Dism says files are clean but sfc claims corrupt

Hello from NC,

I usually run sfc on a periodic basis..monthly or so. I tested out the MS offer to download and install the Feature update to Windows 10, version 21H1. Everything seemed to go OK but then I ran sfc. The claim was unrepairable corrupt files. I tried DISM /RestoreHealth but it too claimed it couldn't fix the image. Since I couldn't find a version 19043 I backed out the Feature update
which put me back to 19042 and Rufus located a matching copy and I mounted it. The commands I used were:
DISM /Online /Cleanup-Image /StartComponentCleanup
DISM /Online /Cleanup-Image /AnalyzeComponentStore and
DISM /Online /Cleanup-Image /RestoreHealth /source:N:sources\install.wim:6 /LimitAccess

Dism seemed happy so after a reboot I ran sfc which claimed it couldn't repair corrupt files. So now I have sfc saying 'dirty' and DISM saying 'clean'.

Anybody any ideas as to how to get sfc to agree with Dism? I looked at the log files that sfc produced and they were pristine with no complaints.

Thanks for any ideas, NCBillP

Hi NCBillP,


Please open a new thread.
In the new thread post results from this script:


Tuneup_plus_log.bat ─ Click here to go to the BSOD batch repository to download and run this batch file.

That's correct. The original findstr command returned zero hits. If I shortened the findstr to just [SR] we produced a file of 89972 bytes. The entire [SR] file consists only of repeated 3 CSI line entries. The only difference is the number of components line ... 100 except for last 2 triplets with 25 and zero.

PS C:\windows\logs\cbs> more SFCResults1.log
2021-10-10 13:15:43, Info CSI 00000006 [SR] Verifying 100 components
2021-10-10 13:15:43, Info CSI 00000007 [SR] Beginning Verify and Repair transaction
2021-10-10 13:15:44, Info CSI 00000008 [SR] Verify complete

The main info seems to be Warnings about Overlap Directory with security setting issues.

Bill

- - - Updated - - -

I cleaned the log files from \windows\logs\cbs and re-ran sfc. Here is the PowerShell output: Results 1 is for filtering only on "[SR]" while Results 2 used "[SR] Cannot repair member file" as a filter. When I ran DISM with Check, Scan, and Restore there were no warnings of corrupt files. Originally neither sfc nor Dism would run clean. I finally found a version (Using Rufus) that Dism accepted and I thought/hoped I was past the corrupt files problem. Pristine may be an overstatement since I'm not sure what the warnings mean.

Directory: C:\WINDOWS\logs\cbs


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 10/9/2021 9:02 AM 1036 FilterList.log
-a---- 10/10/2021 1:21 PM 89972 SFCResults1.Log
-a---- 10/10/2021 1:22 PM 0 SFCResults2.Log


PS C:\WINDOWS\logs\cbs> sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.
PS C:\WINDOWS\logs\cbs> dir


Directory: C:\WINDOWS\logs\cbs


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 10/10/2021 2:05 PM 1285 CBS.log
-a---- 10/9/2021 9:02 AM 1036 FilterList.log
-a---- 10/10/2021 1:21 PM 89972 SFCResults1.Log
-a---- 10/10/2021 1:22 PM 0 SFCResults2.Log


PS C:\WINDOWS\logs\cbs>

I'm puzzled as to why the two Microsoft utilities don't get the same result. My periodic run of sfc /scannow claimed it detected corrupted files that it couldn't fix. After locating a Dism acceptable Windows iso I ran Dism /Online /Cleanup-Image with /CheckHealth, /ScanHealth, and /RestoreHealth. All seemed to go well but sfc complains about corruption it can't fix. My system is running Windows 10 Pro Version 10.0.19042.1237. The iso I used for sources was claimed to be 19042 but is actually 19041. I ran Dism /RestoreHealth alright and Dism didn't complain about corrupt files.

Here are the results of running the Tuneup1.bat sequence as requested. I will save the logs if anyone needs them.

Thanks, Bill


###########################################################
# The following commands will be run in sequence. #
# They can take quite a while to run, be patient. #
###########################################################

sfc /scannow
dism /online /cleanup-image /scanhealth
dism /online /cleanup-image /restorehealth
sfc /scannow

chkdsk /scan


C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\WINDOWS\system32>dism /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.844

Image Version: 10.0.19042.1237

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.844

Image Version: 10.0.19042.1237

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
710912 file records processed.
File verification completed.
Phase duration (File record verification): 9.69 seconds.
13522 large file records processed.
Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.
Phase duration (Bad file record checking): 0.96 milliseconds.

Stage 2: Examining file name linkage ...
2876 reparse records processed.
987188 index entries processed.
Index verification completed.
Phase duration (Index verification): 15.52 seconds.
0 unindexed files scanned.
Phase duration (Orphan reconnection): 1.05 seconds.
0 unindexed files recovered to lost and found.
Phase duration (Orphan recovery to lost and found): 0.44 milliseconds.
2876 reparse records processed.
Phase duration (Reparse point and Object ID verification): 8.73 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
Phase duration (Security descriptor verification): 20.15 milliseconds.
138139 data files processed.
Phase duration (Data attribute verification): 0.41 milliseconds.
CHKDSK is verifying Usn Journal...
38372336 USN bytes processed.
Usn Journal verification completed.
Phase duration (USN journal verification): 133.76 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

316251700 KB total disk space.
152921548 KB in 347711 files.
353732 KB in 138140 indexes.
0 KB in bad sectors.
830172 KB in use by the system.
65536 KB occupied by the log file.
162146248 KB available on disk.

4096 bytes in each allocation unit.
79062925 total allocation units on disk.
40536562 allocation units available on disk.
Total duration: 26.44 seconds (26448 ms).

C:\WINDOWS\system32>Echo off
###################################################################################
# How to capture batch file data and post in your thread in the BSOD forum #
# #
# Batch files and instructions for use in BSOD debugging[Part Two-Four] #
# #
# Press [V] to visit the above web page for detailed instructions. #
# Press [C] to close this window. #
###################################################################################

My first attempt to fix the sfc corrupt file callout was to run Dism without specifying any Source. Dism failed calling out file not found as the reason. I then got into the version search world. After 'trying' a Feature update from MS (leaving me on 19043) my searches for an iso of that version found nada. I backed out the update and found (via Rufus) what was claimed to be 19042 which matched the version of my install. Anyway the Dism series all ran with no complaints. I rebooted and tried sfc again which couldn't fix the corrupt files it found. My system seems to work OK with a few small issues. It keeps complaining about my Microsoft account and accepts my 4 digit startup code but complains again shortly thereafter. Annoying but livable. My biggest concern is with possible security issues that could be logging keystrokes or cloning email. I'm in no hurry to jump on 11 but maybe a 10 major update will fix this mess. Logically, sfc and Dism should verify the system files against the same database but I'm puzzled as to how they come up with different answers. Inspection of the CBS.log shows some anomalies but no errors. Filtering out the [SR] log lines yields nothing but 3 step verification documentation for a multitude of files. Eg:
2021-10-10 14:54:32, Info CSI 00000005 CSI Store 1916062445792 initialized
2021-10-10 14:54:34, Info CSI 00000006 [SR] Verifying 100 components
2021-10-10 14:54:34, Info CSI 00000007 [SR] Beginning Verify and Repair transaction
2021-10-10 14:54:34, Info CSI 00000008 [SR] Verify complete

Lines 6,7, and 8 repeat until finished. SFC doesn't report any errors unless the warnings are causing the command to show it's unhappiness.

Regard, Bill

The 'not found' condition was happening over a week ago. Since then I have run Dism check, scan, and restore with no problem. sfc however, still thinks there are corrupt files it can't fix. After downloading the iso (Rufus claimed 19042 but the file indicates 19041) and removing the last 'Feature' update my system is at 19042. Dism was happy using the 19041 iso for /Source on a restore run with /LimitAccess and since then all 3 Dism normal runs (check, scan, restore) run with no problems without using the downloaded iso. If it's important I think I have a clone of the Windows partition that I could put up and try and recreate the missing file.