Monday, December 19, 2011

How to Perform an Offline System Integrity Verification

Sponsored Links

This article primarily applies to Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

Various system issues can prevent a system from booting properly and can be fixed through an offline file system check and an integrity check/repair of critical operating system files. To perform this check, it is necessary to access the recovery console from the Windows installation media. I will demonstrate this using the Windows 7 ISO,

First, boot the system from the Windows installation disk,



Then click on "Repair Your Computer"



Select the installation of Windows that you want to mount



Open the command prompt



First, lets use the command line to identify all drives attached to the system and their current mount point in Windows PE. This is done with the diskpart utility and the list volumes subcommand. C:\ is the boot volume (labeled "System Reserved") and D:\ is the system volume (where the operating system and user data are stored)



We will start with a chkdsk, this will verify/repair the filesystem and mark any bad sectors on the disk so that they are not used again.



Next, we will perform a sfc /scannow using the offline settings for the boot directory and windows directory. If you use the incorrect options, two errors are common,

"Windows Resource Protection could not start the Repair service."

"There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again."

The first error indicates an invalid boot or system partition path. The second indicates that incorrect arguments wre given, or there is a file that needs to be removed or renamed in the \Windows\winsxs\pending.xml path. For this installation, this is D:\Windows\winsxs\pending.xml.

For this particular system, this is the correct command to run based on the output of diskpart above

sfc /SCANNOW /OFFBOOTDIR=c:\ /OFFWINDIR=d:\Windows



With any luck the system will boot correctly after this point and repair operations can continue. If the system is still unbootable, it may be necessary to perform an in place upgrade or rescue the files and reformat the system.

See Also,
Windows Blue Screen Crash Dump Analysis
Troubleshooting Memory Errors
How To Detect a Failing Hard Drive
Accessing Safe Mode in Windows
How to Edit the Registry of an Offline Windows System


6 comments:

  1. hey (I'm not entirely computer savvy) but is the chkdsk command always /r /f d: or is it dependant on what my computer setup is?

    and for the last part, where the sfc /scannow results in a "There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again." message, what am I supposed to do again?

    ReplyDelete
    Replies
    1. IT depends on how your computer is set up, I showed in the post that by running the diskpart "list volume" command, that you can identify the system volume "identified by system reserved description" and the boot volume is possibly the next one in the list. Do you have a large number of partitions or are things partitioned strangely?

      Delete
  2. Mike, thanks much. Ultimately, it did not resolve my user's problem, but I'm saving this for future issues.

    ReplyDelete
  3. Any tip for a very strange issue?
    Windows 7 Home Premium, starts and immediately explorer.exe closes and restarts and cycles like that.
    Some time it starts fine and as soon I open some directories (maybe the second partition) it starts again with the issue.

    Any hint?

    Thank you

    Robert

    ReplyDelete
  4. It said that there was one faulty file which has been corrected and the result is in the CBS.log.
    But there is no recent entry in the CBS.log and the system does not boot either.
    I would follow your last sentence and go for an inplace upgrade.
    But an inplace upgrade has to be started from a running system and does not work if you boot from CD.

    Is there a way for an inplace upgrade of an unbootable system?

    ReplyDelete
  5. Hi. I was following your method but I get a different error message than the two you showed. I'm getting "Windows Resource Protection could not perform the requested operation". No error messages follow. The computer has no restore points, can not boot in safe mode, runs clean with chkdsk and dell diagnostics shows no errors. Any clue why it won't sun sfc?

    ReplyDelete