Checking and Repairing an NTFS Drive on a Mac, Without First Aid

First Aid cannot see NTFS at all

First Aid and the fsck tool underneath it understand APFS, HFS+, FAT32 and exFAT. Apple's own documentation lists NTFS as unsupported, so running First Aid on an NTFS volume finishes without examining much of anything. Real checking needs a tool that parses NTFS on-disk structures.

The four failures we actually see

• A dirty bit left by an unsafe eject or a power cut. The volume was not unmounted cleanly, so macOS mounts it read-only or declines to mount it, and in most cases the files themselves are intact;
• A volume Windows left hibernated, usually because Fast Startup is on. Nothing should mount it writable until Windows releases its hold;
• Unreplayed $LogFile transactions. The NTFS journal holds operations that never committed, and a mount has to replay the journal before it can trust the directory;
• Structural damage to MFT records or indexes. Files and folders go missing or refuse to open. This is the rarest case and the one that matters most.

ntfsfix clears a flag rather than repairing

Forums often point to ntfsfix, which ships with ntfs-3g. Its own manual says it is not a Linux chkdsk. The tool clears the dirty bit, resets the journal and thereby drops uncommitted transactions, then schedules a Windows chkdsk for the next boot. It never walks the MFT, the indexes or the security descriptors. A cleared dirty flag and a repaired volume are different things.

Four read-only passes, then a graded report

DiskBee's check does not write to the volume while it runs. It walks the Master File Table, validates runlist geometry and cross-linked clusters, reconciles the $Bitmap allocation map against actual usage, then cross-checks directory indexes. A 1 TB drive takes about nine minutes.

The output is a report per pass rather than a spinner: what was examined, what came back clean, and which category each finding belongs to. This check sits in the free tier, so diagnosis costs nothing.

Repair limited to what can be proven

Repair is a Pro feature in the website download edition, and it stays narrow on purpose. It handles leaked or lost clusters, the dirty-bit state, and torn-write update sequence array records. A plan appears for confirmation before a single byte is written.

Torn-write recovery is where the approach differs most from chkdsk. When a power cut leaves an update sequence array mismatch, DiskBee rebuilds the record and keeps it. Many tools delete the record instead, and the data goes with it.

The refusals matter as much. Damage beyond those categories, such as corrupt MFT entries or broken indexes, is reported as such with a pointer to Windows chkdsk. A clear no is more useful than a repair that was never real.

Cases that only Windows chkdsk can settle

`chkdsk /f` on Windows, or `/r` when bad sectors are suspected, remains the authoritative full repair for NTFS. It can rebuild MFT entries, indexes and security descriptors that no Mac-side tool touches. If the report says to go there, run `chkdsk X: /f` from an administrator command prompt on any Windows PC.

One limit worth stating: this is a logical, file-system-level check. It does not read SMART attributes and does not scan the platter for bad sectors. Clicking noises or disconnects across several computers point to hardware, and the drive vendor's diagnostics are the right tool for that.

Three tiers, and one rule about claims

On a Mac, repairing NTFS splits into understanding what broke, fixing the part that is provably safe, and handing the remainder to Windows. A tool that promises to fix everything with one button is telling you it does not know what broke.