The Hidden Core of Windows Storage
Most Windows users interact with their hard drives through File Explorer—right-clicking to format a drive, viewing its properties to check free space, or using the built-in Disk Cleanup tool. However, beneath this graphical layer lies a highly complex NTFS (New Technology File System) architecture that governs how every single byte of data is stored, indexed, and protected.
When system administrators or forensic IT professionals need to query the deepest levels of this architecture—or change fundamental behaviors of the file system itself—they bypass the GUI entirely and use the fsutil (File System Utility) command.
This powerful command-line tool allows you to perform advanced tasks such as managing hard links, viewing the NTFS master file table, querying sparse files, and enabling or disabling critical file system features.
Step 1: Opening an Elevated Command Prompt
Because fsutil can change core operating system behaviors and query low-level hardware structures, almost all of its commands require Administrator privileges.
- Click the Start button and type
cmd. - Right-click on Command Prompt.
- Select Run as administrator.
Step 2: Checking if TRIM is Enabled for Your SSD
One of the most practical uses of fsutil is verifying the health and performance settings of your Solid State Drive (SSD).
SSDs rely on a command called “TRIM” to tell the drive which blocks of data are no longer considered in use and can be wiped internally. If TRIM is disabled, your SSD will become progressively slower over time as it struggles to overwrite old data.
To check if Windows 11 is actively sending TRIM commands, run:
fsutil behavior query DisableDeleteNotify
Understanding the Output:
- If the result is
DisableDeleteNotify = 0, TRIM is ENABLED and working correctly (Zero means “do not disable”). - If the result is
DisableDeleteNotify = 1, TRIM is DISABLED, which is very bad for your SSD.
If it is disabled (1), you can force Windows to turn it back on with this command:
fsutil behavior set DisableDeleteNotify 0
Step 3: Creating Instant Dummy Files
Network engineers and software developers frequently need to test transfer speeds, script behaviors, or disk quotas. To do this, they need a “dummy file” of an exact specific size (e.g., exactly 1 Gigabyte).
Downloading a 1GB file from the internet is slow. Using fsutil, you can instruct the file system to instantly allocate a chunk of space and label it as a file, creating a massive file in milliseconds.
The syntax requires the size in bytes (1 GB = 1073741824 bytes).
fsutil file createnew C:\Temp\testfile.bin 1073741824
Windows will instantly create a file named testfile.bin in the Temp folder that is exactly 1GB in size, filled entirely with zeroes.
Step 4: Checking a Drive for Dirty Bits
If your computer loses power unexpectedly, the NTFS file system might be interrupted in the middle of writing data. When this happens, Windows marks the drive volume as “dirty.”
When a drive is marked dirty, Windows will automatically force a chkdsk scan on the next reboot. If you are experiencing unexplained long boot times where Windows insists on scanning your C: drive every single morning, you can check if the volume is currently flagged as dirty.
fsutil dirty query C:
The output will simply tell you: Volume – C: is Dirty or Volume – C: is NOT Dirty.
Step 5: Disabling 8.3 Short Name Generation
Decades ago, older operating systems (like MS-DOS and Windows 3.1) could only read file names that were a maximum of 8 characters long, plus a 3-character extension (e.g., DOCUMENT.TXT).
To maintain backwards compatibility with 30-year-old software, modern Windows still automatically generates a hidden “8.3 short name” for every single file and folder you create that has a long name.
If you have a folder with 500,000 files in it, Windows is wasting processing power generating 500,000 useless short names. You can improve file system performance on modern drives by disabling this legacy feature.
To check the current status:
fsutil 8dot3name query C:
To disable the creation of these legacy names on all volumes, run:
fsutil 8dot3name set 1
(Note: Only do this if you are absolutely certain you do not run any ancient legacy software from the 1990s).