found.000 with a .chk extension — the contents, without the name, the folder or the date. On a volume with widespread damage that is where a great deal of somebody's work ends up.
The stages you see on screen tell you where it is. Early stages examine the file records and the directory structure. Later ones check security descriptors and the used-space map, and with /r there is a long surface scan at the end. A pass that sits at the same percentage for hours, particularly late on, is nearly always waiting on a disk that cannot answer — which is the clearest possible sign that the problem was never the file system.
Three things happen at once. It reads hard and continuously, and heavy sustained reading is what finishes drives with weakening surfaces or tired heads. It writes its conclusions back to the same disk, so any judgement it gets wrong is permanent. And it does both while a failing drive's limited stock of working hours drains away on a task that was never going to help.
The pattern is depressingly consistent. A drive starts stalling. Someone runs a full check with a surface scan. It grinds for six hours, finishes or gives up, and the volume now shows a fraction of what it held, with the rest scattered through found.000 as numbered fragments. That job was straightforward before it started and it is not now.
The disk sounds normal and behaves normally. It is not clicking, stalling, disconnecting or taking seconds per file. The health counters show no reallocated or pending sectors climbing. Something ordinary happened — a power cut, a laptop battery dying mid-write, a USB drive pulled out during a copy. And you have another copy of anything that matters. In those conditions a check with /f is fine and usually fixes the problem in minutes.
If the drive has been misbehaving and there is no second copy, run nothing. Not this, not a competing repair utility, not a defragment, not a format. Power it down and get an image taken first. Everything can be attempted safely on a copy, and nothing can be un-attempted on the original.
The type of the file system is RAW. CHKDSK is not available for RAW drives. The volume's identity has been damaged badly enough that Windows cannot tell what file system it is. That is not a reason to format. It usually means the boot sector or the master table has gone, both of which are frequently recoverable, and formatting to make CHKDSK work would be writing over the evidence.
An unspecified error occurred. Generic, and on a struggling disk it commonly means the drive stopped answering mid-operation. If the drive has been unwell, treat this as a hardware message rather than a file system one.
Windows cannot run disk checking on this volume because it is write protected. Sometimes a physical switch on a card or stick, sometimes a controller that has put itself into a read-only state because it is failing. In the second case that read-only state is protecting what is left, and forcing past it is not in your interest.
Cannot lock current drive / chkdsk cannot run because the volume is in use. Ordinary for the system disk, which is why the boot-time option exists. If the disk is behaving oddly, decline the scheduled check rather than agreeing to it.
Stop using the drive immediately — that matters more than anything else you do today. Look for a folder named found.000 in the root of the volume; there may be several, numbered upwards. Inside will be files called file0000.chk and similar. Those are your data with the names stripped off, and many of them can be identified by content and given sensible names again, which is routine work on a bench and tedious work by hand.
Do not run the check again in the hope it tidies up after itself. Do not defragment. Do not empty found.000 to save space. Copy anything still visible off to another disk if the drive is stable enough to allow it, and if it is not stable, power it down and send it in.
A single hard drive or SSD is £300 + VAT. Memory cards, USB sticks and pen drives are £250 + VAT. Recorder disks from CCTV systems and encrypted volumes where you can supply the key are £400 + VAT. RAID arrays, NAS units, SAN volumes and servers start at £500 + VAT and rise with the member count. Forensic work with a full written report is £800 + VAT, and a binary image with deleted-file extraction and no report is £400 + VAT.
The diagnostic costs nothing and closes two working days after the drive is booked in, and the figure that follows is fixed in writing before anything starts. A drive that only suffered a bad repair pass is a logical job, so it carries no fix, no fee. Electronic failures, mechanical failures, chip-level work, DVR jobs and forensic jobs sit outside that guarantee, and physical work takes half the quoted figure upfront.
Frequently not, and you should hear that from the people who would otherwise take your money. If the drive is healthy, the volume mounts and a few files are missing, restore them from wherever your second copy lives. If found.000 holds a handful of documents you can identify by opening them, do that yourself over a cup of tea. Send it in when the volume will not mount, when what was lost cannot be replaced, or when the disk is behaving as though it is failing — those are the cases where a bench genuinely changes the outcome.
Anything can be attempted safely on a copy. Nothing can be un-attempted on the original, which is the whole argument in one sentence.
Cards, sticks and single drives are the easiest things in the world to post, and posting them is gentler than a day of being carried around in a coat pocket. A padded envelope handed over in Leicester tends to reach the Cambridge bench the next working day.
The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.
↓ Print the shipping & booking-in form (PDF)
Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.
Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.