System File Checker

Infobox Software
name = System File Checker



caption =
collapsible =
author =
developer = Microsoft
released =
latest release version =
latest release date =
latest preview version =
latest preview date =
frequently updated =
programming language =
operating system = Microsoft Windows
platform =
size =
language =
status =
genre = Security software
license = MS-EULA
website = [http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/system_file_checker.mspx Microsoft SFC Documentation]

System File Checker is a utility in Microsoft Windows that allows users to scan for and restore corruptions in Windows system files. This utility is available on Windows 98, Windows 2000, Windows XP, Windows Server 2003, Windows Vista although in the Windows NT family of operating systems, it scans files using Windows File Protection.

In Windows Vista, System File Checker is integrated with Windows Resource Protection, which protects registry keys and folders as well as critical system files. Under Windows Vista, Sfc.exe can be used to check specific folder paths, including the Windows folder and the boot folder.

Windows File Protection worked by registering for notification of file changes in Winlogon. If any changes were detected to a protected system file, the modified file was restored from a cached copy located in a compressed folder at %WinDir%System32dllcache. In Windows Vista, Windows Resource Protection works by setting discretionary access control lists (DACLs) and access control lists (ACLs) defined for protected resources. Permission for full access to modify WRP-protected resources is restricted to the processes using the "Windows Modules Installer service" (TrustedInstaller.exe). Administrators no longer have full rights to system files.

History

Due to problems with Windows applications being able to overwrite system files in Windows 95, Microsoft has since implemented a number of security measures to protect system files from malicious attacks, corruptions, or problems such as DLL hell.

s; therefore, no preventive or reactive measure was available.

All Windows NT-based operating systems since Windows 2000 introduced real-time file protection, called Windows File Protection (WFP). [cite web
publisher=Microsoft
date=2003-12-15
work=Help and Support
title=Description of the Windows File Protection Feature
url=http://support.microsoft.com/kb/222193/
accessdate=2006-08-28]

In addition, the System File Checker utility (sfc.exe) was reimplemented as a more robust command-line utility that integrated with Windows File Protection. Unlike the Windows 98 SFC utility, the new utility forces a scan of protected system files using Windows File Protection and allows the immediate silent restoration of system files from the "DLLCache" folder or installation media.

In Windows Me, System File Checker was replaced with System File Protection (SFP). [cite web
publisher=Microsoft
date=2001-12-04
title=System File Protection and Windows Me
url=http://www.microsoft.com/whdc/archive/WinMe_sfp.mspx
accessdate=2006-08-28] Similar to Windows File Protection, System File Protection offered real-time protection. The stand-alone SFC utility was removed and not available on Windows Me. [cite web
first=Lincoln
last=Spector
work=PC World
publisher=IDG
date=2001-02-14
title=Answer Line: Windows 98 Utilities Missing in Windows Me?
url=http://www.pcworld.com/article/id,41022-page,1/article.html
accessdate=2006-08-28]

Issues

Older versions of System File Checker are known to override patches distributed by Microsoft. This problem has since been rectified in the newer version of System File Checker. [cite web
date=2003-07-01
publisher=Microsoft
work=Help and Support
url=http://support.microsoft.com/kb/814510/
title=The SFC /SCANNOW Command May Overwrite Hotfix Files
accessdate=2006-08-28]

Usage

In Windows NT-based operating systems, System File Checker can be invoked, using a command prompt, with the following command. sfc /scannowIf it finds a problem, it will attempt to replace the problematic files from the "DLL Cache" (%WinDir%System32Dllcache). If the file is not in the DLL Cache or the DLL Cache is corrupted, the user will be prompted to insert the Windows installation media or provide the network installation path. In Windows Vista and onwards, files are protected using Access control lists (ACLs), however the above command has not changed.

System File Checker in Windows Vista and later Windows operating systems can scan specific individual files. Also, scans can be performed against an offline Windows installation folder to replace corrupt files, in case the Windows installation is not bootable. For performing offline scans, System File Checker must be run from another working installation of Windows Vista or a later operating system or from the Windows setup DVD which gives access to the Windows Recovery Environment.

References