Monday, December 19, 2011

How to Perform an Offline System Integrity Verification



This article primarily applies to Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

Various system issues can prevent a system from booting properly and can be fixed through an offline file system check and an integrity check/repair of critical operating system files. To perform this check, it is necessary to access the recovery console from the Windows installation media. I will demonstrate this using the Windows 7 ISO,

First, boot the system from the Windows installation disk,



Then click on "Repair Your Computer"



Select the installation of Windows that you want to mount



Open the command prompt



First, lets use the command line to identify all drives attached to the system and their current mount point in Windows PE. This is done with the diskpart utility and the list volumes subcommand. C:\ is the boot volume (labeled "System Reserved") and D:\ is the system volume (where the operating system and user data are stored)



We will start with a chkdsk, this will verify/repair the filesystem and mark any bad sectors on the disk so that they are not used again.



Next, we will perform a sfc /scannow using the offline settings for the boot directory and windows directory. If you use the incorrect options, two errors are common,

"Windows Resource Protection could not start the Repair service."

"There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again."

The first error indicates an invalid boot or system partition path. The second indicates that incorrect arguments wre given, or there is a file that needs to be removed or renamed in the \Windows\winsxs\pending.xml path. For this installation, this is D:\Windows\winsxs\pending.xml.

For this particular system, this is the correct command to run based on the output of diskpart above

sfc /SCANNOW /OFFBOOTDIR=c:\ /OFFWINDIR=d:\Windows



With any luck the system will boot correctly after this point and repair operations can continue. If the system is still unbootable, it may be necessary to perform an in place upgrade or rescue the files and reformat the system.

See Also,
Windows Blue Screen Crash Dump Analysis
Troubleshooting Memory Errors
How To Detect a Failing Hard Drive
Accessing Safe Mode in Windows
How to Edit the Registry of an Offline Windows System


8 comments:

  1. hey (I'm not entirely computer savvy) but is the chkdsk command always /r /f d: or is it dependant on what my computer setup is?

    and for the last part, where the sfc /scannow results in a "There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again." message, what am I supposed to do again?

    ReplyDelete
    Replies
    1. IT depends on how your computer is set up, I showed in the post that by running the diskpart "list volume" command, that you can identify the system volume "identified by system reserved description" and the boot volume is possibly the next one in the list. Do you have a large number of partitions or are things partitioned strangely?

      Delete
  2. Mike, thanks much. Ultimately, it did not resolve my user's problem, but I'm saving this for future issues.

    ReplyDelete
  3. Any tip for a very strange issue?
    Windows 7 Home Premium, starts and immediately explorer.exe closes and restarts and cycles like that.
    Some time it starts fine and as soon I open some directories (maybe the second partition) it starts again with the issue.

    Any hint?

    Thank you

    Robert

    ReplyDelete
  4. It said that there was one faulty file which has been corrected and the result is in the CBS.log.
    But there is no recent entry in the CBS.log and the system does not boot either.
    I would follow your last sentence and go for an inplace upgrade.
    But an inplace upgrade has to be started from a running system and does not work if you boot from CD.

    Is there a way for an inplace upgrade of an unbootable system?

    ReplyDelete
  5. Hi. I was following your method but I get a different error message than the two you showed. I'm getting "Windows Resource Protection could not perform the requested operation". No error messages follow. The computer has no restore points, can not boot in safe mode, runs clean with chkdsk and dell diagnostics shows no errors. Any clue why it won't sun sfc?

    ReplyDelete
  6. mike, i know this is an old thread, but i came across it during a search for an answer. When performing the DISKPART, the computer stops after "On computer: MINWINPC" and doesn't list the partitions. Any help here?

    ReplyDelete
    Replies
    1. So, I can think of a few things that might have happened. First off, diskpart can sometimes have a slow start up, extending into a few minutes.

      Anyway, I'd start out with seeing if the disk shows up when you run "list disk"

      DISKPART> list disk

      Disk ### Status Size Free Dyn Gpt
      -------- ------------- ------- ------- --- ---
      Disk 0 Online 238 GB 0 B *


      If it doesn't show up, it might be totally dead. If it does show up, there's a good chance that there is at least some corruption, but you might be able to "find" the partitions using a tool like Hiren's Boot CD.

      Last time I had a similar issue, I used something like Partition Recovery off of Hiren's boot CD. It got the system to the point where I was able to partially recover files.

      Best of luck.

      Delete