Knowledge Base
How to Read SFC /scannow Results from the CBS Log
After running sfc /scannow, you can read the detailed results by extracting the SFC entries from the CBS log. Open an administrator command prompt and run findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt". This pulls every System File Checker entry into a text file on your desktop, so you can see exactly which files were scanned, which were corrupt, and which were repaired.
Key facts
sfc /scannowchecks Windows system files and repairs corrupt ones from a cached copy.- Detailed results are written to
C:\Windows\Logs\CBS\CBS.log, not shown in full on screen. - Extract just the SFC lines with
findstr /c:"[SR]"against the CBS log. - The command works the same on Windows 8, 10, and 11.
- If SFC cannot repair a file, run DISM first, then run SFC again.
Why can’t you see the full SFC results on screen?
The command prompt only shows a summary when sfc /scannow finishes, such as whether it found and repaired corrupt files, but it does not list which files. The full detail goes to the CBS (Component-Based Servicing) log at C:\Windows\Logs\CBS\CBS.log, which is a large file mixing SFC entries with a lot of unrelated servicing activity. That is why you extract just the relevant lines rather than trying to read the whole thing.
How do you extract the SFC results?
The findstr command filters the CBS log down to only the System File Checker entries, which are tagged [SR]. Open Command Prompt as administrator and run:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"
This creates sfcdetails.txt on your desktop containing every SFC line with a timestamp. Open it and look for entries that mention a file being “corrupt” or “repaired”; those are the ones that matter. A scan that found nothing wrong produces a much shorter, cleaner file.
What if SFC cannot repair a file?
When sfc /scannow reports that it found corrupt files but could not fix some of them, the usual cause is that its local repair source is itself damaged, and DISM is the fix. Run DISM /Online /Cleanup-Image /RestoreHealth in an administrator command prompt to repair the underlying component store using Windows Update as the source, then run sfc /scannow again. Running DISM before SFC, in that order, resolves most cases where SFC alone keeps failing. (We run this pair so often it is basically muscle memory.)
Frequently asked questions
Where is the SFC log located?
System File Checker writes its detailed entries to the CBS log at C:\Windows\Logs\CBS\CBS.log. There is no separate SFC log file; its entries are mixed into the CBS log and tagged with [SR], which is why the findstr command filters for that tag.
Does this work on Windows 10 and 11?
Yes. Although the technique dates back to earlier versions, the sfc /scannow command, the CBS log location, and the findstr extraction all work the same way on Windows 8, Windows 10, and Windows 11. The process has not changed.
What does the [SR] tag mean in the CBS log?
[SR] stands for System Resource and marks the log lines written by System File Checker. Filtering the CBS log for [SR] isolates the SFC activity from the much larger volume of general servicing entries, giving you a readable record of what the scan checked and changed.
Persistent system file corruption on a business machine is often a symptom of something larger, from a failing disk to malware. If a workstation keeps needing this treatment, happy to take a proper look at what is behind it.
