Where are the hashes for for Windows files stored for checking when trying to repair windows with DISM /Online /Cleanup-Image /RestoreHealth

Question

We use a custom windows image.wim for servers.

The only issue we are currently having is when trying to repair the image using: DISM /Online /Cleanup-Image /RestoreHealth /Source:SOURCEIMAGE

We have replaced the .jpg files for the wallpapers to use our own, these files are identified as corrupted when trying to repair:

2023-05-18 09:09:54, Info CSI 00000007 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.14393.0_none_088691afc7246346\img0_1600x2560.jpg do not match actual file [l:18]'img0_1600x2560.jpg' :
Found: {l:32 WACb1nWSwBIC0dlpqpEUi1RTXf0djFY/qBYZOISI6ao=} Expected: {l:32 AFM9FRgYA0A9As3noSfaG1YrhSHXnCTHFqHnAaIBf7I=}

When we use the custom image.wim as the source with the custom .jpg files, it still identifies the files as corrupt, then copies over the files from the source:
CBS Copied file \?\C:\test\offline\windows\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.14393.0_none_088691afc7246346\img0_1600x2560.jpg from directory path: \?\C:\test\offline\windows\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.14393.0_none_088691afc7246346\img0_1600x2560.jpg

then checks again and identifies that the source files are corrupted:

CSI 00000014 Hashes for file member \SystemRoot\WinSxS\Temp\InFlight\6da127741489d90101000000401b4803\e531f6c51489d90102000000401b4803_temp do not match actual file [l:18]'img0_1600x2560.jpg' :
Found: {l:32 WACb1nWSwBIC0dlpqpEUi1RTXf0djFY/qBYZOISI6ao=} Expected: {l:32 AFM9FRgYA0A9As3noSfaG1YrhSHXnCTHFqHnAaIBf7I=}

where is that expected value it is comparing itself to coming from?

Answer 1

Hello Cameron,

Thank you for your question and for reaching out with your question today.

Assuming this is Windows 10 as you have not mentioned an operating system.

You should look here:

C:\windows\system32\config\SAM (Registry: HKLM/SAM)

The SAM file is mounted in the registry as HKLM/SAM. Windows locks this file, and will not release the lock unless it's shut down (restart, BSOD, etc). However, if you look at the SAM entry in the aforementioned registry section, you will not find the hash.

The HASH is stored in memory and cannot be accessed.

If the reply was helpful, please don’t forget to upvote or accept as answer.