chkntfs.exe

File Path: C:\Windows\system32\chkntfs.exe
Description: NTFS Volume Maintenance Utility

Hashes

Type	Hash
MD5	`899CA96BF3EF67BF03808CCD7FC8F8F4`
SHA1	`B23B32225CEDB14AA43524EA9E00BDFDD61C6080`
SHA256	`B11778898A18C8A6A24AF153743060E1569F443AD73943BC4292EDA844C80E2E`
SHA384	`328A3D0FF0294CAF8267BBF09FBDAE403BD043874E7A0522541378B46029DE126869B5D1D1FE85040C564825B5EC1A54`
SHA512	`B3E5323DE6233833F6116795CB5AA59554EB06390982DB06DBBFF18A4D4A02A5092A7F34200D659B75CDD0ABFA674D9B4BF263A0BA7EC462DE3BF9C781D7C96F`
SSDEEP	`384:rOtQXGfBVa0gum5UTpr2QX0iBkNmqmBr0mqzrXm+TO0h2NUWi6W:ytQ4a0nmSTh2Pyqmbqzr3Cta`
IMP	`D41BF2F313E9EE8CBB20EF9AD2025250`
PESHA1	`A3CFB32DCA3043A4904B2701B9B4F199E824CDFC`
PE256	`6A8CE9F5038F8AF4A6C927E99ADA63972A877AF81741FE44EE5C6FBA7DC437A1`

Runtime Data

Usage (stdout):

Displays or modifies the checking of disk at boot time.

CHKNTFS volume [...]
CHKNTFS /D
CHKNTFS /T[:time]
CHKNTFS /X volume [...]
CHKNTFS /C volume [...]

  volume         Specifies the drive letter (followed by a colon),
                 mount point, or volume name.
  /D             Restores the machine to the default behavior; all drives are
                 checked at boot time and chkdsk is run on those that are
                 dirty.
  /T:time        Changes the AUTOCHK initiation countdown time to the
                 specified amount of time in seconds.  If time is not
                 specified, displays the current setting.
  /X             Excludes a drive from the default boot-time check.  Excluded
                 drives are not accumulated between command invocations.
  /C             Schedules a drive to be checked at boot time; chkdsk will run
                 if the drive is dirty.

If no switches are specified, CHKNTFS will display if the specified drive is
dirty or scheduled to be checked on next reboot.

Loaded Modules:

Path
C:\Windows\system32\chkntfs.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

Status: Signature verified.
Serial: 3300000266BD1580EFA75CD6D3000000000266
Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: CHKNTFS.EXE.MUI
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.19041.1 (WinBuild.160101.0800)
Product Version: 10.0.19041.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/73
VirusTotal Link: https://www.virustotal.com/gui/file/b11778898a18c8a6a24af153743060e1569f443ad73943bc4292eda844c80e2e/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

chkntfs

Displays or modifies automatic disk checking when the computer is started. If used without options, chkntfs displays the file system of the specified volume. If automatic file checking is scheduled to run, chkntfs displays whether the specified volume is dirty or is scheduled to be checked the next time the computer is started.

[!NOTE] To run chkntfs, you must be a member of the Administrators group.

Syntax

chkntfs <volume> [...]
chkntfs [/d]
chkntfs [/t[:<time>]]
chkntfs [/x <volume> [...]]
chkntfs [/c <volume> [...]]

Parameters

Parameter	Description
`<volume>` […]	Specifies one or more volumes to check when the computer starts. Valid volumes include drive letters (followed by a colon), mount points, or volume names.
/d	Restores all chkntfs default settings, except the countdown time for automatic file checking. By default, all volumes are checked when the computer is started, and chkdsk runs on those that are dirty.
/t [`:<time>`]	Changes the Autochk.exe initiation countdown time to the amount of time specified in seconds. If you do not enter a time, /t displays the current countdown time.
/x `<volume>` […]	Specifies one or more volumes to exclude from checking when the computer is started, even if the volume is marked as requiring chkdsk.
/c `<volume>` […]	Schedules one or more volumes to be checked when the computer is started, and runs chkdsk on those that are dirty.
/?	Displays help at the command prompt.

Examples

To display the type of file system for drive C, type:

chkntfs c:

[!NOTE] If automatic file checking is scheduled to run, additional output will display, indicating whether the drive is dirty or has been manually scheduled to be checked the next time the computer is started.

To display the Autochk.exe initiation countdown time, type:

chkntfs /t

To change the Autochk.exe initiation countdown time to 30 seconds, type:

chkntfs /t:30

[!NOTE] Although you can set the Autochk.exe initiation countdown time to zero, doing so will prevent you from canceling a potentially time-consuming automatic file check.

To exclude multiple volumes from being checked, you must list each of them in a single command. For example, to exclude both the D and E volumes, type:

chkntfs /x d: e:

[!IMPORTANT] The /x command-line option isn’t accumulative. If you type it more than once, the most recent entry overrides the previous entry.

To schedule automatic file checking on the D volume, but not the C or E volumes, type the following commands in order:

chkntfs /d
chkntfs /x c: d: e:
chkntfs /c d:

[!IMPORTANT] The /c command-line option is accumulative. If you type /c more than once, each entry remains. To ensure that only a particular volume is checked, reset the defaults to clear all previous commands, exclude all volumes from being checked, and then schedule automatic file checking on the desired volume.

Additional References

Command-Line Syntax Key