How do I fix this file that SFC flags as corrupted if using a copy straight from a brand-new ISO doesn’t work?

Question

I recently set up a new Windows 10 PC (then v20H2), and whilst customizing it, I replaced the default “new email” sound (C:\Windows\Media\Windows Notify Email.wav) with the Win8.1 version, which I like better. However, I did this by overwriting the original Win10 audio file with the Win8.1 one, rather than just adding the Win8.1 file to the same directory and renaming it (“Windows Notify Email_Win8.1.wav” or whatever). I’d live to regret that.

I’ve since updated Windows to v21H1. Earlier today I ran SFC /scannow for the first time on this system, and it “found corrupted files but was unable to fix some of them”. In the CBS log I find this:

2021-06-06 02:39:15, Info                  CSI    00000217 Hashes for file member [l:24]'Windows Notify Email.wav' do not match.
 Expected: {l:32 ml:33 b:b04f63d689ae7d627a5dc7895bbe53fb3bf470a43c4f1f6339dd4ab8890ffa6f}.
 Actual: {l:32 b:7897e75ba5b52a8e53431e7af5758a84acdf2d50d6d2a9dd2d90fee0034e11c0}.
2021-06-06 02:39:15, Info                  CSI    00000218 [SR] Cannot repair member file [l:24]'Windows Notify Email.wav' of Microsoft-Windows-Shell-Sounds, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2021-06-06 02:39:15, Info                  CSI    00000219 Hashes for file member [l:24]'Windows Notify Email.wav' do not match.
 Expected: {l:32 ml:33 b:b04f63d689ae7d627a5dc7895bbe53fb3bf470a43c4f1f6339dd4ab8890ffa6f}.
 Actual: {l:32 b:7897e75ba5b52a8e53431e7af5758a84acdf2d50d6d2a9dd2d90fee0034e11c0}.
2021-06-06 02:39:15, Info                  CSI    0000021a [SR] Cannot repair member file [l:24]'Windows Notify Email.wav' of Microsoft-Windows-Shell-Sounds, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2021-06-06 02:39:15, Info                  CSI    0000021b [SR] This component was referenced by [l:154]'Microsoft-Windows-Client-Desktop-Required-Package~31bf3856ad364e35~amd64~~10.0.19041.1023.ACD49602CE22B8D2FE76CB65181A0F3C34476C610F7967574610C8CF843FB4AB'

Here’s a rundown of everything I’ve tried:

• I ran sfc /scannow multiple times, but the error never went away.
• I then ran dism /online /cleanup-image /restorehealth, followed by dism /online /cleanup-image /checkhealth, which found no component store corruption.
• Then some more sfc /scannow passes; still corrupted.
• CBS.log then mentioned something about “the version in the store is also corrupted”.
• I downloaded the 21H1 Media Creation Tool, which I used to download a fresh Win10 v21H1 ISO, which I mounted to I:.
• I ran dism /online /cleanup-image /restorehealth /source:I:\sources\install.esd /limitaccess. Completed successfully.
• dism /online /cleanup-image /checkhealth. Clean bill of health for the component store.
• sfc /scannow, several passes. Still doesn’t fix it.
• Maybe if I replace the file manually?
• I extracted the “Windows\Media\Windows Notify Email.wav” straight from the new ISO’s install.esd, and copied it over the corrupted file on my drive. Successful replacement, no errors of any kind.
• sfc /scannow. Still corrupted, SFC still can’t fix. (That’s when I took the above CBS.log excerpt.)
• I tried deleting the affected file from C:\Windows\Media (actually just moved it to my desktop).
• sfc /scannow gave the same error, and weirdly, CBS.log said the same thing as ever – hash mismatch, rather than “file is missing” or similar. (Didn’t give me a new copy.)
• Incidentally, I checked the C:\Windows\Media folder permissions and enabled full control for TrustedInstaller. Didn’t change anything.
• (Not mentioned: Several reboots throughout all this, just to be safe.)

I’m out of ideas. Even manually replacing the allegedly corrupted file with a copy directly from a brand-new ISO doesn’t work. Even weirder, when I run the file through a hash tool, it gives me the exact same hash (SHA256) that the CBS log says SFC is looking for (“b04………a6f”), rather than the “actual” one. As far as I can tell, it’s a perfectly good copy, yet SFC keeps flagging it as corrupted. And I refuse to do something drastic like resetting my PC, undoing weeks of work setting it up (lots of apps & configurations), just to get SFC to stop tripping over one measly little 160 KB .wav file.

Any help in figuring this out would be really appreciated.

OS: Win10 Pro x64 21H1 (19043.1023)

---

More info: I just again tried deleting “C:\Windows\Media\Windows Notify Email.wav” and running SFC /scannow to see if it would replace it, and it seems doing this is what causes SFC to put this particular error in the CBS log:

Could not reproject corrupted file \??\C:\Windows\Media\\Windows Notify Email.wav; source file in store is also corrupted

To be clear, I haven’t touched the store at all (I don’t even know where it is); I only deleted the “corrupted” file from C:\Windows\Media. Does this provide any useful info, or is it just more noise?

Answer 1

Fixed it! Someone over at Windows 10 Forums pointed me towards the component store folder SFC kept trying to replace the file from – C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2 (which I’d seen in the CBS log but thought it was just some random code, didn’t realize it was a folder) – and when I went there, I found the “Windows Notify Email.wav” file there was somehow the Win8.1 version, rather than the original Win10 version. No idea how that happened, unless it’s something Windows did during the update to v21H1 maybe.

Anyway, I swapped it out for the Win10 file from C:\Windows\Media, ran sfc /scannow, and this time it finally gave me Windows Resource Protection did not find any integrity violations. Hallelujah.

Thanks to everyone who pitched in. Definitely keeping repair installs in mind if anything ever goes catastrophically wrong in the future.