System File Checker: Run sfc /scannow & analyze its logs in Windows 10/8/7

The System File Checker is a utility in Microsoft Windows located in  C:\Windows\System32 folder. This utility allows users to scan for and restore corrupt Windows system files. In this post, we will see how to run System File Checker and also see how to analyze System File Checker logs.

Run System File Checker

In Windows 10/8/7/Vista, the System File Checker is integrated with Windows Resource Protection, which protects registry keys and folders as well as critical system files. If any changes are detected to a protected system file, the modified file is restored from a cached copy located in the Windows folder itself.

So if at any point of time if you find that you have hacked some system files or maybe applied some tweaks or replaced system files, maybe while customizing your Windows, and you now find that your Windows is not working properly, you may want to consider running this utility first, before trying a System Restore. To do so, you will have to first open an elevated Command Prompt window.

To run the System File Checker in Windows 10/8/7, type cmd in Start search box. In the result, which appears, right-click on Command Prompt and select Run As Administrator.

Run sfc /scannow

In the command prompt window which opens, type sfc /scannow and hit Enter.

The System File Checker utility will run for a while and if any corruptions are found, replace them on re-boot.

Windows Resource Protection could not perform the requested Service or Start the Repair Service

In case you are unable to start the System File Checker, and you instead get the Windows Resource Protection Could Not Start the Repair Service error, you may want to check up if your Windows Modules Installer service has been disabled. To do so, type services.msc in Start search and hit Enter. The status of this service should be set to Manual.

Run System File Checker Offline or in Safe Mode or Boot Time

Simply boot into Safe Mode and follow the same procedure. System File Checker will run in Safe Mode too.

The /scanonce and /scanboot syntax have been discontinued after Windows XP and does not work on Windows 8 and later.

Follow this procedure if you want to run System File Checker in Safe Mode, Boot Time or Offline.

You can also use the sfc.exe program to help you troubleshoot crashes that occur in the user mode part of Windows 10, Windows 8.1, Windows 7 & Vista. These crashes may be related to missing or damaged operating system files. To do so, you may have to access the log files.

How to view the SFC log file

The System File Checker program writes the details of each verification operation and of each repair operation to the CBS.log file. Each System File Checker program entry in this file has an [SR] tag. The CBS.log file is located in the %windir%\Logs\CBS folder.

You can search for [SR] tags to help locate System File Checker program entries. To perform this kind of search and to redirect the results to a text file, follow these steps:

  • Click Start, type cmd in the Start Search box, right-click cmd in the Programs list, and then click Run as administrator;
  • Type findstr /c:”[SR]” %windir%\logs\cbs\cbs.log >sfcdetails.txt and hit Enter;
  • The sfcdetails.txt file includes the entries that are logged every time that the System File Checker program runs on the computer.

How to interpret the SFC log file entries

The System File Checker program verifies files in groups of 100. Therefore, there will be many groups of System File Checker program entries. Each entry has the following format: date time entry_type details. For more details on how to interpret, visit KB928228.