>_ Operating systems & Linux

Windows maintenance: sfc, DISM, chkdsk and recovery

Built-in tools for repairing Windows: sfc for system files, DISM for the image, chkdsk for the disk, Event Viewer, restore points and the WinRE tools.

When Windows starts throwing odd errors, freezing at boot or refusing updates, the temptation is to reinstall everything or to rely on «cleaning» programs downloaded from the internet. In most cases neither is needed. Windows already includes effective diagnostic and repair tools that work at different levels. The secret is to use them in the right order.

First of all: understand what is happening

Repairing blindly wastes time. Two tools help you understand the problem:

  • Event Viewer (eventvwr.msc): under Windows Logs > System, errors are marked in red, with date, source and code. A repeated error from the disk, a driver or a service tells you straight away where to look.
  • Reliability Monitor: found by searching for «View reliability history» in the Start menu. It shows a day-by-day chart of application crashes, Windows errors and installed updates. It is the quickest way to link the start of a problem to an update or a program installed that day.

sfc: system files

System File Checker compares Windows' protected files with reference copies and replaces any that are damaged or modified. It is run from a terminal opened as administrator:

sfc /scannow

The operation takes from a few minutes to a few dozen. At the end the message reports one of three outcomes: no integrity violations found, corrupt files found and repaired, or corrupt files found but not repairable. Details are in the file C:\Windows\Logs\CBS\CBS.log.

DISM: the system image

If sfc can't repair something, the problem may lie in the very reference copies it uses, that is, in Windows' component store. This is where DISM (Deployment Image Servicing and Management) comes in:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

The first command runs a quick check, the second a thorough scan, the third repairs by downloading the correct components from Windows Update. If the computer has no internet access, you can point to a Windows image of the same version as the source with the /Source option.

So the recommended order is: DISM /RestoreHealth first, then sfc /scannow again. In my work this sequence resolves a good share of stuck updates and system components that won't start.

chkdsk: the filesystem and the disk

If the symptoms involve files that won't open, unreadable folders or read errors, the problem may be in the filesystem. chkdsk checks and corrects the NTFS structure:

chkdsk C: /scan
chkdsk C: /f
chkdsk C: /r
  • /scan analyses the volume online, without needing a reboot;
  • /f fixes errors; on the system drive it is scheduled for the next restart;
  • /r also looks for bad sectors and tries to recover their data; it is much slower.

An important caution: if you suspect the disk is physically failing, because it makes noises, has become extremely slow or its SMART values report reallocated sectors, the first thing to do is copy the data, not run chkdsk /r, which puts the disk under heavy strain.

Restore points

System Restore periodically saves the state of system files, registry and drivers, usually before installations and updates. If a driver or program has caused problems, going back to the previous point is often the quickest route. Personal documents are not touched.

On many installations protection is switched off by default. It is worth checking: search for «Create a restore point», select the system drive and choose Configure to turn it on and reserve some space. A point created by hand before an important change takes a few seconds.

WinRE: when Windows won't start

If Windows doesn't boot, after a few failed attempts the Windows Recovery Environment (WinRE) appears automatically. You can also reach it from a working system by holding Shift while choosing Restart. The main options are:

Option Use
Startup Repair fixes the most common loading problems
Uninstall Updates removes the latest quality or feature update
System Restore goes back to a restore point
Startup Settings lets you enter Safe Mode
Command Prompt lets you use sfc, DISM and chkdsk offline

Safe Mode loads only essential drivers: if the problem disappears there, the culprit is almost certainly a driver or a program that runs at startup.

Last resort: reset

If nothing works, Reset this PC reinstalls Windows with the option to keep personal files, though it removes installed applications. Before doing it, you still need an up-to-date copy of your data and a note of your programs' licence keys.

A reasoned sequence

  1. Event Viewer and Reliability Monitor to understand.
  2. DISM /RestoreHealth, then sfc /scannow.
  3. chkdsk if there are signs of filesystem problems, after saving the data.
  4. Restore point or uninstalling the latest update.
  5. Reset only if everything else fails.

In short

  • Before repairing, Event Viewer and reliability history show where to look.
  • DISM repairs the component store, sfc the system files: in that order.
  • chkdsk fixes the filesystem, but with a failing disk save the data first.
  • Restore points must be switched on and created before important changes.
  • WinRE and Safe Mode let you act even when Windows won't start.
MM
Marco Marzaduri

Marco Marzaduri works in cybersecurity, digital forensics and web development. With degrees in computer science and psychology, he combines technical analysis with an understanding of the human factor.

Read also