Listing Files Protected by System File Checker SFC in Windows

Many computer tech people should know about the utility called SFC (System File Checker) built-in to Windows 98/2000/XP/2003/Vista. This tool can help you scan and restore corrupted Windows system files. Let’s take Event ID 4226 Patcher which patches TCPIP.sys file, which is a system protected file for an example. You can modify the system file with the patcher but after a few seconds you will get a Windows File Protection window telling you that “Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files.”

Good news is we can enter the Windows installation disc and hit the Retry button to restore back the original system file. Bad news is we can hit the Cancel button to keep unrecognized system file. After some time, our Windows computer can have a lot of unrecognized system files causing Windows to be unstable. There are a lot of system files in Windows and it is impossible for us to know which file is modified or not. So the simple solution is to use System File Checker to validate the digital signatures of all of the Windows system files and restores any that it finds are incorrect.

Have you ever wonder which system files are protected by Windows File Protection? Here’s a simple tool that is able to that.

SFCList is the utility to enumerate files protected by SFC mechanism. Windows has introduced SFC technology (System File Checker) to protect core system files from being accidently or intentionally modified by third party programs. Whenever any such protected file is modified, SFC comes into action and replaces it with original system file.

SFCList tool helps to enumerate all those protected files. As there are thousands of such files, it has filter option which can be used to shorten down the search. Also one can verify if the particular file is protected by SFC or not.

You have to run this tool together with switches in command prompt.

Here’s a few example on how to use SFClist.
The command below will list all system file protected through SFC
sfclist -l

The command below will list all the protected dll files
sfclist -l .dll

If you want to verify if the file is protected by SFC:
sfclist -p C:\Windows\system32\drivers\tcpip.sys

When you use the -l switch to list all the protected system files, you should be getting a very long list (I got 3498 files) and you can’t scroll to the first line in command prompt. You can store the result to file by using the command sfclist.exe -l > c:\output.txt

[ Download SFCList ]