Hard drive errors: how to triage before you lose the data

A failing drive rarely announces itself with a single dramatic crash. More often it whispers for weeks: a file that will not open, a save that takes five seconds longer than it should, a click from the case you have never heard before. By the time the screen freezes and the BSOD (Blue Screen of Death, Windows’ way of telling you the kernel panicked) shows up, the data is already on borrowed time. The trick is to catch the whisper, not the scream.

This guide walks through how to triage a Windows hard drive when something feels off. It covers the built-in tools that come with Windows, what they actually check, what they cannot catch, and the few moments where you should stop troubleshooting and start backing up. The order matters: do the read-only checks first, the destructive checks last, and the backup before anything that writes to the disk.

The signals that mean you should pay attention

Drives fail in three broad ways: mechanical (a traditional spinning HDD with a physical arm and platter), electronic (the controller board or the flash on an SSD is going bad), and logical (the filesystem itself has gotten confused). The signals overlap, but each pattern points at a different diagnosis:

Clicking or grinding sounds, especially rhythmic. This is the read head hitting a damaged sector. The drive is mechanically failing. Skip everything below and back up now.
Files that open slowly or fail to open, then open fine on a reboot. The drive is re-reading bad sectors. Logical or electronic. Run the checks below.
Files that vanish, then reappear after a reboot. The filesystem is confused. Logical. Run chkdsk with the /f flag.
Random BSODs with NTFS_FILE_SYSTEM or KERNEL_DATA_INPAGE_ERROR (Windows error codes that mean the filesystem or the disk subsystem hit a problem it could not recover from). Likely the drive, but it could also be the SATA cable or the port. Try a different cable first because that is cheaper than a new drive.
Sudden massive slowdowns on a drive that was fast yesterday. Often an SSD with a worn-out flash cell. Check the S.M.A.R.T. data before assuming software.
Drive not showing up in File Explorer at all, but showing in Disk Management. Partition table (the on-drive index that says which part of the drive is which letter) is corrupt or the filesystem is unrecognized. Recoverable in many cases. Do not initialize the disk if Windows offers.

The signals list is not exhaustive. The point is that the kind of signal points at the kind of failure. Spend a minute on the diagnosis before you spend an hour on the fix.

The first check: S.M.A.R.T. status

Every drive made in the last fifteen years reports S.M.A.R.T. data (drive health telemetry) to the operating system. Windows does not surface most of it by default. You have two ways to read it: a command-line one-liner or a third-party tool.

Open an elevated command prompt (right-click the Start button, pick “Terminal (Admin)” or “Command Prompt (Admin)”) and run:

wmic diskdrive get status

If it returns “OK” for every drive, your drive is not in immediate distress. The check is shallow. For the full telemetry, install CrystalDiskInfo (free, portable, does not write to the drive). Look for any attribute marked yellow or red. The five to watch are:

Reallocated sector count (bad blocks the drive has retired). Any non-zero value means the drive has already lost some capacity.
Current pending sector count (sectors the drive suspects are bad but has not retired yet). Non-zero is bad. The drive is actively struggling.
Uncorrectable sector count (sectors the drive tried and failed to recover). Non-zero is “back up today.”
Wear leveling count (SSD only, how close to the rated write endurance you are). Above 80% is the SSD’s polite way of saying “I have months, not years.”
Reallocated event count. Growth over time matters more than absolute value.

If any of these are bad, your next step is to back up, not to repair. Repairs on a failing drive make the failure worse, because the repair itself requires reads and writes.

The Windows error checking tool (the GUI path)

For a logical check on a drive that is mostly healthy, the built-in Error Checking tool works. Open File Explorer, right-click the drive you want to check, choose Properties, click the Tools tab, and click Check under “Error checking.” Windows 10 and 11 will either report no errors or offer a scan.

Two options matter:

“Automatically fix file system errors” repairs logical inconsistencies in the filesystem (the bookkeeping the OS keeps about which file is where). It is usually safe but requires the drive to be unlocked and not in use. If the drive is the system drive, Windows will schedule the check for the next restart.
“Scan for and attempt recovery of bad sectors” reads every sector and marks bad ones as unavailable. This takes hours on a large drive and the drive cannot be used during the scan. It does not write user data but it does write to the filesystem index.

The GUI path is fine for a quick scan. For anything serious, the command-line version of the same tool is better.

The command-line version: chkdsk

chkdsk (Check Disk, Windows’ command-line disk repair tool) is the same engine as the GUI tool but with finer control. The three flags you actually use:

chkdsk D: runs a read-only scan. Reports problems but does not fix them.
chkdsk D: /f fixes logical filesystem errors. Requires the drive to be locked. If the drive is the system drive, Windows schedules the check for next boot.
chkdsk D: /r does everything /f does plus scans every sector for bad blocks. This is the long one. On a 1TB HDD it takes six to ten hours. On an SSD it takes minutes because SSDs read everything in parallel.

Run them in order. Read-only scan first to see what is wrong. Logical fix second. Bad sector scan third. If the bad sector scan reports uncorrectable sectors, back up immediately and replace the drive. If the bad sector scan completes cleanly, the filesystem is consistent.

One pitfall: chkdsk /r on an SSD is mostly wasted time. SSDs have their own internal bad-block management that is invisible to chkdsk. If your S.M.A.R.T. data on the SSD is fine, skip /r and use the manufacturer’s diagnostic tool instead. Samsung Magician, Crucial Storage Executive, and Western Digital Dashboard all do a deeper SSD-specific check than chkdsk can.

What about third-party tools

For drives that are mostly healthy, third-party tools add little over chkdsk plus CrystalDiskInfo. For drives that are starting to fail, third-party recovery tools (TestDisk, PhotoRec, R-Studio) can sometimes pull data off a drive that Windows will not mount. The catch is that every read on a failing drive risks making the failure worse. The order of operations matters more than the tool:

Stop writing to the drive.
Image the whole drive to a known-good drive with ddrescue (a Linux tool, also available as a Windows port). This makes a bit-for-bit copy. The image is your working copy.
Run recovery on the image, not the original.

If the drive is the system drive and you cannot boot, pull the drive, put it in a USB enclosure on another computer, and image it from there.

When to stop and back up

The single most important rule: if S.M.A.R.T. shows any red attribute, back up before doing anything else. Repairs on a drive that is actively failing will accelerate the failure. The repair tool itself reads and writes.

A practical backup plan for a failing drive:

Use a tool that copies once and verifies (Robocopy with /mir plus a manual spot-check, or a dedicated imaging tool like Macrium Reflect Free).
Target an external drive you have verified works.
Copy the user data first (Documents, Pictures, Desktop, project folders). Skip Program Files because reinstalling apps is faster than backing them up.
Once the backup is verified (open a few files from the external drive), you can run repairs with less stress.

If the backup tool itself starts throwing read errors, the drive is past the repair stage. Pull the data with ddrescue or take it to a recovery service. Software cannot fix a drive that the OS cannot read.

What this misses

A few failure modes the tools above will not catch:

File-level corruption that the filesystem does not flag. If a photo opens but has random colored blocks in it, the file is corrupted but the filesystem is fine. The fix is the backup, not chkdsk.
Silent data decay on old drives. The bits flip slowly over years. The drive reports no errors, but the file you saved in 2019 is now subtly different from what you wrote. The only defense is a backup with periodic verification.
Controller failures on SSDs that look like drive failures. The flash is fine, the controller is not. The manufacturer diagnostic will catch this. chkdsk will not.
Drive firmware bugs. Rare but real. The manufacturer’s firmware update tool is the only fix.

The short version of the rule is: S.M.A.R.T. first, chkdsk second, backup always, manufacturer tool for SSDs, recovery service when the OS cannot see the drive.

Trade-offs

Triage is about ordering, not magic. A few real trade-offs to weigh:

Read-only scan vs immediate fix. The read-only scan (chkdsk D: with no flags) tells you what is wrong without changing anything. The fix (/f or /r) writes to the disk. On a healthy drive, the fix is safe. On a failing drive, every write risks more failures.
chkdsk vs manufacturer tool. chkdsk is generic. The manufacturer’s tool knows the specific SSD controller and can do deeper checks. The trade-off is portability vs depth.
DIY repair vs recovery service. A recovery service has clean rooms and specialized hardware. They charge $500 to $3000 and turn around in days to weeks. DIY with ddrescue is free and takes hours to days.
Backup now vs repair now. If the data is irreplaceable, the backup comes first, even if it stresses the drive further.
Replace vs repair. A drive with non-zero reallocated sectors is going to fail. The question is when. The trade-off is upfront cost vs deferral.
Format vs keep trying. If the filesystem is corrupt and chkdsk cannot fix it, you can format and start over. The data is gone but the drive may work for a while.

None of these have a single right answer. The right answer depends on how much the data matters and how much the drive matters. Triage is the part where you figure out which one you have more of.

Filed under: #bugs #development #office suite #privacy #productivity #reading