Manually Reset or Clear Dirty Bit in Windows without CHKDSK

One mystery that has gone unsolved for the longest time is the dirty bit on hard drive volumes. Basically a dirty bit is just a 1 hex value located somewhere hidden on the hard drive that Microsoft has never reveal until today. Windows will check the dirty bit to determine if a volume can contain corrupted files due to hard resetting your Windows computer with files that are still opened or when you unplug a USB flash drive that is in the midst of copying a file. When the computer boots up with the dirty bit enabled, you will be asked to check the disk for consistency before Windows is loaded. You can skip the disk checking by pressing any key but it will come back again the next time you start up your computer.

As for USB flash drive with dirty bit, plugging the USB flash drive to a Windows 7 computer will prompt a window that ask “Do you want to scan and fix Removable Disk? There might be a problem with some files on this device or disc. This can happen if you remove the device or disc before all files have been written to it”. If you close the popup or select “Continue without scanning”, then this popup will continue to haunt you until you decided to click the recommended Scan and Fix option. There are guides on how to disable the scan and fix window by disabling the Shell Hardware Detection service but honestly I don’t think that is a solution since you’re telling Windows to ignore the problem rather than fixing the problem itself.

There is a tool called fsutil.exe in Windows which can be used to check if a volume is dirty and can even be used to manually set a drive dirty but weirdly it cannot be used to reset the dirty bit. Someone has already reverse engineered the fsutil.exe to confirm it.

So there seems to be 2 solution to clear the dirty bit which is to trust the Microsoft disk checking utility by completing a chkdsk OR you can move the data away from the volume, format the drive and then move it back. I wouldn’t go with the first option because I would risk losing my files when the scandisk decides to turn them into CHK files. The second option is safer but takes a lot of time if you have a lot of files to move. Here is a third method which I’ve spent hours 2 days to locate the dirty bit on NTFS and FAT32 so that we can manually reset or clear the dirty bit with a hex editor that supports disk editing. The below method is for NTFS volumes.

1. Download and install WinHex.

2. Run WinHex as administrator, press the F9 key and select the drive that has the dirty bit.

3. Click on $Volume at the directory browser (if it is not there, press Ctrl + F7 to show the directory browser) and scroll down 1 or 2 times at the bottom window until you see the hex values that shows 03 01 01 00 00 00 00 00 80 00 00 00 18 which is circled in red and also a block that looks like the one circled in blue.

4. The dirty bit is the one that I’ve pointed with a red arrow at the image above. 01 means means dirty bit is enabled. To disable dirty bit, simply change the hex value from 01 to 00. To do that, use your mouse to click once at the dirty bit and then press the number 0 at your keyboard to overwrite it. There is no need use the Backspace or Delete key.

5. Click the File from menubar and select Save Sectors.

I’ve tried a total of 12 different hex editors which are wxHexEditor, HxD, 010 Editor, CI Hex Viewer, iBored, HexEdit Pro, Hackman Suite, Hexprobe, FlexHEX, ADRC Hard Disk Hex Editor, WinHex, Hex Workshop but only WinHex and Hex Workshop are able to write sector changes to the disk. For WinHex, only the full version allows to write sectors to the disk and Hex Workshop is a little complicated in searching for the dirty bit. So if you have a WinHex license, then use WinHex to make the changes. If not, then you’ll have to search for the dirty bit offset hex pattern in Hex Workshop.

The offset location of the dirty bit is different on every NTFS volume. The best way to locate the dirty bit is to search the dirty bit offset hex pattern which is 03 01 01 00 00 00 00 00 80 00 00 00 18. So far the dirty bit offset hex pattern are the same on Windows XP, Windows 7 and even on Windows 8 Developer Preview installed in NTFS partition. Manually resetting the dirty bit on NTFS takes effect immediately on Windows 7 and Windows 8 but on XP, it requires a restart.

As for FAT32, the location of the dirty bit is different from NTFS. I’ve checked a couple of FAT32 partitions and the dirty bit seems to be located at offset 41. The hex value 00 means that dirty bit is disabled while 01 means that dirty bit is enabled. As for FAT16 and exFAT file system, sorry to say that I didn’t manage locate the dirty bit.