ntfs.sys: Windows' NTFS Driver on a Blue Screen

Why a blue screen names ntfs.sys

• Corruption in the NTFS file system.
• Bad blocks (sectors) on the disk.
• Corrupted hard drive (SATA/IDE) drivers.
• Microsoft's steps also name virus scanners, backup programs and disk defragmenter tools that continually monitor the system.

What to do when a blue screen names ntfs.sys

The steps come from Microsoft's guidance, with the reversible ones first. Each one says how to put back what it changed. If Windows cannot start normally, Microsoft's basic steps say to start in safe mode and continue from there.

1. 01

   Write down the stop code and the file the screen names

   Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running. If the screen went by too fast, the command under Check it yourself lists the stop codes Windows recorded, and Event Viewer > Windows Logs > System shows the errors logged around the restart.

   To undo: Nothing to undo: this only reads information.

2. 02

   Back up what matters first

   Microsoft's first cause is disk corruption or bad sectors. Copy important files to another drive before running any repair.

   To undo: Nothing to undo.

3. 03

   Before you change anything: note the driver and make a restore point

   Open the device's Properties > Driver tab and write down the driver provider, date and version. Then select Start, type Create a restore point, open it, and on the System Protection tab choose Create. Microsoft notes that System Protection is not turned on by default; if Create is greyed out, choose Configure and turn it on for the system drive first.

   To undo: A restore point changes nothing by itself. To go back later, run System Restore and pick it: Microsoft says it reverts system files, the registry and installed programs, and leaves your personal files alone.

4. 04

   Check the drive for file system errors

   Microsoft's step: in File Explorer, right-click the drive, choose Properties, open the Tools tab and use the error-checking button. For a corrupted NTFS volume Microsoft's command is chkdsk /f /r from an administrator Command Prompt; on the system drive the scan starts after a restart.

   To undo: A disk repair cannot be undone, which is why the backup comes first.

5. 05

   Make sure the drive has free space

   Microsoft says to confirm there is sufficient free space, and that 10% to 15% free is normally a good idea.

   To undo: Nothing to undo.

6. 06

   Pause tools that watch the disk all the time

   Microsoft suggests disabling virus scanners, backup programs and disk defragmenter tools that continually monitor the system, as a test.

   To undo: Turn them back on after the test, the virus scanner first.

7. 07

   Check Windows' own files

   ntfs.sys is part of Windows, so there is no separate download for it. Open Command Prompt as administrator and run DISM.exe /Online /Cleanup-image /Restorehealth, then sfc /scannow. Microsoft says to run DISM first, and that sfc scans all protected system files and replaces corrupted ones with a cached copy.

   To undo: No undo is needed: the tools only put back Microsoft's version of a damaged Windows file.

8. 08

   Update the storage controller's driver

   Microsoft lists corrupted hard drive drivers among the causes. In Device Manager, open Storage controllers, right-click the controller and choose Update driver, or install the current storage driver from the PC or motherboard maker's support page.

   To undo: Open the device's Properties > Driver tab in Device Manager and choose Roll Back Driver, or apply the restore point.

Check it yourself

1. 01

   See whether a driver on your PC is running from this file (PowerShell)

   Shows the driver service that loads the file, whether it is running and its exact path. No output means no driver service on your PC points at this file. Nothing is changed.

   Get-CimInstance Win32_SystemDriver | Where-Object PathName -like '*\ntfs.sys' |
     Format-List Name, State, StartMode, PathName

   PowerShellCopy
2. 02

   Read the company and version from the file itself

   Every copy on the PC is listed, including copies waiting in the driver store.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter ntfs.sys -ErrorAction SilentlyContinue |
     ForEach-Object { $_.VersionInfo } | Format-List FileName, CompanyName, FileDescription, FileVersion

   PowerShellCopy
3. 03

   Check the signature

   Status should be Valid. The table above shows who signed the file on the test PC.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter ntfs.sys -ErrorAction SilentlyContinue |
     Get-AuthenticodeSignature | Format-List Path, Status, SignerCertificate

   PowerShellCopy