A blue screen naming NTFS.SYS — usually with the stop code NTFS_FILE_SYSTEM (0x00000024) — means Windows’ filesystem driver crashed. NTFS.SYS is the translator between Windows and your drive’s file system; when the filesystem structures it reads are corrupt, or the drive feeds it garbage from bad sectors, the driver fails and takes the system down with it.

The reassuring part: this is a filesystem problem, not a file-deletion problem. Your documents, photos, and programs are still on the drive — the index pointing to them is damaged. The fixes below repair that index (chkdsk), the driver files (SFC), and the drivers that feed the filesystem (storage drivers), in that priority order. If the drive itself is dying, you’ll find out at the health check and can act before it’s too late. For the storage-driver side of this family, see NTFS errors after Windows 11 updates ; for the sibling storage blue screen, UNEXPECTED_STORE_EXCEPTION fixes .

Why this happens

  • Corrupt NTFS filesystem structures: Damaged Master File Table or index records — often from improper shutdowns or power loss.
  • Bad sectors on the drive: Physical defects in areas holding filesystem metadata crash the driver on read.
  • Failing SSD or hard drive: Deteriorating media corrupting filesystem data progressively.
  • Outdated storage drivers: Drivers mishandling I/O and feeding corrupt data to NTFS.SYS.
  • Corrupt NTFS.SYS or system files: Damaged driver files themselves.
  • Third-party disk tools: Defragmenters, partition managers, and encryption drivers interfering with filesystem operations.
  • RAM faults: Memory corruption of filesystem data cached in RAM.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Back up what you can, then run chkdsk

The primary repair for filesystem corruption.

  1. If Windows boots, copy critical files to external media or cloud storage now — do this before any repair touches the disk.
  2. Open Terminal (Admin) and run chkdsk C: /f /r. The /f fixes errors; the /r locates bad sectors and recovers readable data.
  3. Confirm the scan at next restart, reboot, and let it complete — it can take 1–3 hours on large drives. Don’t interrupt it.
  4. When Windows returns, check C:\found.000 for recovered fragments, then test the operations that crashed.

Fix 2: Check drive health with the manufacturer’s tool

Determine whether the drive is dying or just had a bad day.

  1. Identify your drive brand in Device Manager > Disk drives.
  2. Install the manufacturer’s tool (Samsung Magician, WD Dashboard, Crucial Storage Executive, Seagate SeaTools) and read SMART health.
  3. Reallocated/pending sectors, or health warnings = failing drive. Back up everything immediately and replace the drive — chkdsk can’t fix dying hardware.
  4. Healthy drive = the corruption was logical (power loss, bad shutdown). Continue with software fixes confidently.

Fix 3: Repair system files with SFC and DISM

Fix a corrupt NTFS.SYS driver file itself.

  1. Open Terminal (Admin).
  2. Run sfc /scannow — this restores a clean NTFS.SYS if yours is damaged.
  3. Run DISM /Online /Cleanup-Image /RestoreHealth to repair the component store.
  4. Restart and test. If SFC reported fixing corruption, retest before continuing — a damaged driver file explains crashes with no disk errors.

Fix 4: Update storage and chipset drivers

Stop drivers from feeding bad data to the filesystem.

  1. Download the latest chipset and storage drivers for your exact laptop model from Dell , HP , or Lenovo .
  2. In Device Manager, uninstall the current storage controller driver (Uninstall device, tick delete-driver if offered), restart, and install the manufacturer’s package.
  3. Update the SSD firmware via the manufacturer’s tool if an update is available.
  4. Restart and test the previously crashing operations.

Fix 5: Test in Safe Mode and remove disk utilities

Isolate third-party interference.

  1. Hold Shift > Restart > Troubleshoot > Advanced options > Startup Settings > Restart > press 4 for Safe Mode.
  2. If crashes stop in Safe Mode, a third-party program is involved — prime suspects: defragmenters, partition managers, disk encryption, “system optimizers.”
  3. Uninstall (don’t just disable) the suspect tools one at a time, restarting and testing after each.
  4. Keep only one disk utility if you need one, and make sure it’s current — old disk tools on new Windows builds are a classic NTFS.SYS trigger.

Fix 6: Run the memory diagnostic

RAM faults corrupt cached filesystem data.

  1. Win + R > mdsched.exe > Restart now and check for problems.
  2. Let the test complete. Errors = faulty RAM; reseat or replace.
  3. This matters because NTFS caches heavily in RAM — bad memory produces filesystem corruption symptoms with a healthy drive.
  4. If RAM passes and chkdsk found no bad sectors, the remaining suspects are drivers (Fix 4) and Windows files (Fix 3) — revisit whichever you skipped.

Fix 7: Disable Fast Startup and verify with an offline scan

Eliminate hybrid-shutdown filesystem state issues.

  1. Control Panel > Power Options > Choose what the power buttons do > Change settings that are currently unavailable > uncheck Turn on fast startup.
  2. Shut down fully (not restart), power on, and test for several days.
  3. For stubborn cases, run chkdsk offline from the Recovery Environment: boot to WinRE > Command Prompt > chkdsk D: /f /r (verify the Windows letter with diskpart > list vol).
  4. Check Microsoft’s support site for known NTFS issues with your Windows build as a final step.

Closing

NTFS.SYS crashes are the filesystem crying for help, and the help it needs is almost always chkdsk, a driver update, or — when the drive is dying — a replacement carried out before the data is gone. Work the list in order, take the drive-health check seriously, and back up early: the one outcome to avoid isn’t a blue screen, it’s discovering the drive was failing after it takes your files with it. If NTFS errors recur after a full repair, schedule a monthly chkdsk — recurring filesystem corruption is the drive telling you its retirement is near.

Frequently asked questions

What does the NTFS.SYS blue screen mean?
NTFS.SYS is Windows’ driver for the NTFS filesystem. A blue screen naming it (often with stop code NTFS_FILE_SYSTEM, 0x00000024) means the filesystem driver crashed — usually because the filesystem itself is corrupt, the drive is failing, or a driver corrupted filesystem data in memory. Your files are usually intact; the driver just can’t process the filesystem.
Will fixing NTFS.SYS delete my files?
No — every fix below (chkdsk, SFC, driver updates) repairs structures around your files without deleting them. chkdsk may move irrecoverably corrupt file fragments to found.000, but it doesn’t wipe the drive. Still, back up first if you can boot, because a failing drive — one possible cause — can deteriorate.
Can a failing hard drive cause NTFS.SYS errors?
Yes, it’s one of the leading causes. Bad sectors in filesystem metadata areas make NTFS.SYS crash when it tries to read them. Run chkdsk /r to map out bad sectors, and check the drive’s SMART health with the manufacturer’s tool. If bad sectors keep growing, replace the drive — it’s dying.
Why does NTFS.SYS crash only sometimes?
Intermittent crashes point at the specific data being accessed: the driver only crashes when it hits the corrupt filesystem region or bad sector. That’s why crashes cluster around certain folders, programs, or operations. chkdsk with the /r flag finds and quarantines those regions, which is why it fixes intermittent cases.