One mystery that has gone unsolved for the longest time now is the dirty bit on hard drive volumes. Basically a dirty bit is just a 1 hex value located somewhere hidden on the hard drive that Microsoft has never reveal until recently. Windows will check the dirty bit to determine if a volume can contain corrupted files due to hard resetting your Windows computer with files that are still opened or when you unplug a USB flash drive that is in the midst of copying a file.
When the computer boots up with the dirty bit enabled on a hard drive, you will be asked to check the disk for consistency before Windows is loaded. You can skip the disk checking by pressing any key but it will come back again the next time you start up your computer. This will usually keep happening until you let the drive be scanned or alternatively you can tell Windows to stop checking the specific drive. This method doesn’t clear the dirty bit on the drive though and simply forces Windows not to scan a drive on boot.
As for a USB flash drive or portable hard drive with the dirty bit enabled, plugging the drive into a Windows 7 computer will prompt a window that asks:
Do you want to scan and fix Removable Disk (G:)?
There might be a problem with some files on this device or disc. This can happen if you remove the device or disc before all files have been written to it.
If you close the popup or select “Continue without scanning”, then this popup will continue to haunt you until you decided to click the recommended Scan and Fix option. There are guides on how to disable the scan and fix window by disabling the Shell Hardware Detection service but that really isn’t a viable solution since you’re telling Windows to ignore the problem rather than fixing the problem itself.
There is a tool called fsutil.exe in Windows which can be used to check if a volume is dirty and can even be used to manually set a drive as dirty which will force the requests to scan it, but weirdly it cannot be used to clear the dirty bit. Someone has already reverse engineered the fsutil.exe to confirm it.
So there seems to be 2 solutions to clear the dirty bit which is to trust the Microsoft disk checking utility by completing a check disk OR you can move the data away from the volume, format the drive and then move it back. Going with the first option would risk losing some of your files when the scan disk decides to turn them into CHK files. The second option is safer but takes a lot of time if you have a lot of files to move.
Here is a third method, and we’ve spent several hours locating the dirty bit on NTFS and FAT16/32 file systems so that we can manually reset or clear the dirty bit with a hex editor that supports disk editing. As we said earlier, the dirty bit is simply 1 hex value on the disc volume that needs to be reset and is easy to change again in future once you know how.
We’ve tried a total of 13 different hex editors which are wxHexEditor, HxD, 010 Editor, CI Hex Viewer, iBored, HexEdit Pro, Hackman Suite, DMDE, Hexprobe, FlexHEX, ADRC Hard Disk Hex Editor, WinHex and Hex Workshop. Only DMDE, WinHex and Hex Workshop were the editors able to write the data back to the disc but the last two are shareware tools. HxD is certainly one of the easiest tools to use and can make the needed changes but is a bit slower because it needs to manually search the drive for some values.
On Page 2 we’ll show how to clear the dirty bit for NTFS, FAT32, FAT16 and locked volumes.
Didn't find what you want? The links below could help:
Program Install and Uninstall Troubleshooter Tool Replaces MSICUU2Integrate and Replace the Slow Windows 7 Default Search with Agent RansackReset System and Hidden Attributes for Files or Folders Caused by VirusMove Windows XP Hard Drive or Change Motherboard Without Getting a Blue Screen STOP 7B Error
Huh… may someone help me? i have windows xp professional and i’ ve done all steps except the last one. The chkdsk is checking local disk “E” (tipe NTFS) and it’s rather annoying (it does this at every start-up) so i tried these instructions. At the last step when i try to write the changes it says: “Could not lock unmarked volumes.” Furthermore forcing this will cause the loss of all used volume descriptors and ignoring may cause unpredictable result or write access may be denied. Damn it!
Some tips would solve this (i hope). Thanks,
Untitled
from Moon
Are you trying to run the Hex editor from the same E drive? That will cause the error you have.
If not, are you running a dual boot system? You can’t directly edit any partitions that contain boot files which might be on E and C.
Hello.
I have a double boot Win 8 / XP. I tried the whole thing, but it still doesn’t work.
I changed the dirty bit
03 01 01 01 00 00 00 00 80 00 00 00 18
into
03 01 01 01 00 00 00 00 80 00 00 00 18
Are you sure that “03 01 01 01 00 00 00 00 80 00 00 00 18″ is clean ?
Thx for the help, it is still a wonderful post.
“03 01 01 01 00 00 00 00 80 00 00 00 18″ is the dirty bit if it’s been set in windows 8, in XP it will be “03 01 01 00 00 00 00 00 80 00 00 00 18″.
To clear the dirty bit in either case, set it to:
“03 01 00 00 00 00 00 00 80 00 00 00 18″
Note there’s only one “01″ in the string to indicate the dirty bit isn’t set.
Thank you, Raymond, for explaining how to clear the dirty bit on my USB flash drive. CHKDSK never finishes running on my flash drive. It goes about 70% of the way, then mysteriously exits without any error message or explanation. This left me stuck in a loop until I manually cleared the dirty bit. Is the FAT32 filesystem corrupt? Maybe, maybe not. But since my only option was to keep answering NO to the “do you want to watch CHKDSK fail again?” question every time, this is definitely an improvement.
Thank you Raymond for this wonderful post – saved my bacon when a cloned drive wouldn’t boot due to Chkdsk-induced errors
I connected my target disk using a ATAPI/USB bridge (very convenient), and used FSUTIL dirty query g: to check the before and after ‘dirty’ status. I had a bit of a heart attack when I changed the dirty bit from 01 to 00 and then used FSUTIL – it still said the volume was dirty! Then I disconnected the drive from my PC, reconnected it and checked again – now it said NOT dirty – yay!!
Put it back in my laptop, and now it boots up fine – thank you thank you!!
Frank
Just found this thread, thanks for the useful information.
USB flash drives are usually formatted as FAT32 so it’s just a matter of clearing 0×41 – I’ve just successfully done that to my flash drive and the command “fsutil dirty query f:” now confirms that volume is NOT dirty.
Hi Raymond, many thanks for your excellent research. Now I got a bunch of older FAT16 Sticks (1GB and 2GB ones) some of which also produce that “Scan and fix” dialog on Windows 7.
So I tried to locate that “dirty bit” on FAT16, and what should I say, I actually managed to find it: It’s located at offset 37 (decimal), which is 25 hex, respectively (counting from the beginning of the FAT16 boot sector).
In the FAT specifications, this byte is considered to be “unused”.
I found that it has the following meaning regarding the “dirty bit”:
00h = Not dirty
01h = Dirty
I hope this could help some folks also having FAT16 media which shows this problem. Maybe you can add this info to your article, feel free to do so!
Best regards from Germany,
Fabian
Hey, nice info.
Thank you , … i will try that the next time.
Raymond you are the Rainman!
This is a incredible good work, TWO days for one bit :-) Thanks for sharing