According to System File Checker (sfc) Documentation sfc will follow certain procedures to determine whether a system file is corrupt.
- If sfc discovers that a protected file has been overwritten, it
retrieves the correct version of the file from the
%systemroot%\system32\dllcache
folder, and then replaces the incorrect file. - If the
%systemroot%\system32\dllcache
folder becomes corrupt or unusable, usesfc /scannow
,sfc /scanonce
, orsfc /scanboot
to repair the contents of theDllcache
directory.
This seems contradictory.
- How does sfc know that
dllcache
is corrupted if it is using it as comparison for finding corrupted system files? - How does sfc repair the
dllcache
directory if it is what it uses as its backup store? - How does sfc check for corruption in general? I had always assumed it hash-checked the system files against the
dllcache
directory but these previous two statements seem to suggest otherwise.