chkdsk, SFC and DISM: Which One to Run and When

Three commands get recommended for almost every Windows problem, usually together and usually in the wrong order. They repair different things. Running all three when one applies wastes an hour and a reboot; running the wrong one first means the right one has nothing good to work with.

What Each One Repairs

The dependency is the part that matters. SFC repairs system files by copying known-good copies out of a store held on the machine. If that store is damaged, SFC has nothing valid to copy from, and it will say so in its output rather than failing loudly.

DISM repairs the store. That is why the order is DISM then SFC when SFC has already failed, and not the other way round.

chkdsk sits outside this entirely. It works on the filesystem, not on the contents of files. A machine with a healthy filesystem and corrupt system files gets nothing from it.

Running SFC

Open a command prompt as administrator and run the system file checker with the scannow switch. It compares protected files against the component store and replaces anything that does not match.

Three outcomes are worth distinguishing:

It found no violations, which means system files are intact and the problem is elsewhere.

It found and repaired violations, which is the successful case.

It found violations it could not repair, which is the signal to move to DISM and then run SFC again.

The details go into a log under the Windows directory, and reading it tells you which files were involved. That is more useful than the summary line when trying to work out what went wrong.

Running DISM

DISM has a health sequence that runs from cheap to expensive. CheckHealth looks for a flag that corruption was already recorded and returns immediately. ScanHealth performs an actual scan and takes longer. RestoreHealth repairs what it finds, pulling replacement components from Windows Update.

Because RestoreHealth reaches out over the network, it fails on a machine with no connection or with Windows Update blocked. In that case it can be pointed at a mounted installation image as its source instead.

RestoreHealth commonly sits at a percentage for a long time without moving. That is normal and it should be left to finish rather than cancelled.

After DISM completes, run SFC again. DISM fixed the source; SFC is what applies it to the system files.

Running chkdsk

Read-only is the safe first pass: chkdsk with no switches reports what it finds and changes nothing. Start there, because the report tells you whether anything is actually wrong.

The repair switch fixes filesystem errors and requires exclusive access to the volume, which the system volume cannot give while Windows is running. Windows offers to schedule it for the next restart.

The surface scan switch additionally reads every sector and attempts to recover readable data from bad ones, relocating it. This is the pass that takes hours on a large drive, and it is the pass to be careful with.

Before running a repair pass on a drive you suspect is failing, back up anything irreplaceable. A surface scan on a dying drive is a long period of sustained work at exactly the moment the drive is least able to handle it, and data in a sector that cannot be read is not recovered by marking the sector bad. Repair operations can also result in data loss where the filesystem structure pointing at a file is the part that is damaged.

Interrupting a repair pass partway is worse than never starting, because the filesystem may be left in a state between the old structure and the new one.

Checking the Drive Before Repairing It

If the suspicion is hardware rather than filesystem, the drive’s own health reporting is the better first look. Windows exposes a basic status through the storage management commands, and the drive’s built-in self-monitoring holds counters for reallocated sectors and read errors.

A drive reporting reallocations that are climbing is telling you something chkdsk cannot fix. In that situation the priority is copying data off, not repairing the filesystem in place.

What People Get Wrong About This

The most common error is running all three in sequence as a ritual. They address unrelated layers, and running chkdsk because Windows Update failed is time spent on the wrong subsystem.

The second is running SFC, seeing that it could not repair everything, and concluding the machine needs reinstalling. That output is specifically the case DISM exists for. Reinstalling Windows erases the installed applications and, depending on the option chosen, the files on the system volume, so it is a last resort rather than a next step.

A third is running chkdsk with the surface scan switch on a drive that is audibly failing. The scan can be the final load.

A fourth is cancelling DISM because it appears stuck. The progress indicator is not a reliable guide to what it is doing.

And the last is assuming a clean SFC result means the machine is healthy. It means protected system files match the store. Drivers, third-party software, user profile corruption and hardware faults are all outside its scope.

Where to Go Next

If the symptom is a blue screen rather than a file problem, the dump tells you more than any of these three; see reading a blue screen. If it is a boot failure, the boot configuration is the place to look rather than the filesystem. And if the machine is slow rather than broken, 100% disk usage covers the usual causes, none of which these tools address.