How do I fix this file that SFC flags as corrupted if using a copy straight from a brand-new ISO doesn’t work?

Question

I recently set up a new Windows 10 PC (then v20H2), and whilst customizing it, I replaced the default “new email” sound (C:\Windows\Media\Windows Notify Email.wav) with the Win8.1 version, which I like better. However, I did this by overwriting the original Win10 audio file with the Win8.1 one, rather than just adding the Win8.1 file to the same directory and renaming it (“Windows Notify Email_Win8.1.wav” or whatever). I’d live to regret that.

I’ve since updated Windows to v21H1. Earlier today I ran SFC /scannow for the first time on this system, and it “found corrupted files but was unable to fix some of them”. In the CBS log I find this:

2021-06-06 02:39:15, Info                  CSI    00000217 Hashes for file member [l:24]'Windows Notify Email.wav' do not match.
 Expected: {l:32 ml:33 b:b04f63d689ae7d627a5dc7895bbe53fb3bf470a43c4f1f6339dd4ab8890ffa6f}.
 Actual: {l:32 b:7897e75ba5b52a8e53431e7af5758a84acdf2d50d6d2a9dd2d90fee0034e11c0}.
2021-06-06 02:39:15, Info                  CSI    00000218 [SR] Cannot repair member file [l:24]'Windows Notify Email.wav' of Microsoft-Windows-Shell-Sounds, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2021-06-06 02:39:15, Info                  CSI    00000219 Hashes for file member [l:24]'Windows Notify Email.wav' do not match.
 Expected: {l:32 ml:33 b:b04f63d689ae7d627a5dc7895bbe53fb3bf470a43c4f1f6339dd4ab8890ffa6f}.
 Actual: {l:32 b:7897e75ba5b52a8e53431e7af5758a84acdf2d50d6d2a9dd2d90fee0034e11c0}.
2021-06-06 02:39:15, Info                  CSI    0000021a [SR] Cannot repair member file [l:24]'Windows Notify Email.wav' of Microsoft-Windows-Shell-Sounds, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2021-06-06 02:39:15, Info                  CSI    0000021b [SR] This component was referenced by [l:154]'Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.19041.1023.ACD49602CE22B8D2FE76CB65181A0F3C34476C610F7967574610C8CF843FB4AB'

Here’s a rundown of everything I’ve tried:

I ran sfc /scannow multiple times, but the error never went away.
I then ran dism /online /cleanup-image /restorehealth, followed by dism /online /cleanup-image /checkhealth, which found no component store corruption.
Then some more sfc /scannow passes; still corrupted.
CBS.log then mentioned something about “the version in the store is also corrupted”.
I downloaded the 21H1 Media Creation Tool, which I used to download a fresh Win10 v21H1 ISO, which I mounted to I:.
I ran dism /online /cleanup-image /restorehealth /source:I:\sources\install.esd /limitaccess. Completed successfully.
dism /online /cleanup-image /checkhealth. Clean bill of health for the component store.
sfc /scannow, several passes. Still doesn’t fix it.
Maybe if I replace the file manually?
I extracted the “Windows\Media\Windows Notify Email.wav” straight from the new ISO’s install.esd, and copied it over the corrupted file on my drive. Successful replacement, no errors of any kind.
sfc /scannow. Still corrupted, SFC still can’t fix. (That’s when I took the above CBS.log excerpt.)
I tried deleting the affected file from C:\Windows\Media (actually just moved it to my desktop).
sfc /scannow gave the same error, and weirdly, CBS.log said the same thing as ever – hash mismatch, rather than “file is missing” or similar. (Didn’t give me a new copy.)
Incidentally, I checked the C:\Windows\Media folder permissions and enabled full control for TrustedInstaller. Didn’t change anything.
(Not mentioned: Several reboots throughout all this, just to be safe.)

I’m out of ideas. Even manually replacing the allegedly corrupted file with a copy directly from a brand-new ISO doesn’t work. Even weirder, when I run the file through a hash tool, it gives me the exact same hash (SHA256) that the CBS log says SFC is looking for (“b04………a6f”), rather than the “actual” one. As far as I can tell, it’s a perfectly good copy, yet SFC keeps flagging it as corrupted. And I refuse to do something drastic like resetting my PC, undoing weeks of work setting it up (lots of apps & configurations), just to get SFC to stop tripping over one measly little 160 KB .wav file.

Any help in figuring this out would be really appreciated.

OS: Win10 Pro x64 21H1 (19043.1023)

More info: I just again tried deleting “C:\Windows\Media\Windows Notify Email.wav” and running SFC /scannow to see if it would replace it, and it seems doing this is what causes SFC to put this particular error in the CBS log:

Could not reproject corrupted file \??\C:\Windows\Media\\Windows Notify Email.wav; source file in store is also corrupted

To be clear, I haven’t touched the store at all (I don’t even know where it is); I only deleted the “corrupted” file from C:\Windows\Media. Does this provide any useful info, or is it just more noise?

Try maybe to move this file away and then run SFC, so it might put back its own file. — harrymc, Jun 06 '21 at 08:54
@harrymc I tried exactly that – moved the file to my desktop, ran SFC, it just spat out the same “hash mismatch” error, didn’t even seem to notice the file was missing, and didn’t replace it with a new one. — Walter, Jun 06 '21 at 09:31
@Walter `Sfc` lists a system file as corrupted when its hash doesn't match the hash of its backup in the Component Store [`%WinDir%\WinSxS`] within `Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.19041.1023...`] and simply copying the file from another system/`install.wim` index isn't going to fix the issue - please perform [Steps 1 - 6](https://superuser.com/a/1579031/529800), as `Sfc` and `Dism` were run out of order and the order sequence matters. If Step 5 still fails, please post the applicable sections of the `CBS.log` and `DISM.log` to your question. — JW0914, Jun 08 '21 at 13:43
@Walter A few FYIs: **(1)** `Sfc` doesn't download anything - it references the Component Store _(`/Cleanup-Image` verifies against the Windows Update servers and downloads accordingly)_; **(2)** Running `/Cleanup-Image` with the `/Source` as an `install.esd`||`install.wim` requires specifying the index number contained within the image, as an `install.esd`||`install.wim` contains multiple images, from boot images to x64 and x86 OS base images, containing anywhere from 2 - 8+ indexes. _(Both of these are covered in the aforementioned link.)_ — JW0914, Jun 08 '21 at 14:20
A) The problem has been solved. B) Copying a file directly from the install.esd is how I got the good copy that eventually let me solve the issue. C) My post states that whilst I started with `SFC`, I then ran `DISM` and `SFC` sequentially, several times, and I did post the CBS.log results from that. D) (In reply to your comment on my answer) Entering the component store manually is what allowed me to fix the problem. — Walter, Jun 08 '21 at 22:13
@Walter **(A)** You got lucky in fixing your issue, but you didn't solve the underlying problem; **(B)** Generally that will not work due to what the Component Store is and how it operates _(covered in the man pages linked to within [this](https://superuser.com/a/1579031/529800) answer)_; **(C)** You didn't run the correct commands in the correct order - please reference the linked to answer, as all you had to do was: `Dism /Online Cleanup-Image /StartComponentCleanup; Dism /Online Cleanup-Image /RestoreHealth; Sfc /ScanNow`; **(D)** I addressed this in a comment under your answer — JW0914, Jun 09 '21 at 12:22

score 0 · Accepted Answer · answered Jun 06 '21 at 21:59

Fixed it! Someone over at Windows 10 Forums pointed me towards the component store folder SFC kept trying to replace the file from – C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2 (which I’d seen in the CBS log but thought it was just some random code, didn’t realize it was a folder) – and when I went there, I found the “Windows Notify Email.wav” file there was somehow the Win8.1 version, rather than the original Win10 version. No idea how that happened, unless it’s something Windows did during the update to v21H1 maybe.

Anyway, I swapped it out for the Win10 file from C:\Windows\Media, ran sfc /scannow, and this time it finally gave me Windows Resource Protection did not find any integrity violations. Hallelujah.

Thanks to everyone who pitched in. Definitely keeping repair installs in mind if anything ever goes catastrophically wrong in the future.

The Component Store should not be entered by users, as there's nothing in there a user needs to access _(coupled with the fact users likely don't realize they need to remove their ACL permissions from it once they've given themselves the permissions to traverse it)_. The **only** correct solution is to run [Steps 1 - 6](https://superuser.com/a/1579031/529800). _(Accessing the Component Store directly is a recipe for disaster waiting to happen by the majority of users who have no understanding of what the Component Store is or how it operates - it is not intended for direct user access.)_ — JW0914, Jun 08 '21 at 14:17

How do I fix this file that SFC flags as corrupted if using a copy straight from a brand-new ISO doesn’t work?

1 Answers1