---
id: a78ea33b-3187-470d-b5d1-6a4fcbbb5070
---

# Corrupt System Files and Filesystem on Windows Machine
---

This incident type refers to the occurrence of corrupt system files and a corrupt filesystem on a Windows machine. This can cause a variety of issues such as system crashes, error messages, and data loss. It is important to address this issue promptly to prevent further damage to the system and potential data loss.

### Parameters
```shell
export DRIVE_LETTER="PLACEHOLDER"
```

## Debug

### Check disk for errors
```shell
chkdsk ${DRIVE_LETTER}: /f /r
```

### Check system files for errors
```shell
sfc /scannow
```

### Check disk for bad sectors
```shell
wmic diskdrive get status
```

### Check disk health
```shell
wmic diskdrive get status, availability
```

### Check disk usage
```shell
wmic logicaldisk get name, freespace, systemname, size
```

### Check disk event logs for errors
```shell
Get-EventLog -LogName Application -Source "Microsoft-Windows-Ntfs" -After (Get-Date).AddDays(-7)
```

### Scan for malware
```shell
Windows Defender: Start-MpWDOScan
```

### Check disk fragmentation
```shell
defrag ${DRIVE_LETTER}: /a
```

### Repair corrupt system files
```shell
DISM /Online /Cleanup-Image /RestoreHealth
```

### Check system event logs for errors
```shell
Get-EventLog -LogName System -EntryType Error
```

## Repair

### Check the hard drive for errors and bad sectors using a disk utility tool.
```shell


#!/bin/bash



# Specify the drive letter to check (e.g. C: or D:)

drive_letter=${DRIVE_LETTER}



# Run chkdsk command with /f and /r options to fix errors and locate bad sectors

chkdsk ${DRIVE_LETTER} /f /r



# Check the exit code of the previous command to see if any errors were fixed

if [ "$?" -eq 0 ]; then

  echo "Drive ${DRIVE_LETTER} checked and fixed successfully."

else

  echo "Error: Drive ${DRIVE_LETTER} check failed."

fi


```

This incident type refers to the occurrence of corrupt system files and a corrupt filesystem on a Windows machine. This can cause a variety of issues such as system crashes, error messages, and data loss. It is important to address this issue promptly to prevent further damage to the system and potential data loss.


```shell
export DRIVE_LETTER="PLACEHOLDER"
```


### Check disk for errors

```shell
chkdsk ${DRIVE_LETTER}: /f /r
```

### Check system files for errors

```shell
sfc /scannow
```

### Check disk for bad sectors

```shell
wmic diskdrive get status
```

### Check disk health

```shell
wmic diskdrive get status, availability
```

### Check disk usage

```shell
wmic logicaldisk get name, freespace, systemname, size
```

### Check disk event logs for errors

```shell
Get-EventLog -LogName Application -Source "Microsoft-Windows-Ntfs" -After (Get-Date).AddDays(-7)
```

### Scan for malware

```shell
Windows Defender: Start-MpWDOScan
```

### Check disk fragmentation

```shell
defrag ${DRIVE_LETTER}: /a
```

### Repair corrupt system files

```shell
DISM /Online /Cleanup-Image /RestoreHealth
```

### Check system event logs for errors

```shell
Get-EventLog -LogName System -EntryType Error
```


### Check the hard drive for errors and bad sectors using a disk utility tool.

```shell


#!/bin/bash



# Specify the drive letter to check (e.g. C: or D:)

drive_letter=${DRIVE_LETTER}



# Run chkdsk command with /f and /r options to fix errors and locate bad sectors

chkdsk ${DRIVE_LETTER} /f /r



# Check the exit code of the previous command to see if any errors were fixed

if [ "$?" -eq 0 ]; then

  echo "Drive ${DRIVE_LETTER} checked and fixed successfully."

else

  echo "Error: Drive ${DRIVE_LETTER} check failed."

fi


```


Corrupt System Files and Filesystem on Windows Machine

Overview

Parameters

Debug

Check disk for errors

Check system files for errors

Check disk for bad sectors

Check disk health

Check disk usage

Check disk event logs for errors

Scan for malware

Check disk fragmentation

Repair corrupt system files

Check system event logs for errors

Repair

Check the hard drive for errors and bad sectors using a disk utility tool.

Learn more

Related Runbooks

Support