How to Use the fsutil Command in Windows 11 to Manage NTFS Volumes, Sparse Files, and USN Journals

Windows systems engineers, database administrators, and storage architects frequently require direct low-level control over the New Technology File System (NTFS) and Resilient File System (ReFS) engines. While graphical File Explorer properties display high-level volume metrics, specialized storage operations—such as querying sector allocation clusters, pre-allocating zeroed dummy files, creating sparse files with unallocated range blocks, managing the Update Sequence Number (USN) Change Journal, and inspecting the volume “dirty bit”—demand the native fsutil.exe utility. Operating in Windows 11 with administrative privileges, fsutil provides the definitive toolkit for auditing volume performance and fine-tuning filesystem behaviour.

Understanding the fsutil Architecture and Functional Subsystems

The fsutil executable directly communicates with the kernel filesystem filter driver (ntfs.sys). The table below delineates the primary command modules and their operational roles:

Command Module	Primary Technical Function	Administrative & Development Role
fsinfo	Queries low-level filesystem attributes, sectors, and drive types.	Auditing sector cluster sizes, 4K native alignment, and drive capability flags.
usn	Manages and queries the Update Sequence Number (USN) Change Journal.	Auditing file modifications, troubleshooting incremental backup engines.
sparse	Controls sparse file flags and defines unallocated byte ranges.	Optimising disk space for database images, virtual disks, and test mocks.
file	Finds files by SID, queries allocation ranges, and creates raw files.	Pre-allocating contiguous test files of arbitrary byte dimensions.
dirty	Queries or sets the volume dirty bit.	Forcing automatic Chkdsk filesystem scans during next operating system boot.
8dot3name	Controls legacy MS-DOS 8.3 short filename generation.	Disabling 8.3 naming to maximize NTFS directory traversal speed.

Querying Filesystem and Volume Telemetry with fsutil fsinfo

All filesystem tuning begins with establishing baseline cluster and partition characteristics. Launch an elevated Administrator Terminal to run these queries.

1. Listing All Available System Drives

To enumerate all mounted drive letters across the machine:

fsutil fsinfo drives

2. Inspecting Volume Cluster Geometry

To view sector dimensions, allocation cluster sizes, and volume features for drive C::

fsutil fsinfo volumeinfo C:

To inspect physical and logical sector reporting—crucial for verifying that modern Advanced Format 4K (4096-byte) SSDs are not misaligned:

fsutil fsinfo sectorinfo C:

Verify that PhysicalSectorSizeInBytes: 4096 and Alignment: Aligned on 4k boundary are confirmed.

Managing the USN Change Journal with fsutil usn

The NTFS USN Change Journal maintains a permanent log of all alterations introduced to files and directories on the volume. Backup software, search indexing services, and virus scanners parse this journal to identify altered files without scanning millions of files manually.

1. Querying Active USN Journal Metrics

To inspect the operational state, maximum byte allocation, and allocation delta of the active journal on volume C::

fsutil usn queryjournal C:

2. Reading Recent Journal Transaction Logs

To stream recent file creation, rename, and deletion events recorded in the journal:

fsutil usn readjournal C: csv

3. Recreating or Pruning the USN Journal

If the USN journal becomes corrupted or backup software throws journal-wrap errors, administrators can safely purge and re-initialize it:

# Delete the existing journal
fsutil usn deletejournal /d C:

# Create a fresh journal allocating 64 MB maximum size with an 8 MB delta
fsutil usn createjournal m=67108864 a=8388608 C:

Creating and Managing Sparse Files

Sparse files allow applications to allocate massive virtual file containers (e.g., a 100 GB virtual disk or database file) while consuming disk space strictly for sectors containing actual non-zero data. Unallocated regions are tracked as metadata, freeing physical storage.

1. Setting the Sparse Flag

First, create or identify a target file, then mark it with the NTFS sparse attribute:

# Create a test file
fsutil file createnew "C:\Storage\container.bin" 10737418240

# Mark the file as sparse
fsutil sparse setflag "C:\Storage\container.bin"

2. Zeroing and Freeing Allocated Ranges

To tell NTFS that a specific internal byte range consists entirely of zeroes and should be unallocated from disk:

fsutil sparse setrange "C:\Storage\container.bin" 0 5368709120

This command deallocates the first 5 GB of the file. While the file still reports 10 GB in File Explorer, its physical size-on-disk drops to 5 GB.

3. Querying Sparse Status

To verify whether a file is actively operating as a sparse file:

fsutil sparse queryflag "C:\Storage\container.bin"

Pre-Allocating Files and Managing the Dirty Bit

Beyond querying metadata, fsutil executes low-level disk manipulations useful for load testing and maintenance.

1. Rapid File Pre-Allocation

To instantly generate a dummy file of exact byte dimensions (for example, generating a 1 GB test file for network throughput benchmarking):

fsutil file createnew "C:\Tests\testfile_1GB.dat" 1073741824

Unlike standard write streams, fsutil allocates the disk pointers instantaneously without writing data payloads sequentially.

2. Querying and Setting the Volume Dirty Bit

When Windows detects unwritten cache data during an unexpected power cutoff, it sets the volume “dirty bit”, prompting an automatic Chkdsk repair pass upon next boot.

To inspect whether a volume is currently flagged as dirty:

fsutil dirty query C:

To manually flag a secondary drive as dirty to force a comprehensive filesystem check on next system startup:

fsutil dirty set D:

Tuning Performance: Disabling 8.3 Short Filenames

For backwards compatibility with 16-bit MS-DOS software, NTFS generates supplementary 8.3 filenames (e.g., PROGRA~1 for Program Files). In directories containing hundreds of thousands of files, generating these short names introduces measurable file creation latency.

To disable 8.3 filename generation across all NTFS volumes:

fsutil 8dot3name set 1

Value states:

• 0: Enables 8.3 name creation across all volumes.
• 1: Disables 8.3 name creation globally (recommended for maximum performance).
• 2: Configurable per volume.

Troubleshooting Common fsutil Execution Blockers

When operating low-level filesystem tools, keep the following operational caveats in mind:

• Error: Access is Denied: Nearly all fsutil verbs interact directly with the storage driver stack and require elevated privileges. Always ensure the console window title displays Administrator: Command Prompt or Administrator: Windows PowerShell.
• “The volume is currently in use” During Journal Deletion: If fsutil usn deletejournal fails, background enterprise search indexers or real-time antivirus engines are currently reading the journal stream. Temporarily pause the Windows Search service (net stop wsearch) and re-attempt the command.
• Sparse Files Expanding Unexpectedly During Copying: Standard legacy copy tools may write explicit zeroes when reading sparse ranges, converting the destination file into a fully allocated thick file. Always use robocopy /sparse to preserve sparse metadata across disk transfers.