SFC, DISM and CHKDSK: What Each One Does and the Right Order to Run Them

When Windows 11 becomes unstable, three repair commands appear in almost every troubleshooting guide:

sfc /scannow

DISM.exe /Online /Cleanup-Image /RestoreHealth

chkdsk C: /f

They are often presented as though they perform the same job. They do not.

Each tool repairs a different layer of the system:

• CHKDSK checks the structure and condition of a storage volume.
• DISM repairs the Windows component store used as a source for system files.
• SFC checks protected Windows system files and replaces corrupted copies.

Running them in the wrong order does not usually damage Windows, but it can waste time and produce confusing results. For example, SFC may be unable to repair a system file when the component store containing its replacement copy is also corrupted.

Microsoft’s current guidance is to run DISM before SFC when repairing missing or corrupted Windows system files. CHKDSK should be added when the symptoms or logs suggest a storage or file-system problem rather than run aggressively after every minor Windows fault. 

The Quick Answer: Which Order Should You Use?

For ordinary Windows corruption where the drive appears healthy, use:

1. Restart Windows.
2. Run DISM.
3. Run SFC.
4. Restart again.
5. Test the original problem.

Commands:

DISM.exe /Online /Cleanup-Image /RestoreHealth

Then:

sfc /scannow

When you suspect file-system or drive problems, use:

1. Back up important data.
2. Check the drive’s hardware health.
3. Run a non-disruptive CHKDSK scan.
4. Repair the file system if errors are found.
5. Run DISM.
6. Run SFC.
7. Restart and retest.

A sensible initial drive scan is:

chkdsk C: /scan

This ordering matters because a damaged or unreliable file system can prevent DISM and SFC from reading or writing files correctly.

What SFC Does

SFC stands for System File Checker.

Its job is to examine protected Windows system files and compare them with known-good versions. When it finds a protected file that is missing, damaged or modified incorrectly, it attempts to replace it.

The standard command is:

sfc /scannow

Microsoft describes SFC as a Windows tool that scans protected system files and helps repair missing or corrupted copies that may cause Windows to malfunction. 

SFC is useful for problems involving:

• Windows components that no longer open
• Built-in tools crashing
• Missing system DLLs
• Windows features behaving incorrectly
• Errors after an interrupted update
• Corrupted protected files
• Some Start menu, taskbar or File Explorer faults
• Windows services failing because their files are damaged

SFC does not inspect every file on the computer.

It does not normally repair:

• Personal documents
• Third-party application files
• Physical drive faults
• Damaged sectors
• Every registry problem
• Malware infections
• Faulty drivers supplied by another manufacturer
• A broken Windows component store

What Happens During

sfc /scannow

?

When you run:

sfc /scannow

Windows checks all protected system files and attempts repairs automatically.

The scan normally ends with one of several messages.

“Windows Resource Protection did not find any integrity violations”

SFC did not find damaged protected system files.

This does not prove that:

• The SSD is healthy
• Every driver is working
• Windows Update is healthy
• Third-party software is intact
• The original fault has been resolved

It only tells you that SFC did not detect corruption within the protected files it checked.

“Windows Resource Protection found corrupt files and successfully repaired them”

SFC found and replaced one or more damaged files.

Restart Windows and test the original problem.

It can be useful to run SFC once more after restarting. A second clean result helps confirm that the repaired files have remained intact.

“Windows Resource Protection found corrupt files but was unable to fix some of them”

SFC detected corruption but could not complete all repairs.

This is one of the main reasons Microsoft recommends running DISM first. DISM repairs the component store from which SFC obtains replacement files. 

Run:

DISM.exe /Online /Cleanup-Image /RestoreHealth

Then restart and run:

sfc /scannow

again.

“Windows Resource Protection could not perform the requested operation”

SFC could not complete the scan.

Possible causes include:

• Component-store corruption
• File-system problems
• Pending Windows servicing operations
• A damaged recovery environment
• Storage errors
• Security or system-service interference

Try DISM first. If SFC still cannot run, test it in Safe Mode or from Windows Recovery Environment.

Where Are the SFC Logs?

SFC records details in:

C:\Windows\Logs\CBS\CBS.log

This file contains more information than most users need and may include entries from other Windows servicing operations.

To extract SFC-specific entries into a desktop file, run:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

Microsoft documents this method for creating an easier-to-read file containing SFC repair details. 

Remember that the output can include entries from several scans. Check the dates and times to identify the latest run.

What DISM Does

DISM stands for Deployment Image Servicing and Management.

It is a larger Windows servicing tool used to inspect, maintain and repair Windows images. In everyday troubleshooting, its most important role is repairing the active Windows installation’s component store.

The component store contains Windows components and replacement files used by servicing processes, including SFC.

The standard repair command is:

DISM.exe /Online /Cleanup-Image /RestoreHealth

The sections mean:

• /Online — Work on the Windows installation currently running.
• /Cleanup-Image — Perform servicing operations on the Windows image.
• /RestoreHealth — Scan for component-store corruption and repair it where possible.

Microsoft documents DISM as the tool used to check and repair Windows image corruption, and its SFC guidance specifically says to run DISM before System File Checker. 

What Is the Windows Component Store?

The component store is commonly associated with:

C:\Windows\WinSxS

It is not simply a folder of disposable duplicate files.

Windows uses it to:

• Install updates
• Enable or disable optional features
• Replace protected system files
• Roll components forward during servicing
• Supply repair files to SFC

Do not manually delete files from WinSxS.

If the component store is corrupted, SFC may correctly identify a damaged system file but have no healthy copy available to replace it.

The Three Useful DISM Health Commands

DISM provides three commonly used health options.

CheckHealth

DISM.exe /Online /Cleanup-Image /CheckHealth

This performs a quick check of whether Windows has already marked the image as corrupted and whether the damage is considered repairable.

It does not perform a full scan or repair.

Microsoft states that /CheckHealth reports whether the image is healthy, repairable or non-repairable. 

ScanHealth

DISM.exe /Online /Cleanup-Image /ScanHealth

This performs a more detailed scan for component-store corruption.

It can take longer than CheckHealth but still does not repair anything.

RestoreHealth

DISM.exe /Online /Cleanup-Image /RestoreHealth

This checks for corruption and attempts to repair it.

For most normal troubleshooting, you can go directly to RestoreHealth rather than running all three commands in sequence. CheckHealth and ScanHealth are more useful when diagnosing, documenting or testing an image without immediately modifying it.

Where Does DISM Get Its Repair Files?

By default, DISM can use Windows Update as a source for replacement components.

This means that DISM may require:

• A working internet connection
• Access to Windows Update
• Functioning Windows Update services
• No firewall or proxy blocking the required Microsoft services

Microsoft notes that when Windows Update cannot provide the required files, DISM can use a matching Windows installation, network folder or removable installation source instead. 

An example using a repair source is:

DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:C:\RepairSource\Windows /LimitAccess

/LimitAccess prevents DISM from contacting Windows Update and makes it use only the specified source.

The repair source must match the installed Windows edition, architecture, language and build closely enough to provide the required components.

Why Does DISM Appear Stuck?

DISM can remain on one percentage for a long time.

Common pause points include:

• 20%
• 40%
• 62.3%
• 84%
• 100% before the final message

Do not close the Terminal merely because the percentage has stopped changing for several minutes.

The tool may still be:

• Checking component manifests
• Comparing files
• Contacting Windows Update
• Decompressing repair content
• Processing a large servicing operation

Monitor Task Manager for processor, disk or network activity.

Only consider stopping it when there has been no meaningful activity for an extended period and the system is clearly unresponsive.

Common DISM Results

“The restore operation completed successfully”

DISM repaired the component store or confirmed that the operation completed.

Restart Windows and run:

sfc /scannow

“No component store corruption detected”

The component store appears healthy.

You should still run SFC when you are investigating protected system-file corruption, because DISM and SFC check different layers.

Error

0x800f081f

: “The source files could not be found”

DISM could not obtain suitable replacement files.

Possible reasons include:

• Windows Update is damaged
• The required files are no longer available through the configured source
• The repair media does not match the installed build
• A proxy or firewall prevents access
• The device uses WSUS or management policies that restrict sources

Use matching Windows installation media or another approved repair source.

DISM reports the image is non-repairable

A non-repairable image may require:

• An in-place repair installation
• Restoring a known-good system image
• Resetting Windows
• Reinstalling Windows

Protect the user’s data and investigate the storage hardware before using destructive recovery options.

What CHKDSK Does

CHKDSK stands for Check Disk.

It checks a volume’s file system and file-system metadata for logical and, with certain parameters, physical errors.

Microsoft’s command reference states that CHKDSK without repair parameters reports the status of a volume but does not fix errors. Parameters including /f, /r, /x and /b perform repair-related operations. 

CHKDSK is concerned with the structure of the storage volume, including areas such as:

• File-system metadata
• Directory entries
• File records
• Security descriptors
• Allocation information
• Links between files and disk clusters
• Readable and unreadable sectors when deeper scanning is requested

CHKDSK is not a substitute for SFC or DISM.

It does not know whether a Windows DLL contains the correct Microsoft code. It checks whether the volume can store and retrieve the file according to the file system.

When Should You Run CHKDSK?

CHKDSK is appropriate when you see signs such as:

• “The file or directory is corrupted and unreadable”
• Repeated NTFS errors
• Files disappearing or becoming damaged
• The computer losing access to a drive
• Windows reporting that a drive needs repair
• Update or installation failures associated with disk errors
• Event Viewer reporting disk, NTFS or controller problems
• A system that was switched off during heavy disk activity
• A drive appearing as RAW
• Repeated freezes while reading or writing files
• SFC or DISM failing because files cannot be accessed

It should not be your automatic first response to:

• A browser problem
• One application crashing
• A printer fault
• Slow Wi-Fi
• A Microsoft account issue
• A display-driver problem

CHKDSK Without Parameters

Run:

chkdsk C:

This reports information about the file system.

On an active Windows volume, a read-only check may sometimes be less conclusive because files are changing while Windows is running. Microsoft’s older technical guidance notes that checks performed without locking an active volume can sometimes report inconsistent or misleading results. 

For an online Windows 11 scan, use:

chkdsk C: /scan

This is a useful first check because it performs an online scan without immediately scheduling a lengthy repair.

What Does

/f

Do?

Run:

chkdsk C: /f

/f tells CHKDSK to fix logical file-system errors.

Because Windows is using the C: drive, CHKDSK will usually report that it cannot lock the volume and ask whether you want to schedule the check for the next restart.

Enter:

Y

Then restart Windows.

Use /f when CHKDSK or Windows has identified file-system errors requiring repair.

What Does

/r

Do?

Run:

chkdsk C: /r

/r locates bad sectors and attempts to recover readable information. It also includes the functionality of /f.

This can take a very long time, particularly on:

• Large drives
• Mechanical hard disks
• Drives containing many files
• Failing storage
• Volumes with significant corruption

Do not use /r casually as a routine maintenance command.

On an SSD, it does not physically repair flash cells. The SSD controller manages flash health and bad-block handling internally. CHKDSK can still test readability and repair file-system references, but repeated bad-sector or read errors should trigger a hardware-health investigation.

What Does

/x

Do?

Run:

chkdsk D: /x

/x forces the volume to dismount first and includes /f.

Applications using that volume will lose access while it is dismounted.

Do not use /x on an active business data volume without checking who and what is connected to it.

What Does

/b

Do?

/b is primarily relevant to NTFS volumes and re-evaluates clusters previously identified as bad. It includes /r.

It is sometimes used after:

• Cloning a volume to different hardware
• Storage repairs
• A disk image being restored
• A previous bad-cluster record no longer being relevant

It is not an everyday first-line option.

Can CHKDSK Damage Data?

CHKDSK is designed to repair the file system, but any repair operation carries risk when:

• The drive is physically failing
• The file system is severely corrupted
• The computer loses power during repair
• Important files exist only on that drive
• The storage controller is unstable

CHKDSK may need to remove invalid records or recover fragments to restore file-system consistency. That can leave damaged files incomplete.

Before running /f, /r, /x or /b on a drive containing irreplaceable information, back up or recover the data first wherever possible.

If the drive is clicking, disappearing, reporting SMART failure or becoming extremely slow, stop repeatedly scanning it and arrange professional recovery or replacement.

The Correct Order: DISM, SFC and CHKDSK

There is no single order that applies to every fault.

The right sequence depends on the symptoms.

Scenario 1: Windows Features Are Broken, but the Drive Appears Healthy

Examples:

• Settings will not open
• File Explorer crashes
• Windows Update behaves incorrectly
• Built-in tools are missing or corrupted
• Windows reports damaged system files

Use:

DISM.exe /Online /Cleanup-Image /RestoreHealth

Then:

sfc /scannow

Restart and test.

This follows Microsoft’s recommended repair sequence: repair the component store with DISM, then use SFC to repair protected system files. 

Scenario 2: Windows Reports File-System or Disk Errors

Examples:

• NTFS errors in Event Viewer
• The drive needs scanning
• Files are unreadable
• Applications report corrupted paths
• DISM or SFC cannot access files

Use:

chkdsk C: /scan

If repair is required:

chkdsk C: /f

Restart if requested.

Then run:

DISM.exe /Online /Cleanup-Image /RestoreHealth

Followed by:

sfc /scannow

This repairs the storage structure before asking Windows servicing tools to repair files stored on it.

Scenario 3: The PC Will Not Boot

Enter Windows Recovery Environment:

Troubleshoot > Advanced options > Command Prompt

The Windows partition may not be C: inside recovery.

Check drive letters with:

diskpart

Then:

list volume

Then:

exit

Once you identify the Windows volume, you can check it:

chkdsk D: /scan

or repair it where justified:

chkdsk D: /f

An offline SFC scan can be run using:

sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

Replace D: with the correct recovery-environment drive letter.

Offline DISM repairs are more complex because you must specify the image and, where necessary, a matching source. Avoid copying commands that assume the wrong drive or Windows image.

Scenario 4: SFC Found Corruption but Could Not Fix It

Run:

DISM.exe /Online /Cleanup-Image /RestoreHealth

Restart.

Then run:

sfc /scannow

If it still fails:

1. Check the CBS log.
2. Run CHKDSK /scan.
3. Check drive health.
4. Try Safe Mode.
5. Use a matching DISM repair source.
6. Consider an in-place Windows repair installation.

Scenario 5: DISM Fails Because Source Files Cannot Be Found

Check:

• Internet access
• Windows Update
• Proxy configuration
• WSUS policies
• Firewall controls
• Windows build and edition
• Repair-source compatibility

Mount matching Windows installation media and use an approved source.

Do not use a random install.wim downloaded from an unofficial site.

Scenario 6: Different Files Become Corrupted Again

If SFC repairs files but corruption returns, investigate the underlying cause.

Possibilities include:

• Failing storage
• Unstable RAM
• Sudden power loss
• Malware
• An unstable overclock
• A problematic driver
• A broken update process
• Third-party software modifying protected components

Repeatedly running SFC treats the symptom, not the cause.

A Safe Standard Repair Procedure

For a Windows 11 computer that starts normally and has no signs of physical drive failure:

Step 1: Back Up Important Data

Before carrying out system repairs, confirm that important files exist in:

• OneDrive or SharePoint
• A business backup
• An external drive
• Another protected storage location

Do not assume a system repair tool is a substitute for backup.

Step 2: Restart Windows

Use:

Start > Power > Restart

A restart completes pending servicing operations and releases locked files.

Step 3: Open Terminal as Administrator

Right-click Start and select:

Terminal (Admin)

Approve the User Account Control prompt.

The commands require administrative privileges.

Step 4: Run DISM

DISM.exe /Online /Cleanup-Image /RestoreHealth

Wait for the final result.

Do not close the window when the percentage pauses temporarily.

Step 5: Run SFC

sfc /scannow

Wait until verification reaches 100%.

Step 6: Restart Again

Restart even when both commands report success.

Step 7: Test the Original Problem

Check the actual symptom:

• Open the affected application.
• Run Windows Update.
• Restart File Explorer.
• Test printing.
• Reopen the Windows feature.
• Review Event Viewer.

A successful command does not automatically prove that the original fault is fixed.

Step 8: Add CHKDSK Only When Needed

When storage symptoms exist, begin with:

chkdsk C: /scan

Use /f or /r only when the results and symptoms justify a repair or deeper surface scan.

Should You Run SFC Before DISM?

You can, and doing so is not normally harmful.

Some technicians run SFC first because:

• It may resolve a simple isolated corruption quickly.
• It provides an early indication of system-file damage.
• DISM may not be needed when SFC reports no problems.

However, Microsoft’s current support sequence is DISM first and SFC second because DISM repairs the source that SFC may need. 

For a standard written procedure, use:

DISM → SFC

For rapid diagnosis, an experienced technician may run SFC first, but should still use DISM when SFC cannot repair files or when component-store corruption is suspected.

Should You Run CHKDSK Before DISM?

Run CHKDSK first when there is evidence of:

• File-system corruption
• Read errors
• NTFS errors
• Drive disconnections
• Storage-controller faults
• A volume marked dirty
• DISM or SFC failing to read files

Do not run a lengthy chkdsk /r before every DISM scan.

For ordinary Windows component corruption on an otherwise healthy drive, DISM can be run first.

How Long Do the Tools Take?

Approximate timings vary considerably.

SFC

Often takes:

• 5–20 minutes on a modern SSD
• Longer on slower or heavily used systems

DISM RestoreHealth

Often takes:

• 10–30 minutes
• Longer when downloading repair files
• Longer on damaged or slow systems

CHKDSK

/scan

Often completes relatively quickly, depending on volume size and file count.

CHKDSK

/f

May require a restart and can take from minutes to hours.

CHKDSK

/r

Can take many hours on a large drive.

Do not schedule disruptive repairs immediately before a meeting, deadline or business opening time.

How to View CHKDSK Results

A CHKDSK operation performed during startup disappears from the screen when Windows loads.

To review the result:

1. Open Event Viewer.
2. Go to Windows Logs > Application.
3. Filter or search for the relevant source, commonly Wininit for startup checks.
4. Open the event matching the scan time.

Microsoft’s CHKDSK documentation describes retrieving check results through Event Viewer or PowerShell. 

What These Tools Cannot Fix

SFC, DISM and CHKDSK are valuable, but they are not universal repairs.

They cannot reliably fix:

• Failed SSD electronics
• A mechanically failing hard drive
• Faulty RAM
• Overheating
• A damaged motherboard
• A defective power supply
• Third-party application corruption
• Incorrect business software configuration
• Malware persistence
• Broken network infrastructure
• A user profile that requires replacement
• Unsupported hardware or drivers

They also do not replace:

• Backup
• Antivirus and endpoint protection
• Hardware diagnostics
• Crash-dump analysis
• Application troubleshooting
• Proper Windows update management

Common Mistakes

Running All Three Commands After Every Minor Fault

This wastes time and may distract from the actual cause.

Use the tool that matches the symptom.

Running

chkdsk /r

as Routine Maintenance

A full sector scan can take hours and is unnecessary for most ordinary Windows problems.

Start with /scan.

Closing DISM Because It Appears Frozen

DISM can remain at one percentage for a long time while continuing to work.

Check system activity before stopping it.

Running SFC Repeatedly Without DISM

When SFC cannot repair files, repeatedly running the same scan is unlikely to change the result if its replacement source is corrupted.

Repair the component store with DISM.

Deleting WinSxS Manually

This can break Windows servicing, optional features and future repairs.

Use supported DISM operations only.

Ignoring Storage Hardware Warnings

A file-system repair does not make failing hardware healthy.

Back up the data and check the drive.

Using an Incorrect DISM Source

A mismatched Windows ISO can produce source errors or fail to supply the correct components.

Use matching, official media.

Interrupting CHKDSK

Do not force the computer off during a repair unless the system is clearly irrecoverably frozen.

An interrupted file-system repair can create further corruption.

Assuming “No Integrity Violations” Means the PC Is Healthy

SFC checks a specific group of Windows files. It is not a complete hardware, malware or application test.

When to Stop Running Commands and Seek Help

Arrange professional diagnosis when:

• The drive disappears from BIOS or Windows
• SMART or manufacturer diagnostics report failure
• Files continue becoming corrupted
• CHKDSK repeatedly finds new errors
• DISM cannot repair the component store
• SFC repairs the same files after every restart
• Windows no longer boots
• The computer repeatedly blue-screens
• Important data is not backed up
• The device is business-critical
• The drive makes unusual clicking or grinding noises
• Several repair attempts have made no improvement

Repeated repair commands can place additional load on failing storage. Protect the data before continuing.

The Best Tool for Each Problem

The Recommended Command Set

For ordinary Windows repair:

DISM.exe /Online /Cleanup-Image /RestoreHealth

Then:

sfc /scannow

For an initial file-system check:

chkdsk C: /scan

For confirmed logical file-system errors:

chkdsk C: /f

For suspected unreadable sectors where a deeper scan is justified:

chkdsk C: /r

Use each command separately and read its final result before moving on.

How Hamilton Group Can Help

Built-in Windows repair tools can resolve genuine corruption, but they can also give false confidence when the real problem is failing storage, unstable memory or an update that keeps damaging the same files.

Hamilton Group can help with:

• SFC and DISM failures
• Windows component-store corruption
• CHKDSK and NTFS errors
• SSD and hard-drive health checks
• Windows Update repair
• Blue-screen and crash-dump analysis
• Safe Mode and Windows Recovery Environment
• In-place Windows repair installations
• Driver and firmware problems
• Data backup and recovery
• Business device replacement
• Microsoft Intune and managed Windows support

We can identify whether the issue is limited to Windows files or is being caused by the underlying hardware.

Use the Right Tool for the Right Layer

SFC, DISM and CHKDSK are not three versions of the same repair command.

CHKDSK checks the file system and storage volume. DISM repairs the Windows component store. SFC uses that source to verify and replace protected Windows system files.

For most Windows corruption, run DISM first and SFC second. Add CHKDSK when there is evidence of file-system or storage trouble, beginning with a non-disruptive scan and using repair parameters only when they are justified.

For help diagnosing Windows corruption, disk errors or repeated repair failures, call Hamilton Group on 0330 043 0069 or book a call with one of our experts today.