0x00000024: Safest Fixes Before You Run CHKDSK First

0x00000024 is the NTFS_FILE_SYSTEM bug check, and Microsoft documents that it indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives. If Windows still starts, copy files to another drive before any repair that writes to disk. If recovery media sees the volume, use offline checks there. If recovery media cannot see the disk, check the storage path before filesystem repair. If the drive reports bad SMART health, disappears, or clicks, image or clone it before trying repairs. This guide gives a boot-time decision tree, recovery steps for Windows 7 through 11, and clear stop points for imaging, chkdsk, and hardware replacement, using Microsoft guidance for NTFS, Event Viewer, storage diagnostics, and Recovery Console where noted.

This guide is part of our Windows BSOD stop codes: full list and fixes series.

Triage first: which recovery path fits your case?

One-page checklist

Sort the machine into one of three cases first. That decision matters more than the first command you type. 0x00000024 can show up with different parameter values on the blue screen, and the safest next step depends on whether Windows boots, recovery media can see the NTFS volume, or the disk is missing entirely. Microsoft documents bug check 0x24: NTFS_FILE_SYSTEM as a failure in the NTFS file system driver path, and that lines up with the branch logic below. (neosmart.net)

Decision path

1. If Windows still starts, copy files to another drive before any repair that writes to disk.
2. If Windows will not start but recovery media sees the volume, use offline checks there.
3. If recovery media boots but cannot see the disk, treat it as a hardware or controller path first, not a simple NTFS cleanup job.
4. If the drive clicks, disappears, or reports bad SMART health, image or clone it before trying repairs.

For a fuller startup flow, compare this with our Windows boot repair guide before changing firmware settings or running repeated boot attempts.

Decision matrix: image first, run chkdsk, or replace the drive?

Use this matrix to make one call and stick to it. Microsoft’s bug check documentation says disk corruption is one possible cause of this stop code, and that corruption in the NTFS file system or bad blocks on the hard disk can induce it. Microsoft also notes that corrupted hard drive (SATA/IDE) drivers can adversely affect the system’s ability to read and write to disk. That is why the first choice is whether the disk path looks stable enough for repair.

If you need help interpreting SMART details before you choose, use our disk health and SMART warning signs guide. If the disk is already unstable and your priority is getting files back, go straight to our data recovery options page.

What usually causes 0x00000024?

Common causes include NTFS file system corruption, bad blocks on the hard disk, disk corruption, and corrupted hard drive (SATA/IDE) drivers. Microsoft lists those directly in its bug check documentation. Software that continually monitors the system, such as antivirus scanners, backup programs, or disk defragmenter tools, can also be part of the problem because Microsoft advises disabling them during troubleshooting.

Likely causes ranked from most to least likely

1. NTFS metadata damage after interruption. Sudden shutdowns can leave file system structures half-written, which fits a startup blue screen well.
2. Disk trouble or bad sectors. Microsoft’s bug check notes make disk corruption and bad blocks part of the core suspect list.
3. Storage path faults. A loose SATA cable, bad port, or damaged storage driver can make a healthy file system look broken long enough to crash boot.
4. ntfs.sys involvement. The blue screen may name ntfs.sys, the Windows NTFS file system driver used to read and write NTFS partitions. That tells you where the crash was caught, not automatically what started it.
5. Software interference. Filter drivers from antivirus, backup, and disk utilities can be part of the chain, especially if the stop code appears only in normal boot and not Safe Mode.
6. RAM faults. Memory problems are possible, but storage and file system checks usually come first for this stop code.

Can Safe Mode or Last Known Good fix 0x00000024?

Sometimes. Safe Mode is worth one clean test because it strips startup down to core drivers and skips a lot of third-party filter drivers, which can tell you fast if the crash is tied to software loaded during a normal boot. Last Known Good Configuration is still worth trying on older Windows versions. But if the NTFS volume is badly damaged, both options often fail with the same stop code and should not delay offline recovery work.

Try the low-risk startup options first

1. Safe Mode: On Windows 10 or 11, hold Shift while selecting Restart from the sign-in screen, then go to Troubleshoot > Advanced options > Startup Settings > Restart > 4) Enable Safe Mode. On older systems, use F8 during startup. That path matches Microsoft’s Windows Recovery Environment and Startup Settings documentation. (businessinsider.com) (Microsoft Learn)
2. If Safe Mode works, copy data off the system drive first. Then open Event Viewer > Windows Logs > System and look for disk, NTFS, controller reset, or bad block errors. Microsoft support guidance for stop errors specifically points you to the System log.
3. Last Known Good Configuration: On Windows XP, Vista, and some Windows 7 systems, press F8 and choose Last Known Good Configuration. It may still fail if the same volume damage is present.
4. If both fail, move to recovery media instead of looping restarts.

How do I repair NTFS corruption without risking more data?

The safe answer is to decide first whether the disk should be imaged, then repair offline from recovery media. Use the scan disk utility to confirm that there are no file system errors, as Microsoft advises. Microsoft also advises disabling virus scanners, backup programs, or disk defragmenter tools that continually monitor the system.

When in-place repair is reasonable

1. Use in-place repair if the drive is detected consistently in BIOS or UEFI and recovery media.
2. Back up user files first if Windows or Safe Mode still loads.
3. Disable third-party antivirus, backup agents, or disk tools before the next normal boot if the system becomes bootable, because filter drivers can complicate storage troubleshooting.

When to image first

1. Image or clone before repair if SMART warns, the disk vanishes between boots, or the drive clicks.
2. Do not keep rerunning chkdsk on a physically unstable disk. Every extra read can make recovery harder.
3. Recover files from the image if possible, then repair the copy or replace the original drive.

How to run chkdsk from recovery media

1. Boot from Windows installation DVD or USB recovery media. Older systems may need a Windows installation CD or DVD; newer Windows 10 and 11 systems usually use USB media.
2. On Windows 10 or 11, choose Repair your computer > Troubleshoot > Advanced options > Command Prompt. That is the Microsoft-documented Windows Recovery Environment path.
3. On Windows XP, insert the CD, restart, and at Welcome to Setup press R to open Recovery Console, then sign in to the Windows installation. This sequence was reported by bleepingcomputer.com for Windows XP Home and Professional.
4. Run chkdsk C: /f first if the drive is stable.
5. If the volume may be locked, use the recovery environment so the system volume can be checked offline.
6. Use chkdsk C: /r only when you need a sector check and the drive is not showing hardware red flags. For Windows XP, using chkdsk /r from Recovery Console was reported by bleepingcomputer.com.
7. If Windows later boots, run sfc /scannow from an elevated Command Prompt.

How to read the result

1. If chkdsk reports file system fixes and the machine boots once, copy data immediately.
2. If it finds bad sectors or hangs for long periods on read errors, stop repeated repair attempts and move to imaging or replacement.
3. If the stop code returns after a clean run, check the cable, controller path, and disk health next.

Lab-tested example

A common pattern is a Windows system that crashes after a forced shutdown and then blue-screens at boot with NTFS_FILE_SYSTEM. Safe Mode may fail the same way. In recovery media, the deciding questions are whether the system volume is visible, whether the drive is detected consistently, and whether Event Viewer previously logged NTFS errors or storage-related errors.

If the disk is visible and the storage path looks stable, chkdsk C: /f is the lower-risk first repair. If recovery media cannot see the disk, or if the drive disappears, clicks, or reports bad SMART health, stop repair attempts and image or replace the drive first.

Why does 0x00000024 happen after a sudden shutdown or power loss?

Because NTFS metadata writes can be interrupted mid-update. The next boot then hits structures that no longer agree with each other, and the crash happens before normal startup completes. That is why a machine that was fine yesterday can fail right after a hard power-off or drained battery.