Special Note: After testing it seems none of the hex editors will edit the system volume (C: drive) or any volumes currently in use and locked by the system, although some of them claim to be able to do so. There is a solution to this problem which we mention at the bottom of the article.
Clear the Dirty Bit for an NTFS Volume
1. Download the DMDE GUI for Windows tool and extract the zip file, it’s free and portable.
2. On running the DMDE.exe you will be asked to select a drive for editing, clicking on “Logical Disk/Volumes” will give the drive letter to help recognize the correct drive for editing. Partition size and label for the current selection will be underneath.
3. On the Partitions screen click the volume on the logical drive, then Open Volume. Click Open on the next window. In the edit window click the expand icon on the bottom right window to expand the MFT view.
4. Press Alt+C to bring up the volume cluster selection (or Editor -> Volume Cluster), just press OK or enter in the window.
5. Now in the Hex editor press Ctrl+S or go to Tools -> “Search String in Object”. In the Hex box enter the following string and click OK:
03 01 01 00 00 00 00 00 80 00 00 00 18
For some odd reason Windows 8 has slightly changed this value when it sets the dirty bit and the values to look for are different. For a fixed drive look for the following hex string:
03 01 01 01 00 00 00 00 80 00 00 00 18
For a USB flash drive in Windows 8 look for this:
03 01 81 01 00 00 00 00 80 00 00 00 18
Note the bits in bold that are different to Windows 7 and below.
6. Instantly the program will find the string as it’s close by. Everyone will have different offset addresses for this string which is to be expected.
7. The dirty bit itself is not the whole string and the second (and third in Windows 8) 01′s in the search string are all that needs to be edited, so:
03 01 01 00 00 00 00 00 80 00 00 00 18 (or 03 01 01 01 for Win 8)
will turn into this to clear the dirty bit:
03 01 00 00 00 00 00 00 80 00 00 00 18
Click on the 01 to be edited and press Ctrl+E (or Edit -> Edit Mode) which will make the cursor flash. Change the 01 to 00. If this value is already 00 then the dirty bit is not currently set.
8. When you’re ready, press Ctrl+W or Edit -> Write Changes to commit the change to the disc and close DMDE.
The offset location of the dirty bit is different on every NTFS volume. If you try to locate the dirty bit using a search for 03 01 01 00 00 00 00 00 80 00 00 00 18 from the start of the drive, you will likely find another match within the first 20 or 30 sectors. Changing this value will NOT clear the dirty bit. So far the dirty bit offset hex patterns are the same on Windows XP and Windows Vista and 7 when installed in an NTFS partition, only 8 seems to be different. Manually resetting the dirty bit on NTFS takes effect immediately on Windows 7 and Windows 8 but on XP, it requires a restart.
Clear the Dirty Bit for a FAT32 Volume
Finding and clearing the dirty bit for a FAT32 file system is far easier than NTFS because it’s located right at the start of the volume and is always at the same offset location. Here’s how to clear it.
1. Download DMDE GUI for Windows and follow steps 1 and 2 above to load the program and select the drive volume to edit.
2. On the Partitions screen change nothing and select Close.
3. The dirty bit for FAT32 is located at offset 41 (5 down, 2 across) and if set this will be 01. Click on it, press Ctrl+E to edit, change 01 to 00 and then press Ctrl+W to commit the changes.
Clear the Dirty Bit for a FAT(16) Volume
As for a FAT(16) volume, the procedure is exactly the same as for FAT32 apart from the offset to change the value is slightly different. When you’re working in DMDE, look at the offset of 25 and if necessary change the dirty bit value of 01 to 00. Use Ctrl+E, edit the value and then Ctrl+W to commit the changes.
Unfortunately we didn’t manage to locate the dirty bit for the exFAT file system which seems to be harder to trace and edit.
Changing the Dirty Bit on Locked/System volumes
If you’re trying to clear the dirty bit on your C drive you will probably find using any hex editor will not solve the problem and you will get a locked error in a similar way to when you need to run Chkdsk and it cannot run until you reboot the system.
However, there is a way around this problem which is not to boot from the C drive because doing that will break the lock and allow you to edit it with a hex editor. This can be achieved with the help of a bootable live CD, and we would highly recommend Hiren’s Boot CD for the task because HxD is already included in the Mini Windows XP.
1. Download Hiren’s Boot CD and burn it to CD or write it to USB.
2. Boot the system with the CD/USB flash drive and choose Mini Windows XP at the menu.
3. Once Windows has loaded, click on the tool icon in the tray and select “Editors / Viewers” -> HxD. This will load the HxD editor.
4. Go to the Extras menu, select Open disk and choose the drive you can’t edit. Make sure to untick the Read Only box before pressing OK and accepting the warning.
5. Now simply search for the strings depending on the file system you want to edit from above. Ctrl+F will bring up the search window and choose a Datatype of Hex from the drop down, then enter the hex string.
6. Once you’ve done editing click the Save icon or press Ctrl+S. You obviously need to be very sure what you’re doing here because changing wrong values could render the computer unbootable.
Hey thanks,
I ran the chkntfs command in cmd to check all my hard disk drives and two of them proclaimed to be dirty which I believe is not true as I have ran the manufacturers diagnostic tools on them very recently.. anyway I followed the tutorial which works but I noticed I had to do it twice on each drive for it to actually change =S
Manufacturer diagnostic tools don’t really check the filesystem dirty bit, they check the SMART attributes and run a few other tests to check the integrity of the disk surface etc. The dirty bit is set and checked by Windows.
I had a couple of drives with the dirty bit set by Win 8.1, verified by fsutil, but DMDE could not find the string anywhere close to the beginning of the MFT. I tried both the Win7 and Win8 strings you gave, and I even searched just for “03 01″, but I couldn’t find the string before I aborted the search after five minutes and 50 million sectors. Is it possible that Win 8.1 has a completely different kind of string to look for?
Even if I have to fix the dirty bit the hard way, thanks for the article, and the great tip on DMDE, which is a great piece of freeware.
This is the only solution that seemed to work for me. Thank you so much for the help!
Hello,
I have find the sring with dirty bit in windows 7 in C: drive where OS is installed , but I am not able to save the changed string. Error of loss of data.
thnking you.
You can’t save changes to the C drive if that’s what you are booting from. Have you read the section “Changing the Dirty Bit on Locked/System volumes” on page 2?
Hello.
I have a machine with Windows XP Professional SP3 on a 250GB-SATA drive (NTFS). Two weeks ago, the machine had a read-error from the SATA drive (C:) while booting (hard reset was neccessary). Autochk.exe now loads CHKDSK at every windows boot. I tried hard to fix the problem, but no way… ‘chkntfs c:’ via CMD told me again and again that C: isn’t fine and every time before Windows starts it starts CHKDSK. I have taken a brandnew SATA drive and cloned the old drive (via Acronis) – result: same procedure as every day :((
Finally I found this excellent article here, but I can’t solve the problem. What I have done: I took a Hiren’s 13.1 and launched MiniXp. Then I launched HxD and opened C: without write protection and started a search for ‘ 03 01 01 00 00 00 00 00 80 00 00 00 18′. No results.
The next step was to start a search for ’03 01 00 00 00 00 00 00 80 00 00 00 18′. No results.
Finally I started to search for the pattern ’00 00 00 00 80 00 00 00 18′. Stepwise with F3 I had success on the beginning of the drive (Unfortunately I don’t remember the offset): ’03 01 01 40 00 00 00 00 80 00 00 00 18′ . I searched until offset 02 80 5A 9E A4 but had no further related search result.
How to go on now? Do I have to overwrite the ’03 01 01 40′ with ’03 01 00 00′ and see what happens? But why is the fourth bit 0×40 instead of 0×00?
Please give me advice or hints!
Best regards
Robert
exFAT has the dirty bit in the VBR (1st Sector), offset 106 (0x6a). Since there are 4 flags in this single byte: оffset 0 is Active FAT and indicates which FAT is active;
оffset 1 is Dirty Volume, 0=clean, 1=dirty;
оffset 2 is Media Failure, this indicates if there are ANY bad clusters on the volume;
оffset 3 is Clear to Zero (the spec does not indicate what this means)
It is truley a dirty bit, not a dirty byte.
Hello Everyone,
Just a note to say thanks for the info. I had wondered why I could no longer leave a flash-drive in while booting the computer. All was good until one day I happened to notice a chkdsk of my flash-drive was happening, and after that some of its data became “lost”. I had a backup for it but, sometimes even that is a pain to have to deal with.
I checked all my flash-drives with the method outlined and found two “dirty” little drives.
Fixed ‘em both with the Hex Editor as per the instructions.
WooHoo!! All is good.
I do want to share one thing.
One of my FAT 32 flash-drives showed 03 in offset 41 (5 down 2 across) instead of 01 (as is mentioned in the instructions).
I was confused at first and then I figured that XP may have written to it three times (due to my stupidity, I’m sure) and that would account for the change from 01 to 03.
So, I changed the 03 to 00 and gave it a go.
Worked like a charm.
Below is what the drive looked like before (w/ the 6 or 7 or 8 zeros omitted from the beginning of each line), if anyone is interested.
00: EB 58 90 4D-53 44 4F 53-35 2E 30 00-02 20 00 04
10: 02 00 00 00-00 F8 00 00-3F 00 80 00-80 1F 00 00
20: 80 AA E6 00-70 0E 00 00-00 00 00 00-02 00 00 00
30: 01 00 08 00-00 00 00 00-00 00 00 00-00 00 00 00
40: 00 03 29 E8-90 89 99 55-53 42 20 44-49 53 4B 20
50: 20 20 29 E8-90 89 99 55-53 42 20 44-49 53 4B 20
Thanks a bunch,
At step 4, when I pressed Alt+C, the cluster selection window came up with ’3′ preloaded as the start cluster. When I ran a search from that location for the bit string, it came up with a result at address 31DE0. Changing the appropriate bit at that address did nothing. (At least as far as dirty status! I changed it back in case it’s used for something else…)
I then went back and manually entered 0 in the cluster selection window to start at the beginning of the disk. Then when I searched it found a result at address 3DE0, which was the correct one. Changing the appropriate bit there changed the disk status to NOT dirty. (Also, the change took effect immediately, even on Windows XP, perhaps because I had booted in safe mode and/or because it was a data disk, not the system disk.)
Thanks for this.
Huh… may someone help me? i have windows xp professional and i’ ve done all steps except the last one. The chkdsk is checking local disk “E” (tipe NTFS) and it’s rather annoying (it does this at every start-up) so i tried these instructions. At the last step when i try to write the changes it says: “Could not lock unmarked volumes.” Furthermore forcing this will cause the loss of all used volume descriptors and ignoring may cause unpredictable result or write access may be denied. Damn it!
Some tips would solve this (i hope). Thanks,
Untitled
from Moon
Are you trying to run the Hex editor from the same E drive? That will cause the error you have.
If not, are you running a dual boot system? You can’t directly edit any partitions that contain boot files which might be on E and C.
Hello.
I have a double boot Win 8 / XP. I tried the whole thing, but it still doesn’t work.
I changed the dirty bit
03 01 01 01 00 00 00 00 80 00 00 00 18
into
03 01 01 01 00 00 00 00 80 00 00 00 18
Are you sure that “03 01 01 01 00 00 00 00 80 00 00 00 18″ is clean ?
Thx for the help, it is still a wonderful post.
“03 01 01 01 00 00 00 00 80 00 00 00 18″ is the dirty bit if it’s been set in windows 8, in XP it will be “03 01 01 00 00 00 00 00 80 00 00 00 18″.
To clear the dirty bit in either case, set it to:
“03 01 00 00 00 00 00 00 80 00 00 00 18″
Note there’s only one “01″ in the string to indicate the dirty bit isn’t set.
Thank you, Raymond, for explaining how to clear the dirty bit on my USB flash drive. CHKDSK never finishes running on my flash drive. It goes about 70% of the way, then mysteriously exits without any error message or explanation. This left me stuck in a loop until I manually cleared the dirty bit. Is the FAT32 filesystem corrupt? Maybe, maybe not. But since my only option was to keep answering NO to the “do you want to watch CHKDSK fail again?” question every time, this is definitely an improvement.
Thank you Raymond for this wonderful post – saved my bacon when a cloned drive wouldn’t boot due to Chkdsk-induced errors
I connected my target disk using a ATAPI/USB bridge (very convenient), and used FSUTIL dirty query g: to check the before and after ‘dirty’ status. I had a bit of a heart attack when I changed the dirty bit from 01 to 00 and then used FSUTIL – it still said the volume was dirty! Then I disconnected the drive from my PC, reconnected it and checked again – now it said NOT dirty – yay!!
Put it back in my laptop, and now it boots up fine – thank you thank you!!
Frank
GOOD ONE, REALLY HELPED
Just found this thread, thanks for the useful information.
USB flash drives are usually formatted as FAT32 so it’s just a matter of clearing 0×41 – I’ve just successfully done that to my flash drive and the command “fsutil dirty query f:” now confirms that volume is NOT dirty.
Hi Raymond, many thanks for your excellent research. Now I got a bunch of older FAT16 Sticks (1GB and 2GB ones) some of which also produce that “Scan and fix” dialog on Windows 7.
So I tried to locate that “dirty bit” on FAT16, and what should I say, I actually managed to find it: It’s located at offset 37 (decimal), which is 25 hex, respectively (counting from the beginning of the FAT16 boot sector).
In the FAT specifications, this byte is considered to be “unused”.
I found that it has the following meaning regarding the “dirty bit”:
00h = Not dirty
01h = Dirty
I hope this could help some folks also having FAT16 media which shows this problem. Maybe you can add this info to your article, feel free to do so!
Best regards from Germany,
Fabian
Hey, nice info.
Thank you , … i will try that the next time.
Raymond you are the Rainman!
This is a incredible good work, TWO days for one bit :-) Thanks for sharing