1. Chkdsk.exe is the command-line interface which verifies the logical integrity of a file system, [Q314835].
? When running CHKDSK and logical inconsistencies are encountered in file system data, it performs repair actions (assuming that the data is not in read-only mode).
? When running it online, the code that actually performs the verification resides in utility DLLs (Untfs.dll and Ufat.dll). The verification routines that it invokes are the same routines that run when a volume is verified through the Windows Explorer or the Disk Management Graphical User Interface.
a. If an error is encountered which causes a system to shutdown prematurely, CHKDSK is scheduled during the next boot and calls Autochk.exe which is run early in the startup sequence, runs without the benefit of virtual memory use, and is run when CHKDSK is used on the boot volume. CHKDSK cannot dismount the boot volume so it offers the option to run the repair process by using Autochk when the computer is restarted, [Q831426].
b. Chkdsk requires Autochk. Chkdsk automatically looks for Autochk.exe in the startup folder. If Chkdsk cannot find the file in the startup folder it looks for the Windows media CD-ROM. If Chkdsk cannot find the installation CD-ROM, Chkdsk prompts the user for the location of Autochk.exe, [Q307654]. Also note, CHKDSK can be initiated using the Recovery Console.
c. When Autochk runs against a volume at boot time it records its output to a file called Bootex.log in the root of the volume being checked. The Winlogon service then moves the contents of each Bootex.log file to the Application Event log. One event log message for each volume checked is recorded as follows:
Event ID: 1001
Description: This includes file system type; drive letter or GUID, and volume name or serial number to help determine what volume Chkdsk ran against. Also included is whether Chkdsk ran because a user scheduled it or because the dirty bit was set.
? Chkdsk without parameters - it runs in read-only mode, examines a disk, and then reports whether it found any file system errors but does not repair anything.
? Chkdsk with parameters - parameters /f or /r errors are repairs relating to the file system structure.
d. How to View Event Details To view the details of an event, follow these steps:
 Click Start,Control Panel and click Performance and Maintenance. Click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in eventvwr.msc using Start, Run.
 In the console tree, expand Event Viewer, and then click the log that contains the event that you want to view.
In the details pane, double-click the event that you want to view.
? The Event Properties dialog box containing header information and a description of the event is displayed.
? To copy the details of the event, click the Copy button, then open a new document in the program in which you want to paste the event (for example, Microsoft Word), and then click Paste on the Edit menu.
e. In addition to using the command-line version of CHKDSK, it can be run from My Computer/Explorer but the graphical version offers the read-only mode equivalent where CHKDSK will run to completion only if no significant corruption exist and no correction is made, [Q315265]. And for your information and for what it is worth, be aware of the contents of this article even though it does not mention WinXP, "Err Msg: CHKDSK Detected Minor Inconsistencies on the Drive... (Q109524)."
f. Supplemental reading:
(1) "Chkdsk Runs Each Time That You Start Computer After Upgrade to Windows XP (Q316506)."
Note: In addition to these instructions the same type of anomaly may occur should the Bootex.log file becomes corrupted - the file Autochk records its output in the root of the volume being checked and which the Winlogon service then moves to the Application Event log. Use the [Recovery Console], a special command prompt with its own command interpreter that requres the local Administrator password to fix it. For a list of commands that are available in Recovery Console, type recovery console commands or help at the command prompt, and then press ENTER. Use the command Chkdsk /p to fix the dirty bit and file corruption.
(2) "Stop 0x000000ED Error Message When Volume on IDE Drive with Caching Enabled Is Mounted (Q315403)."
2. For correct verification a volume must be static and the only way to guarantee a static state is to lock the volume. CHKDSK locks the volume only if you specify the /F switch (or the /R switch which implies /F), [User Action].