Difference between revisions of "Windows Dirty Bit"

Revision as of 15:54, 4 March 2016

The "Dirty Bit"

If you received this message (or a very similar one) from Partclone, it means that the Windows "Dirty Bit" is turned ON:

ntfsclone-ng.c: NTFS Volume '/dev/sda4' is scheduled for a check or it was shutdown uncleanly. Please boot Windows or fix it by fsck.

The Windows "dirty bit" is set ON when:

There are pending Windows updates

There is a pending restart

Fast Startup is enabled

Windows is hibernated

Windows is improperly shutdown

There is a chkdsk scheduled

Data corruption is detected

There are a number of ways to clear the dirty bit, but the best and easiest ways are to simply not have updates pending, disabling fast startup, shutting down windows properly, not having chkdsk scheduled, and having non-damaged HDDs and non-damaged partitions. AFTER making the necessary changes to clear the "dirty bit", windows should be restarted at least two times for it to clear properly.

Hibernation file

Windows 8.0 and 8.1 use hibernation by default when shutting down. This enables Windows to startup much faster than in past Windows versions. Because this feature is on by default, the windows OS partition has a hibernation file which prevents mounting and imaging via FOG. Even when hibernation and fast startup is disabled, the hibernation file remains and the "Dirty Bit" remains ON and these things causes problems. There are a few ways to fix this.

Way 1 (clean method)

Turn off: "Turn on fast startup", located here: Control Panel (Classic View) -> Power Options -> Choose what the power button does -> Change Settings that are currently unavailable -> "Turn On Fast Startup & Hibernate"

Both of those settings should be turned off for use with FOG. They may be turned on at a later time via GPO or snapins.

Shutdown and then boot the system.

Then run this command from an elevated command prompt to disable hibernation and remove the hibernation file:

powercfg.exe /H off

Now you can shut down and reboot once or twice, and then upload your image via FOG.

Way 2 (A little hackish)

When you're ready to capture an image, do not shut down the computer. Instead, tell it to restart. The middle point of the restart is when the OS stops, and control is handed over to the system's firmware. During or just after this moment, you can push the power button to instantly turn off the computer. Now you can upload your image.

This is because without changing the settings (in way 1), a shutdown is actually a hibernate. A restart is the only real way to take the system down fully without changing settings. The reboot causes the system to shutdown fully, thus clearing the "dirty bit".

Way 3 (Very hackish, not clean)

This method is just as viable but not as clean or easy and requires timing.

You would open an elevated command prompt and then run:

chkdsk /F

Answer yes to schedule the checkdisk at the next reboot.

Now you would reboot and allow the checkdisk to run. At some point during the check disk (which may not be at 100%), check disk will tell the sytem to reboot.

At this moment, you need to boot to the network and upload your image to fog. If you miss this moment and windows boots, you will have to re-run chkdsk.