Windows System Files: Where They Are Stored, How to Display or Restore Them

Read about what files are called system files, their names and extensions, and where you can find them. We’ll find out what to do if system files get damaged and how they can be restored with the SFC checking tool.

A personal computer, smartphone, tablet PC, laptop – everyone knows these words, and we see and use these devices every day. All these things help their users solve various tasks while saving time and money.

What files are system files?

Modern computers and other gadgets are pretty small and compact while offering high performance and effective data processing capacity. It takes advanced software – an operating system – to use all the wide functionality of computer devices. The operating system should let the user adjust the interface to suit individual needs, manage all processes without errors and failures, be extremely effective, convenient to use and never bottleneck the hardware components of a device.

Windows, the Microsoft operating system, meets the above requirements in every way. It’s got a user-friendly customizable interface so that every user can configure the operating system to satisfy their needs. The high performance of this operating system is perfectly combined with intuitive computer control and management tools so the ease of use comes along with high efficiency.

In fact, the Windows operating system is a program shell which lets the user install applications and other software required to perform certain tasks.

To ensure correct work of the entire operating system, its full-fledged operation and opportunities to use additional software, Windows uses special system files.

Technically, Windows system files are any files with the “hidden” system attribute enabled. These include hardware drivers, configuration files, DLL (dynamic link library) files and various sets of files that make up the Windows registry.

Such files are often modified automatically when the operating system is updated or applications are installed, but the usual rule is you shouldn’t try to modify system files on your own. Deleting, moving, renaming or changing these files in any way can result in certain apps refusing to start, some system elements crashing, or even the entire system failing to work. That is why system files are often hidden and accessible to users as read-only files. However, there’s a lot of advice and recommendations (you can find some of the stuff described in our website) on modifying system files.

If you are an advanced PC user, acting carefully and confident of what you’re doing, or you follow a certain guide you trust absolutely, then you may gain a kind of advantage from using such advice.

Where are system files stored?

Usually system files are found in certain folders which are identified as system folders. In Windows operating systems, these files are hidden by default to prevent them from being deleted accidentally. Also, they are not shown in search results to save the system from undesirable consequences.

Actually, system files can be found in many locations on your PC. For example, the root folder of your system disk (C:\) contains system files such as the paging file (pagefile.sys) and the hibernation file (hiberfil.sys).

Most system files of a Windows operating system are stored in the folder C:\Windows, especially in such subfolders as /System32 and /SysWOW64. You will also find system files in a user’s folder (for example, AppData) and application folders (for example, Program Data or Program Files).

How to display hidden system files in Windows?

Though system files are hidden by default in a Windows operating system, you can easily change the settings to make them visible.

Just remember that deleting, moving, editing or renaming these files can cause all kinds of issues affecting reliability and correct work of your operating system. The right decision, after all, is to leave the system files hidden as they were. But if you work with system files deliberately and follow certain advice or recommendations, then make them visible, do your job, and then make them hidden again.

To enable displaying system files in a Windows operating system, you’ll have to open This PC in the File Explorer. In the window that opens, go to the tab View. In this tab find Options which contains settings for opening elements, presentation of files and folders, and open the nested menu. In the pop-up menu, select Change folder and search options.

In the Folder Options window go to the View tab and in the section Advanced settings drag the slider down until you can uncheck the box Hide protected operating system files (Recommended). The Windows operating system will show you a warning to make sure that you realize what you’re going to do. Confirm your choice by clicking on the Yes button. Then click Apply and OK to save the changes you have made to file and folder view settings.

Now you’ll be able to see hidden system files in the Windows File Explorer. Note that the icons for system files look dimmer than the non-system files icons. This is a special feature to mark them as more important.

What happens if system files are damaged?

The answer really depends on what system files are damaged, that’s why the final symptoms may range from some applications failing to start or working incorrectly to BSOD errors or even the Windows operating system crashing completely – which makes the OS absolutely no good to use.

If you suspect that some system files are damaged or missing, there are several built-in tools inside the operating system to help you out of trouble. The System File Check (SFC) tool scans Windows system files and can replace any missing or damaged files detected during the test. The Windows Deployment Image Servicing and Management (DISM) can be used to eliminate the problems that prevent the SFC tool from performing its functions properly. Using the two apps together you’ll be able to restore successfully any missing or damaged system files.

SFC scans your computer to detect possible damage or any other changes in Windows system files. If the SFC checking tool finds a system file that has been changed, the file will be replaced automatically with its correct version.

To launch the SFC tool you will have to use the Command Prompt utility started with Administrator rights. There are many ways to open this app. We’ll describe several of them so you can use the one you like best.

Method one: Open This PC in the File Explorer and then go to the system folder C:/. Open the Windows folder and go to the subfolder System32. Drag the slider box down and find the file cmd.exe. Right-click on it and open a pop-up menu. From the list of possible actions, select Run as administrator.

Method two: Click on the Start button in the lower left corner of your desktop, on the Taskbar, and open the main Windows menu. In the list of all installed applications, drag the slider down and find the section Windows System. In the drop-down menu, find the line Command Prompt and right-click on it. From the list of possible actions in the More section, select Run as administrator.

Method three: Click the Search button on the Taskbar (you can find it next to the Start button) and open the search panel. Enter command or cmd into the search field. The Best match section will show you the result you were looking for – Command Prompt. Right-click on it and select Run as administrator in the menu.

When the pop-up notification from Windows User Account Control asks “Do you want to allow this app to make changes to your device?” click Yes and the command prompt with administrator rights will open.

Enter the command sfc /scannow into the Command Prompt window to launch the Windows system file checking utility.

Results of the system scan with description of all actions will be shown in the application window.

If all the actions described above didn’t work and you failed to fix the damaged system files, you can always update or reset your computer’s operating system settings. However, this solution should only be used as the last resort. All your personal files will be preserved, but any applications will be removed after you reset the operating system.

If all the actions described above didn’t work and you failed to fix the damaged system files, you can always update or reset your computer’s operating system settings. However, this solution should only be used as the last resort. All your personal files will be preserved, but any applications will be removed after you reset the operating system.

Author: Vladimir Artiukh, Technical Writer

Vladimir Artiukh is a technical writer for Hetman Software, as well as the voice and face of their English-speaking YouTube channel, Hetman Software: Data Recovery for Windows. He handles tutorials, how-tos, and detailed reviews on how the company’s tools work with all kinds of data storage devices. Read more

Windows 7 File System Structure

Formally, a file system is a way to organize, store and name data at information storage devices. But we can say simpler: it is a format of saving information at various storage devices and, in the first place, at the computer hard disk. Windows 7 utilizes the NTFS file system which is the most commonly used system nowadays.

The core of the NTFS is the MFT (Master File Table). This is a file of a special format that is located on the MFT zone of a partition. This zone is only available to OS service applications and to specialized tools that can address the hard drive directly. The MFT is a table that lists all files with their attributes and security parameters. But that’s not all. The MFT also stores addresses of sectors where file contents are physically stored. This is very important information, without it the operating system simply wouldn’t know where the requested object is, and where it should move the reading head of the hard drive to.

So, we have learned the basics of the file system, so let’s look at Windows 7 itself now. As any other operating system it has several folders that we can call system. By default they are the same for all users of this OS. Some of them are crucial, so you better not touch them, otherwise you may experience system faults. The contents of others may be changed safely.

Windows

Undoubtedly the most important folder located on the system partition of the hard disk. It keeps all system executables, drivers, libraries and so on. That is why it is strongly not recommended to delete files from that folder. It is worth to mention, that this folder may have a different name.

Windows.old

The folder with a previous operating system. The folder is created if Windows 7 was installed over the existing system without the preliminary formatting of the disk. For the majority of users this folder isn’t necessary and may be safely deleted.

Users

This folder contains user profiles. By default it is located in the root folder of the system partition. It contains a number of standard folders, and also a folder per each user account in the system. These folders contains various user subfolder including the Desktop, the Documents, the Pictures, the Favorites and so on. The contents of those folder depends on the owner of the account in full. Other subfolder are used to store information of various applications, browsers etc.: AppData, ApplicationData, Cookies, LocalSettings and others. These folders are hidden and you shouldn’t change their contents unless you are really sure what you’re doing.

This folder contains operating system boot files. It is hidden, and it is not recommended to change its contents.

ProgramData

One more crucial folder. Installed applications store their data, setup files and other info in that folder. Obviously, you don’t want to delete anything from it.

Recovery

This folder contains an image required to log in to the system Recovery Console. It is hidden too and you can’t change its contents.

$Recycle.Bin

This folder is actually Windows Recycle Bin. It is this folder where the deleted files go to. The folder is hidden, but you can safely delete its contents as well as the folder itself. This will be equal to emptying the Recycle Bin or a part of it. Note that each hard drive partition has its own $Recycle.Bin folder that stores files deleted from it.

Mar 09, 2011 (updated: Jan 11, 2014 ), Chemtable Software

The basics of file systems

Presently, the computer market offers a huge variety of opportunities for storing information in the digital form. Existing storage devices include internal and external hard drives, memory cards of photo/video cameras, USB flash drives, RAID sets along with other complex storage systems. Pieces of data are kept on them in the form of files, like documents, pictures, databases, email messages, etc. which have to be efficiently organized on the disk and easily retrieved when needed.

The following article provides a general overview of the file system, the major means of data management on any storage, and describes the peculiarities of different file system types.

What is a file system?

Any computer file is stored on a storage medium with a given capacity. In actual fact, each storage is linear space for reading or both reading and writing digital information. Each byte of information on it has its offset from the storage start known as an address and is referenced by this address. A storage can be presented as a grid with a set of numbered cells (each cell is a single byte). Any file saved to the storage gets its own cells.

Generally, computer storages use the pair of a sector and in-sector offset to reference any byte of information on the storage. A sector is a group of bytes (usually 512 bytes), a minimum addressable unit of the physical storage. For example, byte 1040 on a hard disk will be referenced as a sector #3 and offset in sector 16 bytes ([sector]+[sector]+[16 bytes]). This scheme is applied to optimize storage addressing and to use a smaller number to refer to any portion of information located on the storage.

To omit the second part of the address (in-sector offset), files are usually stored starting from the sector start and occupy whole sectors (e.g.: a 10-byte file occupies the whole sector, a 512-byte file also occupies the whole sector, at the same time, a 514-byte file occupies two entire sectors).

Each file is stored in «unused» sectors and can be read later by its known position and size. However, how do we know which sectors are occupied and which are free? Where are the size, position and name of the file stored? This is exactly what the file system is responsible for.

As a whole, a file system is a structured representation of data and a set of metadata describing this data. It is applied to the storage during the format operation. A file system serves for the purposes of the whole storage and is also a part of an isolated storage segment – a disk partition. Usually, a file system operates blocks, not sectors. File system blocks are groups of sectors that optimize storage addressing. Modern file systems generally use block sizes from 1 to 128 sectors (512-65536 bytes). Files are usually stored at the start of a block and take up entire blocks.

Constant write/delete operations in the file system cause its fragmentation. Thus, files are not stored as whole units, but get divided into fragments. For example, a storage is completely occupied by files with the size of about 4 blocks each (e.g. a collection of photos). A user wants to store a file that will take up 8 blocks and therefore deletes the first and the last files. By doing this, he or she frees the space of 8 blocks, however, the first segment is located near to the storage start while the second one – to the storage end. In this case, the 8-block file is split into two parts (4 blocks for each part) and takes the free space «holes». The information about both fragments as parts of a single file is stored in the file system.

In addition to user’s files, the file system also contains its own parameters (such as a block size), file descriptors (including file size, file location, its fragments, etc.), file names and directory hierarchy. It may also store security information, extended attributes and other parameters.

To comply with diverse users’ requirements, such as storage performance, stability and reliability, plenty of file systems are developed to be able to serve different purposes more effectively.

File systems of Windows

Microsoft Windows employs two major file systems: NTFS, the primary format most modern versions of this OS use by default, and FAT, which was inherited from old DOS and has exFAT as its later extension. The ReFS file system was also introduced by Microsoft as a new generation file system for server computers starting from Windows Server 2012. The HPFS file system developed by Microsoft together with IBM can be found only on extremely old machines running Windows NT up to 3.5.

FAT (File Allocation Table) is one of the simplest file system types, which has been around since the 1980s. It consists of the file system descriptor sector (boot sector or superblock), the file system block allocation table (referred to as the File Allocation Table) and plain storage space for storing files and folders. Files in FAT are stored in directories. Each directory is an array of 32-byte records, each defining a file or extended attributes of a file (e.g. a long file name). A file record attributes the first block of a file. Any next block can be found through the block allocation table by using it as a linked list.

The block allocation table contains an array of block descriptors. A zero value indicates that the block is not used and a non-zero one relates to the next block of a file or a special value for the file end.

The numbers in FAT12, FAT16, FAT32 stand for the number of bits used to enumerate a file system block. This means that FAT12 can use up to 4096 different block references, while FAT16 and FAT32 can use up to 65536 and 4294967296 accordingly. The actual maximum count of blocks is even less and depends on the implementation of the file system driver.

FAT12 and FAT16 used to be applied to old floppy disks and do not find extensive employment nowadays. FAT32 is still widely used for memory cards and USB sticks. The system is supported by smartphones, digital cameras and other portable devices.

FAT32 can be used on Windows-compatible external storages or disk partitions with the size under 32 GB (Windows cannot create a FAT32 file system which would be larger than 32 GB, although Linux supports the size up to 2 TB) and doesn’t allow creating files the size of which exceeds 4 GB. To address this issue, exFAT was introduced, which doesn’t have any realistic limitations concerning the size of files or partitions and is frequently utilized on modern external hard drives and SSDs.

NTFS (New Technology File System) was introduced in 1993 with Windows NT and is currently the most common file system for end user computers based on Windows. Most operating systems of the Windows Server line use this format as well.

The file system is quite reliable thanks to journaling and supports many features, including access control, encryption, etc. Each file in NTFS is stored as a file descriptor in the Master File Table and file content. The Master file table contains entries with all information about files: size, allocation, name, etc. The first 16 entries of the Master File Table are retained for the BitMap, which keeps record of all free and used clusters, the Log used for journaling records and the BadClus containing information about bad clusters. The first and the last sectors of the file system contain file system settings (the boot record or the superblock). This file system uses 48 and 64 bit values to reference files, thus being able to support data storages with extremely high capacity.

ReFS (Resilient File System) is the latest development of Microsoft introduced with Windows 8 and now available for Windows 10. The file system architecture absolutely differs from other Windows file systems and is mainly organized in a form of the B+-tree. ReFS has high tolerance to failures due to new features included into the system. The most noteworthy one among them is Copy-on-Write (CoW): no metadata is modified without being copied; data is not written over the existing data – it is placed to another area on the disk. After any file modifications, a new copy of metadata is saved to a free area on the storage, and then the system creates a link from older metadata to the newer copy. Thus, the system stores a significant quantity of older backups in different places providing easy file recovery unless this storage space is overwritten.

HPFS (High Performance File System) was created by Microsoft in cooperation with IBM and introduced with OS/2 1.20 in 1989 as a file system for servers that could provide much better performance when compared to FAT. In contrast to FAT, a file system which simply allocates any first free cluster on the disk for the file fragment, HPFS seeks to arrange the file in contiguous blocks, or at least ensure that its fragments (referred to as extents) are placed maximally close to each other. At the beginning of HPFS, there are three control blocks occupying 18 sectors: the boot block, the super block and the spare block. The remaining storage space is divided into parts of contiguous sectors referred to as bands taking 8 MB each. A band has its own sector allocation bitmap showing which sectors in it are occupied (1 – taken, 0 – free). Each file and directory has its own F-Node located close to it on the disk – this structure contains the information about the location of a file and its extended attributes. A special directory band located in the center of the disk is used for storing directories while the directory structure itself is a balanced tree with alphabetical entries.

Hint: The information concerning data recovery perspectives of the file systems used by Windows can be found in the articles on data recovery specificities of different OS and chances for data recovery. For detailed instructions and recommendations, please, read the manual devoted to data recovery from Windows.

File systems of macOS

Apple’s macOS applies two file systems: HFS+, an extension to their legacy HFS file system used on old Macintosh computers, and APFS, a format employed by modern Macs running macOS 10.14 and later.

HFS+ used to be the primary file system of Apple desktop products, including Mac computers, iPods, as well as Apple X Server products before it was replaced by APFS in macOS High Sierra. Advanced server products also use Apple Xsan file system, a clustered file system derived from StorNext and CentraVision.

The HFS+ file system uses B-trees for placing and locating files. Volumes are divided into sectors, typically 512 bytes in size, which are then grouped into allocation blocks, the number of which depends on the size of the entire volume. The information concerning free and used allocation blocks is kept in the Allocation File. All allocation blocks assigned to each file as extends are recorded in the Extends Overflow File. And, finally, all file attributes are listed in the Attributes file. Data reliability is improved through journaling which makes it possible to keep track of all changes to the system and quickly return it back to the working state in case of unexpected events. Among other supported features are hard links to directories, logical volume encryption, access control, data compression, etc.

The Apple file system is aimed to address fundamental issues present in its predecessor and was developed to efficiently work with modern flash storages and solid-state drives. This 64-bit file system uses the copy-on-write method to increase performance, which allows to copy each block before the changes to it are applied, and offers a lot of data integrity and space-saving features. All the file contents and metadata about files, folders along with other APFS structures are kept in the APFS container. The Container Superblock stores information about the number of blocks in the Container, the block size, etc. Information about all allocated and free blocks of the Container is managed with the help of Bitmap Structures. Each volume in the Container has its own Volume Superblock which provides information about this volume. All files and folders of the volume are recorded in the File and Folder B-Tree, while the Extents B-Tree is responsible for extents – references to file contents (file start, its length in blocks).

Hint: The details related to the possibility of data recovery from these file systems can be found in the articles about the peculiarities of data recovery depending on the operating system and chances for data recovery. If you’re interested in the practical side of the procedure, please, refer to the guide on data recovery from macOS.

File systems of Linux

Open-source Linux aims at implementing, testing and using different types of file systems. The most popular Linux file systems include:

Ext2, Ext3, Ext4 are simply different versions of the «native» Linux Ext file system. This file system falls under active developments and improvements. Ext3 file system is just an extension of Ext2 that uses transactional file writing operations with a journal. Ext4 is a further development of Ext3, extended with the support of optimized file allocation information (extents) and extended file attributes. This file system is frequently used as a «root» file system for most Linux installations.

ReiserFS

ReiserFS — an alternative Linux file system optimized for storing a huge number of small files. It has a good capability for files search and enables compact allocation of files by storing tails of files or simply very small files along with metadata in order to avoid using large file system blocks for this purpose. However, this file system is no longer actively developed and supported.

XFS — a robust journaling file system that was initially created by Silicon Graphics and used by the company’s IRIX servers. In 2001, it made its way to the Linux kernel and is now supported by most Linux distributions, some of which, like Red Hat Enterprise Linux, even use it by default. This file system is optimized for storing very big files and file systems on a single host.

JFS — a file system developed by IBM for the company’s powerful computing systems. JFS1 usually stands for JFS, JFS2 is the second release. Currently, this file system is open-source and implemented in most modern Linux versions.

Btrfs

Btrfs — a file system based on the copy-on-write principle (COW) that was designed by Oracle and has been supported by the mainline Linux kernel since 2009. Btrfs embraces the features of a logical volume manager, being able to span multiple devices, and offers much higher fault tolerance, better scalability, easier administration, etc. together with a number of advanced possibilities.

F2FS – a Linux file system designed by Samsung Electronics that is adapted to the specifics of storage devices based on the NAND flash memory that are widely used in modern smartphones and other computing systems. The file system works on the basis of the log-structured file system approach (LFS) and takes into account such peculiarities of flash storage as constant access time and a limited number of data rewriting cycles. Instead of creating one large chunk for writing, F2FS assembles the blocks into separate chunks (up to 6) that are written concurrently.

The concept of «hard links» used in this kind of operating systems makes most Linux file systems similar in that the file name is not regarded as a file attribute and rather defined as an alias for a file in a certain directory. A file object can be linked from many locations, even multiply from the same directory under different names. This can lead to serious and even insurmountable difficulties in recovery of file names after file deletion or file system damage.

Hint: The information concerning the possibility of successful recovery of data from the mentioned file systems can be found in the articles describing the specifics of data recovery from different operating systems and chances for data recovery. To get a grasp on how the procedure should be carried out, please, use the manual on data recovery from Linux.

File systems of BSD, Solaris, Unix

The most common file system for these operating systems is UFS (Unix File System) also often referred to as FFS (Fast File System).

Currently, UFS (in different editions) is supported by all Unix-family operating systems and is a major file system of the BSD OS and the Sun Solaris OS. Modern computer technologies tend to implement replacements for UFS in different operating systems (ZFS for Solaris, JFS and derived file systems for Unix etc.).

Hint: The information about the likelihood of a successful result when it comes to data recovery from these file systems can be found in the articles about OS-specific peculiarities of data recovery and chances for data recovery. The process itself is described in the instruction dedicated to data recovery from Unix, Solaris and BSD.

Clustered file systems

Clustered file systems are used in computer cluster systems. These file systems support distributed storage.

Distributed file systems include:

ZFS – Sun company «Zettabyte File System» — a file system developed for distributed storages of Sun Solaris OS.

Apple Xsan – the Apple company evolution of CentraVision and later StorNext file systems.

VMFS – «Virtual Machine File System» developed by VMware company for its VMware ESX Server.

GFS – Red Hat Linux «Global File System«.

JFS1 – the original (legacy) design of IBM JFS file system used in older AIX storage systems.

Common properties of these file systems include distributed storages support, extensibility and modularity.

To learn about other technologies used to store and manipulate data, please, refer to the storage technologies section.