Practical Lab: System File Exploration

Objective

Walk through the most important Windows folders and files on your own PC, check their owners and permissions, and ask Windows whether its system files are healthy. You only look. Nothing in this lab deletes, renames, moves or repairs anything.

Time: 25–30 minutes
You need: A Windows 10 or 11 PC. Parts 5 and 6 need an administrator window (one extra approval click).

SAFETY RULES — read first

1. Never delete, rename or move anything inside C:\Windows, C:\Program Files, System Volume Information or the root hidden files. Only open and read.
2. Do not double-click .exe files in System32 "to see what they do". Some change settings.
3. If you untick Hide protected operating system files, tick it again at the end.
4. Do not run sfc /scannow or DISM /RestoreHealth in this lab. Only the read-only checks are used.

What to Open

Part 1: Browse the Folders (File Explorer, View Only)

Open C:\ in File Explorer. You will probably see only Program Files, Program Files (x86), Users and Windows.

1A. Show hidden items. Choose View → Show → Hidden items (Windows 11), or the View tab → Hidden items (Windows 10). New folders appear.

1. Which new folders appeared in C:\? (Look for ProgramData, maybe $Recycle.Bin.) ________________

1B. Show protected files. Open View → Options → View tab, untick Hide protected operating system files (Recommended), confirm the warning, then click OK. Now look again.

2. Do you see pagefile.sys? hiberfil.sys? swapfile.sys? Write the sizes you see in the Properties box (right-click → Properties). ________________
3. Do you see System Volume Information? (Double-click it. You should get Access denied. That is correct and good.) ________________
4. Is there a Recovery folder? ________________

1C. Now put things back. Re-open View → Options → View and tick Hide protected operating system files (Recommended) again.

Part 2: Walk Through Windows (View Only)

Open C:\Windows. Look, don't touch. Fill in what you see:

5. Is there a System32 folder and a SysWOW64 folder? (If SysWOW64 is missing, your Windows is 32-bit.) ________________
6. Is explorer.exe in C:\Windows or in System32? ________________
7. Open C:\Windows\System32\drivers. Find ntfs.sys. How big is it? (Right-click → Properties.) ________________
8. Open C:\Windows\System32\config. You may get a permission prompt. If so, click Cancel. Do not continue. (These are the live registry hive files from Chapter 17.) ________________
9. Open C:\Windows\Fonts. Roughly how many fonts? ________________
10. Open C:\Windows\Logs. Which sub-folders do you see? ________________

Part 3: Seeing the Same Things from the Command Line

Open a normal PowerShell (not admin). Type each line and press Enter:

Get-ChildItem C:\ -Force
Get-ChildItem C:\Windows -Directory | Select-Object Name
Get-Item C:\Windows\System32\ntoskrnl.exe | Select-Object Name, Length, LastWriteTime
Get-Item C:\Windows\explorer.exe | Select-Object Name, Length, LastWriteTime

-Force means "also show hidden and system items". Compare with Part 1.

11. What is the size (Length, in bytes) of ntoskrnl.exe? ________________
12. Does Get-ChildItem C:\ -Force show pagefile.sys? ________________

And in Command Prompt (cmd):

dir /a C:\
dir /a:h C:\

13. What does /a:h show? (hint: hidden items only) ________________

Part 4: Who Owns the System Files? (Read Permissions)

These commands only read permissions.

Get-Acl C:\Windows\System32\kernel32.dll | Format-List Owner
(Get-Acl C:\Windows\System32\kernel32.dll).Access | Select-Object IdentityReference, FileSystemRights, AccessControlType

icacls C:\Windows\System32\kernel32.dll

14. Who is the owner of kernel32.dll? ________________ (Look for NT SERVICE\TrustedInstaller.)
15. What rights does the Administrators group have? ________________ (Look for R, RX, or "ReadAndExecute", not full control.)
16. Which identity has Full control (F)? ________________

Now compare with your own file:

Get-Acl "$env:USERPROFILE\Documents" | Format-List Owner

17. Who owns your Documents folder? ________________

This is why even an administrator cannot casually delete kernel32.dll: the owner is TrustedInstaller (Section 3.2).

Part 5: Ask Windows if Its Files Are Healthy (Admin, Read-Only)

Open Command Prompt or PowerShell as administrator. Run:

sfc /verifyonly

This scans protected system files and only reports; it fixes nothing. It can take several minutes. Wait until it reaches 100 percent. Typical results:

Then run the quick component store check:

DISM /Online /Cleanup-Image /CheckHealth

Typical results (wording may vary): "No component store corruption detected", or a message saying the store is repairable or not repairable.

18. What did sfc /verifyonly report? ________________
19. What did DISM /CheckHealth report? ________________

CheckHealth only reads a flag Windows already stored. It does not do a deep scan, and changes nothing.

Part 6: Look at the Component Store (Optional, Admin)

DISM /Online /Cleanup-Image /AnalyzeComponentStore

This analyzes WinSxS and only reports. It can take a minute or two. Look for lines such as Windows Explorer Reported Size of Component Store, Actual Size of Component Store, and Component Store Cleanup Recommended (Yes or No). Do not run the StartComponentCleanup command in this lab.

20. Explorer-reported size: ________________ Actual size: ________________
21. Is cleanup recommended? ________________

Why are the two sizes different? Because many files in WinSxS are hard links (Section 1.4), counted twice by Explorer.

Part 7: Spot the System Processes (Task Manager)

Open Task Manager → Details tab. Find these and add the Image path name column (right-click a column header → Select columns).

22. Find smss.exe, csrss.exe, wininit.exe, services.exe, lsass.exe, winlogon.exe. Are they all in C:\Windows\System32? ________________
23. How many csrss.exe are there? (Expect two on a PC with one signed-in user.) ________________
24. How many svchost.exe are there? ________________
25. Where is explorer.exe running from? ________________

Do not end any of these processes. This is read-only.

What Should Happen

• Part 1 and 2 show hidden items on, System Volume Information blocked, and System32 and SysWOW64 both present on 64-bit Windows.
• Part 3 gives the same facts as File Explorer, from the command line.
• Part 4 shows TrustedInstaller as the owner and Administrators with only read rights.
• Part 5 and 6 report a healthy PC (usually) without changing anything.

Interpretation Guide

Follow-Up Questions

1. Why does the name System32 still hold 64-bit files on a modern PC?
2. Why does File Explorer hide pagefile.sys and System Volume Information by default?
3. Why can an administrator not delete kernel32.dll straight away, and why should they not try?
4. If sfc /verifyonly reported violations, which two commands would you run (in order) to repair them?
5. Name three facts from this lab that you could not have learned just by looking at the Desktop.