In chkdsk, what is an online scan?

Question

Running Windows 8.0 Pro, chkdsk has a /scan option that Runs a online scan on the volume (sic). What is an online scan?

My guess is that it runs it while letting you use the drive, which is good if it's your c: drive.

Here's the full options:

CHKDSK [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/L[:size]] [/B]
[/scan] [/spotfix]


  volume              Specifies the drive letter (followed by a colon),
                      mount point, or volume name.
  filename            FAT/FAT32 only: Specifies the files to check for
                      fragmentation.
  /F                  Fixes errors on the disk.
  /V                  On FAT/FAT32: Displays the full path and name of every
                      file on the disk.
                      On NTFS: Displays cleanup messages if any.
  /R                  Locates bad sectors and recovers readable information
                      (implies /F, when /scan not specified).
  /L:size             NTFS only:  Changes the log file size to the specified
                      number of kilobytes.  If size is not specified, displays
                      current size.
  /X                  Forces the volume to dismount first if necessary.
                      All opened handles to the volume would then be invalid
                      (implies /F).
  /I                  NTFS only: Performs a less vigorous check of index
                      entries.
  /C                  NTFS only: Skips checking of cycles within the folder
                      structure.
  /B                  NTFS only: Re-evaluates bad clusters on the volume
                      (implies /R)
  /scan               NTFS only: Runs a online scan on the volume
  /forceofflinefix    NTFS only: (Must be used with "/scan")
                      Bypass all online repair; all defects found
                      are queued for offline repair (i.e. "chkdsk /spotfix").
  /perf               NTFS only: (Must be used with "/scan")
                      Uses more system resources to complete a scan as fast as
                      possible. This may have a negative performance impact on
                      other tasks running on the system.
  /spotfix            NTFS only: Runs spot fixing on the volume
  /sdcleanup          NTFS only: Garbage collect unneeded security descriptor
                      data (implies /F).
  /offlinescanandfix  Runs an offline scan and fix on the volume.

The /I or /C switch reduces the amount of time required to run Chkdsk by
skipping certain checks of the volume.

Answer 1

An offline scan is done by dismounting the volume to fix file system corruption and bring the volume back to a healthy state. Generally it is only possible with non-system volumes, and system volumes (with the dirty bit set) are scanned during boot-up before the OS is up and running completely.

Self-healing is a feature built into NTFS that fixes certain classes of corruptions encountered during normal operation, and can make these fixes while the volume is still online. If all issues that are detected are self-healed online then obviously there is no need for an offline repair. In Windows 8 the number of issues that can be handled online has been increased and hence the need for running an offline scan using chkdsk is further reduced. All this is part of the new NTFS health model:

You can also run an on-demand online scan with chkdsk /scan to identify and spot-fix file system corruption, although for major problems a full offline scan is still required.

_{Source: Redesigning chkdsk and the new NTFS health model}

Answer 2

If you ask it to scan and fix files while the operating system is running it will try with all iof its heart and informative advisory pop up messages to convince you to scan 'n fix the very next time you boot the computer instead of now. That piece of advisiory code probably means business and it wont let you run a big scan or fix even one randomly selected file without command line or other termiinal commands and some identification that proves you are an administrator who outranks that piece of code. That is most likely in your own best interest because there is some risk doing very deep scans for broken and lost files, there is a very big risk of trying to fix broken pieces of an operating system and uits file system while its running. Its the same basic reason that almost noboy who is both sane and competitive plays Jenga while standing on a paint shaker. If the files are bad and you want them returned to a state that can be found read and written then scan and fix offline. Even if they are all fine and plowing through the files with scandisk and chkdsk or any other blunt brutal and automatic fixer, then t will take MUCH less time if the file fixer is running before the OS boots. On a big hard disk with reasonably sloppy filing and some troubles to fix it could take an hour or two longer with the OS running. By running it means that chkdsk might give you enough resources to play play spider solitaire slow and balking. Or perhaps start a web browser enough to lock the screens and cursors until the scans and fixes are done. It really is better offline.