What files does SFC replace?

Posted on 2005-04-28
Last Modified: 2008-02-01
SFC is a great tool to restore a corrupt XP OS to working when files are corrupt or changed. BUT - in order to prevent the symptoms from happening again, it tells nothing of what it did.  Is there any technique or trick to finding out what files SFC reverts when ran?  A log?  something!!??  if I monitor the system32 folder as it runs, I can see it creating files named OLD***.tmp, but this is like a wild goose chase to figure out what file it used to be.  Byte sizes, dates, etc. don't match up (of course).  Just wondering if anyone can help me keep some hair on my head.
Question by:1-11
    LVL 20

    Accepted Solution

    As you can see from Microsoft Windows Driver Foundation article , there is no SFC job logging feature.
    System File Checker

    A command-line utility called System File Checker (SFC.EXE) allows an Administrator to scan all protected files to verify their versions. System File Checker can also set the registry value SFCScan discussed in "Additional Registry Settings" later in this article.

    System File Checker will also check and repopulate the %Systemroot%\system32\dllcache directory. If the dllcache directory becomes corrupted or unusable, SFC /SCANNOW, SFC /SCANONCE, SFC /SCANBOOT, or SFC /PURGECACHE can be used to repair the contents of the dllcache directory.

    SFC.exe scans all protected system files and replaces incorrect versions with correct Microsoft versions. The following shows the syntax:


    /SCANNOW  Scans all protected system files immediately.

    /SCANONCE  Scans all protected system files once.

    /SCANBOOT  Scans all protected system files at every boot.

    /CANCEL  Cancels all pending scans of protected system files.

    /QUIET  Replaces all incorrect file versions without prompting the user.

    /PURGECACHE  Purges the file cache and scans all protected system files immediately.

    /CACHESIZE=x  Sets the file cache size (in megabytes).

    The only relatively simple way to backtrack changes made by SFC is to get directory listings before SFC and after
    SFC job and then compare the contens of the two.
    simply type before you perform SFC:

    dir C:\WINDOWS\SYSTEM32\dllcache > beforesfc.txt

    and once you're done with SFC type modified command:
    C:\WINDOWS\SYSTEM32\dllcache > aftersfc.txt

    the compare files . command is:
     fc  beforesfc.txt    aftersfc.txt
    which will give you the list of differences in the directory lists.

    good luck
    LVL 22

    Expert Comment

    No logging feature for SFC.
    LVL 16

    Assisted Solution

    HI :)

    Here is a full list of what Sfc protects !

    Hope that helps.
    LVL 16

    Expert Comment

    Download  :  '' - Executable (Release Build)
    LVL 22

    Expert Comment

    eagle..thats a list of protected files and not of what sfc replaces....
    LVL 16

    Expert Comment

    It replaces those marked as not found !

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Join & Write a Comment

    Ok I have been working on this for some time having learned and gained certification in XenDesktop 4 along came version 5 which was released last month. Since then I have been working to deploy XenDesktop 5 in a small environment with only 2 virt…
    If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article ( first and run the tool TDSSKiller ( to get rid of the infection. Once done, and if the …
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now