Quick Answer

If your files disappeared after CHKDSK and a found.000 folder with FILE0001.CHK files appeared, CHKDSK broke corrupted file system chains and dumped the orphaned clusters into that folder. Stop writing to the disk immediately, then re-match the .CHK files using professional recovery software or an expert lab. Your data is usually still on the disk.

What CHKDSK Actually Does

CHKDSK (Check Disk) is the Windows tool that verifies file system consistency. It scans the logical structure of an NTFS or FAT32 volume: the Master File Table (MFT) records, the directory tree, the cluster allocation bitmap and the file chains. Its goal is not to recover data; its goal is to return the file system to a consistent state that Windows can reuse. That distinction is critical, because consistency and the integrity of your data are not always the same thing.

The parameters define the behavior:

Command What it does Risk
chkdsk D: Scans only, read-only report None
chkdsk D: /f Fixes logical errors found, writes to disk Medium
chkdsk D: /r /f + full surface scan, marks bad sectors, moves readable data High
chkdsk D: /f /x Force-dismounts the volume, then repairs High

Running chkdsk D: with no parameters is safe because it writes nothing. The danger begins with /f and /r.

Why It Sometimes Causes Data Loss

When CHKDSK finds a cluster that is marked allocated but cannot be traced back to any file in the MFT, it treats that cluster as orphaned (lost). To make the file system clean again, it cannot leave these clusters allocated but unlinked. Its solution: it re-links the cluster into a hidden system folder named FOUND.000 in the root of the volume, under names like FILE0001.CHK, FILE0002.CHK.

The problem is that CHKDSK does not know the original file name, extension or folder path. An Excel sheet, a family photo and a PDF all end up with the same meaningless .CHK extension, all gathered in a single FOUND.000 folder. Worse, on a physically failing disk, the CHKDSK /r surface scan forces repeated reads of already weak sectors, which can degrade the head or platter condition and put the remaining readable data at risk too.

In short, CHKDSK does not "delete" data, but it severs the file-to-directory link and turns the pieces into nameless blocks. From this point on the work becomes a classic data recovery effort.

What found.000 and .CHK Files Are, and How to Open Them

The FOUND.000 folder is hidden and has the system attribute by default. To see it, you must enable showing hidden and protected operating system files in File Explorer's View settings. The .CHK files inside are raw data blocks; the header information is usually intact, but there is no file-type label.

The recovery approach is file signature (magic number) analysis. Every file type begins with characteristic bytes:

File type Signature (hex start)
JPEG FF D8 FF
PNG 89 50 4E 47
PDF 25 50 44 46 (%PDF)
ZIP / DOCX / XLSX 50 4B 03 04 (PK)
MP4 00 00 00 .. 66 74 79 70

Tools that read these signatures (such as unCHK, CHK-Mate, or general carving tools) can restore the correct extension to .CHK files. If a single .CHK file maps to a single real file and the header is sound, this works fast. But with fragmented files, multiple pieces may be mixed inside one .CHK; automatic tools fall short here and manual sector analysis is needed.

Important warning: while doing this, never write the output to the same disk. We explained in detail why this is fatal in our article on writing recovery software to the same disk. Always save recovered files to a separate, healthy target disk.

When You Should NEVER Run CHKDSK

CHKDSK is a logical tool, designed only to resolve software-level inconsistencies in the file system. In the cases below, running CHKDSK does more harm than good:

If there are signs of physical failure

If the disk makes clicking, knocking or grinding noises, if it is detected and lost intermittently, or if SMART values are critical, the problem is mechanical. The CHKDSK /r surface scan will stubbornly attempt reads for hours on this disk and can finish off an already dying head, motor or platter. With such a disk, the only correct move is to power it off and take it to an expert.

If there are many bad sectors

If the surface has many unreadable sectors, CHKDSK /r increases the load on the disk while trying to read each one. In professional recovery these disks are first cloned sector by sector (imaged), and the work is then done on the copy. CHKDSK instead proceeds directly on the original disk, making irreversible changes.

If the disk shows as RAW

If the disk appears with a RAW file system and Windows wants to format it, the file system header structure (boot sector, MFT) is corrupted. CHKDSK often returns "CHKDSK is not available for RAW drives"; on the rare occasion it runs, it can corrupt the structure further. We covered this scenario end to end in our article my disk became RAW. Short answer: do not format a RAW disk, and do not run CHKDSK on it.

What to Do AFTER You Have Run CHKDSK

If you already ran the command, do not panic; most of your data is usually still recoverable. In order:

  1. Stop writing to the disk. Stop programs, downloads and automatic updates. Every new write endangers data that has not yet been overwritten, outside FOUND.000.
  2. Do not keep using that volume. If possible, safely eject the relevant drive or shut down the computer holding that disk.
  3. Copy the FOUND.000 folder as is. Copy the whole folder to another disk and back it up without altering the original.
  4. Make an image. Ideally extract a sector-level image of the entire disk to another disk and run recovery from the image.
  5. Scan with recovery software. Tools like TestDisk and PhotoRec both attempt to repair the file system structure and perform signature-based carving. Always write the output to a separate disk.
  6. Stop if you get no results. If a few attempts on critical data yield nothing, each extra attempt reduces your chances. Move to a professional service.

When Professional Service Is Essential

If the files are business-critical (accounting database, legal case files, production data), if the disk shows signs of physical failure, if it appears as RAW, or if the .CHK files are heavily fragmented, fighting with software usually makes things worse. In professional labs the disk is first cloned one-to-one with hardware imagers in a dust-free environment, and recovery is done on that copy so the original media is protected.

DSET has been providing digital forensics and data recovery services since 2003 at Ankara Hacettepe Teknokent, Beytepe, Çankaya. Our success rate in logical recovery after CHKDSK and formatting is 99.4%. We work on a free initial diagnosis, no data no fee basis. If the disk shows signs of physical failure, stop running the device and call us: +90 536 662 38 09.

Frequently Asked Questions (FAQ)

Does CHKDSK bring back the files it deleted? CHKDSK has no undo command. It cannot itself repair the file links it cut. But the data usually remains as .CHK inside FOUND.000 or as unallocated blocks on the disk; the right recovery software or an expert lab can bring them back.

Can I delete the FOUND.000 folder? Do not delete it before recovering your data. The .CHK files inside are the raw form of your lost files. First copy them to another disk and recover the files, then delete it once you are done.

How do I open a .CHK file? You cannot open it by double-clicking because it has no file-type label. You need a tool that reads the file signature to restore the correct extension (jpg, pdf, docx, etc.). If the header is sound the file opens; if fragmented, manual analysis is required.

Is running CHKDSK always dangerous? No. The parameterless chkdsk D: performs a read-only scan and is safe. Danger begins with /f and /r, especially on physically failing or RAW disks. On important data, do not use /f and /r without first making a backup or image.

I ran CHKDSK on a RAW disk, what should I do? Stop writing to the disk immediately and do not format it. CHKDSK usually does not run on RAW disks, and if it does it can corrupt the file system structure further. You should make a sector image and try recovery software, or go straight to a professional service.

Sources