You ran CHKDSK, or Windows decided on its own to start “Scanning and repairing drive” at boot, and afterwards something is badly wrong: folders are empty, documents have vanished, or there is a new folder called FOUND.000 packed with files named FILE0000.CHK, FILE0001.CHK and so on. It is a common and alarming situation. The good news is that the data is often still on the disk in some form. The bad news is that what you do next can decide whether it stays recoverable, especially if the drive itself is failing.
What CHKDSK actually does
CHKDSK is a file system repair tool. It does not fix hard drives; it fixes the index that Windows uses to find files. On an NTFS drive that index is the Master File Table (MFT), a list of every file, where its pieces sit on the disk and which folder it belongs to. When CHKDSK finds entries that are inconsistent or unreadable, its job is to make the file system consistent again, and it will do that even if it means cutting files loose from their folders.
That is why the result can look like data loss:
- Orphaned files that CHKDSK cannot link back to a folder are saved into FOUND.000 (then FOUND.001 on the next run) as numbered .CHK files, with their original names and extensions lost.
- Damaged folder records may be removed, so whole folders appear empty or disappear.
- Bad sectors found with the /r option are marked as unusable. Whatever was stored there is not copied anywhere; it is simply abandoned.
Why it so often goes wrong on a failing drive
File system errors rarely appear on their own. On a hard drive they are usually caused by sectors the drive can no longer read reliably, often because the heads or the disk surface are wearing out. CHKDSK sees missing or garbled records and “repairs” them by discarding them. Running it with /r makes things worse, because it tries to read every sector on the disk, which puts hours of strain on weak heads. Drives that limp into a CHKDSK scan sometimes come out of it with many more bad sectors, or do not come out of it at all.
Warning signs that the problem is physical rather than just a corrupt index include the scan stalling at one percentage for a long time, clicking or ticking noises, the computer freezing when the drive is accessed, and SMART warnings before or after the scan.
What not to do
- Do not run CHKDSK again. Each run can orphan more records and overwrite parts of the file system that recovery would rely on.
- Do not delete FOUND.000 or rename the .CHK files in bulk. They may be the only surviving copy of some files.
- Do not keep using the drive. Windows writing logs, updates and temporary files to it can overwrite the space where your missing files still sit.
- Do not install recovery software onto the same drive, and do not run “repair” or “optimise” tools on it.
- Do not format or reinstall Windows to “get it working again” if the files matter.
Safe next steps
- Stop and think about the drive’s health. If there were any of the warning signs above, shut the computer down and leave the drive switched off. Further attempts at home are the biggest single risk to the data.
- If the drive seems healthy (no noises, no freezes, no SMART warnings), look inside FOUND.000. A .CHK file is just a raw chunk of data. Small numbers of files can sometimes be identified by opening a copy in a viewer, or by checking the first few bytes for a known file signature, but this only works for files that were stored in one piece.
- Work from a copy. If you want to try recovery software, use a read-only tool, run it against the drive from a different computer or drive, and save anything it finds to a separate disk.
- Check other copies first. OneDrive, Google Drive, email attachments, an old backup drive or a colleague’s copy may get you back the most important files without touching the damaged disk at all.
How a lab approaches it
For anything important, the safer route is to have the drive imaged professionally. At Data Doctor we first assess the drive’s physical condition. If the heads or surface are failing, they are dealt with in our clean room before anything else. We then make a sector-by-sector copy and work only on that copy, so the original is not stressed further.
From the image, the old file system structures can often be analysed directly, including records that CHKDSK detached or skipped. That can bring back original file names and folder structure that are lost in the .CHK files. Where records are gone completely, files can still be found by their content, although names and folders are not always recoverable this way. How much comes back depends on how many times CHKDSK ran, how much the drive was used afterwards and how badly damaged the disk surface is.
You can read more about our hard drive data recovery in London, or see our laptop data recovery services if the drive is inside a laptop.
Lost files after CHKDSK? Talk to us
If files went missing after a disk check, turn the drive off and give it a break before trying anything else. Call Data Doctor on 020 7394 2529 for a free initial consultation, or bring the drive to us at Unit 1 The Willows, 80 Willow Walk, London SE1 5SY.