Special Note: After testing it seems none of the hex editors will edit the system volume (C: drive) or any volumes currently in use and locked by the system, although some of them claim to be able to do so. There is a solution to this problem which we mention at the bottom of the article.
Clear the Dirty Bit for an NTFS Volume
1. Download the DMDE GUI for Windows tool and extract the zip file, it’s free and portable.
2. On running the DMDE.exe you will be asked to select a drive for editing, clicking on “Logical Disk/Volumes” will give the drive letter to help recognize the correct drive for editing. Partition size and label for the current selection will be underneath.
3. On the Partitions screen click the volume on the logical drive, then Open Volume. Click Open on the next window. In the edit window click the expand icon on the bottom right window to expand the MFT view.
4. Press Alt+C to bring up the volume cluster selection (or Editor -> Volume Cluster), just press OK or enter in the window.
5. Now in the Hex editor press Ctrl+S or go to Tools -> “Search String in Object”. In the Hex box enter the following string and click OK:
03 01 01 00 00 00 00 00 80 00 00 00 18
For some odd reason Windows 8 has slightly changed this value when it sets the dirty bit and the values to look for are different. For a fixed drive look for the following hex string:
03 01 01 01 00 00 00 00 80 00 00 00 18
For a USB flash drive in Windows 8 look for this:
03 01 81 01 00 00 00 00 80 00 00 00 18
Note the bits in bold that are different to Windows 7 and below.
6. Instantly the program will find the string as it’s close by. Everyone will have different offset addresses for this string which is to be expected.
7. The dirty bit itself is not the whole string and the second (and third in Windows 8) 01’s in the search string are all that needs to be edited, so:
03 01 01 00 00 00 00 00 80 00 00 00 18 (or 03 01 01 01 for Win 8)
will turn into this to clear the dirty bit:
03 01 00 00 00 00 00 00 80 00 00 00 18
Click on the 01 to be edited and press Ctrl+E (or Edit -> Edit Mode) which will make the cursor flash. Change the 01 to 00. If this value is already 00 then the dirty bit is not currently set.
8. When you’re ready, press Ctrl+W or Edit -> Write Changes to commit the change to the disc and close DMDE.
The offset location of the dirty bit is different on every NTFS volume. If you try to locate the dirty bit using a search for 03 01 01 00 00 00 00 00 80 00 00 00 18 from the start of the drive, you will likely find another match within the first 20 or 30 sectors. Changing this value will NOT clear the dirty bit. So far the dirty bit offset hex patterns are the same on Windows XP and Windows Vista and 7 when installed in an NTFS partition, only 8 seems to be different. Manually resetting the dirty bit on NTFS takes effect immediately on Windows 7 and Windows 8 but on XP, it requires a restart.
Clear the Dirty Bit for a FAT32 Volume
Finding and clearing the dirty bit for a FAT32 file system is far easier than NTFS because it’s located right at the start of the volume and is always at the same offset location. Here’s how to clear it.
1. Download DMDE GUI for Windows and follow steps 1 and 2 above to load the program and select the drive volume to edit.
2. On the Partitions screen change nothing and select Close.
3. The dirty bit for FAT32 is located at offset 41 (5 down, 2 across) and if set this will be 01. Click on it, press Ctrl+E to edit, change 01 to 00 and then press Ctrl+W to commit the changes.
Clear the Dirty Bit for a FAT(16) Volume
As for a FAT(16) volume, the procedure is exactly the same as for FAT32 apart from the offset to change the value is slightly different. When you’re working in DMDE, look at the offset of 25 and if necessary change the dirty bit value of 01 to 00. Use Ctrl+E, edit the value and then Ctrl+W to commit the changes.
Unfortunately we didn’t manage to locate the dirty bit for the exFAT file system which seems to be harder to trace and edit.
Changing the Dirty Bit on Locked/System volumes
If you’re trying to clear the dirty bit on your C drive you will probably find using any hex editor will not solve the problem and you will get a locked error in a similar way to when you need to run Chkdsk and it cannot run until you reboot the system.
However, there is a way around this problem which is not to boot from the C drive because doing that will break the lock and allow you to edit it with a hex editor. This can be achieved with the help of a bootable live CD, and we would highly recommend Hiren’s Boot CD for the task because HxD is already included in the Mini Windows XP.
2. Boot the system with the CD/USB flash drive and choose Mini Windows XP at the menu.
3. Once Windows has loaded, click on the tool icon in the tray and select “Editors / Viewers” -> HxD. This will load the HxD editor.
4. Go to the Extras menu, select Open disk and choose the drive you can’t edit. Make sure to untick the Read Only box before pressing OK and accepting the warning.
5. Now simply search for the strings depending on the file system you want to edit from above. Ctrl+F will bring up the search window and choose a Datatype of Hex from the drop down, then enter the hex string.
6. Once you’ve done editing click the Save icon or press Ctrl+S. You obviously need to be very sure what you’re doing here because changing wrong values could render the computer unbootable.