How To Check If A File Is Corrupted: Step-by-Step Data Integrity Guide

To check if a file is corrupted, calculate its cryptographic hash value (such as SHA-256 or MD5) and compare it against the original author's published checksum, or inspect the file's header signature (magic bytes) using a hex editor. If the calculated hash deviates by a single character or the magic bytes are missing, the file is structurally compromised. System files can be checked automatically using built-in command-line diagnostic utilities like SFC on Windows or disk-repair commands on macOS.

Pre-Diagnostic Assessment and Diagnostic Tool Setup

Before diagnosing file corruption, you must understand whether you are testing individual user files (such as compressed archives, images, or documents) or core operating system files. System-level checks require administrative access to execution shells, while single-file verification requires standard hash calculators or hex editors.

Operational Requirements and Diagnostic Checklist

• Essential Hardware & Software Utilities:
  
  
  • Windows PowerShell (integrated in Windows 7 and newer) or macOS/Linux Terminal.
  • A GUI-based cryptographic hash calculator (such as HashMyFiles) or a command-line tool.
  • A reliable Hex Editor (such as HxD for Windows or Hex Fiend for macOS) for manual header analysis.
  • Built-in disk analysis tools: Windows CHKDSK and SFC, or macOS Disk Utility.
• Mandatory Prerequisite Knowledge:
  
  
  • Basic familiarity with command-line syntax and file directory navigation.
  • An understanding of cryptographic hashing concepts (MD5, SHA-1, and SHA-256).
  • Knowledge of the original file properties, such as expected file extension and approximate size.
• Estimated Budget and Duration Benchmarks:
  
  
  • Cost: 0 USD (All tools utilized in this guide are native to modern operating systems or available as open-source freeware).
  • Time to Complete: 3 to 10 minutes per file; 15 to 30 minutes for entire system drives.

Diagnostic Framework for Verifying File Integrity

Follow these precise sequential processes to identify and confirm file corruption across different platforms and file types.

Step 1: Analyze File Size and System Metadata Properties

The initial step in diagnosing file corruption is examining the metadata exposed by the operating system's file manager. Corrupted files often display anomalies in file size, structural creation dates, or generic icons.

First, locate the suspicious file in Windows File Explorer or macOS Finder. Right-click the file and select Properties (Windows) or Get Info (macOS). Observe the File Size value. If the file size displays as exactly 0 KB or 0 Bytes, the system has created a master file table allocation entry, but no physical data payload was written to the storage sector. This indicates a fatal file write interruption or a sector allocation error.

Next, compare the file's current size with its known origin size, if documented. A compressed ZIP archive or an installer file that is even a single byte smaller than its source is truncated and will fail execution. Additionally, if the file icon has reverted to a blank, generic sheet of paper icon, the operating system can no longer read the file's header block to determine its MIME type or register its default application handler.

Warning: Do not attempt to force open a file that displays 0 KB or an unreadable icon. Attempting to force-load corrupted executable binaries or macro-enabled documents into their native applications can cause the host software to hang, crash, or write corrupted temporary swap files over healthy disk sectors.

Step 2: Calculate and Validate Cryptographic Checksums

A cryptographic hash or checksum is a digital fingerprint of a file. If even a single bit of data changes due to corruption, the resulting hash value changes completely. This mathematical phenomenon is known as the avalanche effect.

To check file integrity on Windows using native PowerShell, press the Windows Key, type PowerShell, right-click the application, and select Run as Administrator. To calculate the SHA-256 hash of a file, enter the following command, replacing the placeholder path with your actual file path:

Get-FileHash -Path "C:\Users\Username\Documents\TargetFile.zip" -Algorithm SHA256

Press Enter. The utility will output an alphanumeric string containing 64 characters. Copy this string and compare it directly against the SHA-256 hash provided by the software developer or content source. If the characters match exactly, your file is structurally intact. If they do not match, the file is corrupted, altered, or incomplete.

To calculate an MD5 hash on macOS or Linux, open your Terminal utility and input the following command:

md5 /Users/Username/Documents/TargetFile.zip

On Linux systems, use the equivalent utility by typing:

md5sum /home/user/documents/TargetFile.zip

Compare the resulting 32-character hexadecimal string with the source value to confirm integrity.

Pro-Tip: If you are checking large media or ISO files over a network, run a CRC32 checksum verification instead of SHA-256. CRC32 calculates much faster and is highly effective at detecting accidental, hardware-induced transmission corruption, though it should not be relied upon for security verification.

Step 3: Inspect File Signatures and Magic Bytes in a Hex Editor

Every standard file format begins with a unique sequence of bytes called "magic bytes" or a file signature. These bytes tell the operating system and applications how to parse the incoming data stream. Corruption in this header area prevents programs from recognizing the file.

Download and install an open-source hex editor like HxD (for Windows) or Hex Fiend (for macOS). Open the hex editor, click File, select Open, and load your suspicious file.

Look at the very first row of hexadecimal numbers, specifically the first four to eight bytes (offset 00000000). For example, a healthy PDF file must always begin with the hexadecimal sequence 25 50 44 46, which translates to the ASCII characters %PDF in the text representation panel on the right. A healthy JPEG image file always starts with FF D8 FF and ends with FF D9. An executable file (.exe) must always begin with 4D 5A (ASCII characters MZ).

If you open your suspected file in the hex editor and find that offset 00000000 consists entirely of zeros (00 00 00 00) or random, unpatterned characters that do not match the standard file signature, the header of your file has been wiped or overwritten. This confirms file corruption at the structural level.

Step 4: Run Operating System File Integrity Diagnostics

If you suspect your operating system's system files (such as DLLs or core configuration files) are corrupted, you can run automated recovery utilities built into the operating system.

On Windows, open an elevated Command Prompt by searching for cmd in the taskbar, right-clicking it, and selecting Run as Administrator. Type the following command and press Enter:

sfc /scannow

The System File Checker (SFC) will scan all protected operating system files, comparing their cryptographic hashes against a cached, clean system image stored in the WinSxS directory. If SFC detects mismatched hashes, it will automatically replace the corrupted files with healthy copies.

If SFC cannot repair the files, run the Deployment Image Servicing and Management utility to fix the underlying system component store first. Type:

DISM /Online /Cleanup-Image /RestoreHealth

Once this completes, rerun the sfc /scannow command to finalize repairs.

On macOS, restart your system and hold Command + R to enter Recovery Mode. Open Disk Utility, select your startup volume (typically Macintosh HD), and click First Aid. This utility scans the Apple File System (APFS) metadata, directory structures, and catalog files, identifying and repairing system-level corruption.

File Integrity Assessment and Verification Matrix

The following table compares different file validation methods, detailing their primary use cases, processing speeds, and the specific types of file system anomalies they are engineered to identify.

Resolving Unreadable Data and Structural Corruption Failures

When validating files, you may encounter specific diagnostic roadblocks or failure messages. Below are the most common real-world failure scenarios along with their root causes and actionable remedies.

Scenario 1: Calculated Cryptographic Hash Does Not Match Source Checksum

• Root Cause: The file was interrupted during download or transfer, resulting in lost packets. This can also indicate silent data corruption (bit rot) on your storage drive, or that the file was modified by a third party.
• Actionable Fix: Clear your browser cache and download the file over a wired network connection to prevent packet loss. If the hash mismatch persists across multiple downloads, contact the file provider; the source file on the server may have been corrupted during upload.

Scenario 2: "The file is corrupted and cannot be opened" Error in Microsoft Office

• Root Cause: Microsoft Office applications utilize Protected View to block files containing invalid metadata headers or files downloaded from external networks that do not pass structural validation checks.
• Actionable Fix: Right-click the file, select Properties, and look for a security warning at the bottom of the General tab stating the file came from another computer. Click the Unblock checkbox and apply the changes. If this fails, open the host application (such as Excel or Word), navigate to File, select Open, browse to the file, click the arrow next to the Open button, and select Open and Repair.

Scenario 3: The Target File Displays as Zero Bytes

• Root Cause: A system crash, sudden power loss, or forced drive disconnection occurred while the application was writing data to the storage sector. The file system updated the directory index, but the physical sectors remain empty.
• Actionable Fix: Zero-byte files contain no actual data payloads, meaning they cannot be repaired using hex editors or reconstruction utilities. You must restore the file from a Volume Shadow Copy (right-click the file, select Restore previous versions), pull the file from an automated cloud backup service, or run a data recovery tool like Recuva or TestDisk to scan for deleted, unindexed versions of the file.

Scenario 4: Command Line SFC Utility Returns "Windows Resource Protection found corrupt files but was unable to fix some of them"

• Root Cause: The local offline system image cache (the source repository used to replace damaged files) is itself corrupted, preventing the SFC tool from matching and replacing system files.
• Actionable Fix: Connect your computer to a stable internet connection. Run the DISM /Online /Cleanup-Image /RestoreHealth command in an elevated command prompt. This forces Windows to download clean replacement binaries directly from the official Microsoft Windows Update servers. After the DISM process reaches 100% completion, execute the sfc /scannow command again to repair the local system files.

Frequently Asked Questions

Can a corrupted file be repaired without backups?

A corrupted file can only be repaired if the corruption is limited to the metadata headers or if the file format includes built-in redundancy (such as WinRAR archives with recovery records). If the core data payload is overwritten by zeros or random characters, reconstruction is mathematically impossible without restoring a previous version or utilizing specialized recovery tools to locate fragmented disk sectors.

What causes files to become corrupted?

File corruption is typically caused by sudden system power losses, storage device wear (bad sectors on hard disk drives or flash cell degradation on solid-state drives), faulty system memory (RAM), interrupted network transfers, or software crashes during active write operations. Additionally, malware can deliberately overwrite file headers to disable system diagnostics or compromise user data.

How do I check for file corruption on macOS?

To check system file corruption on macOS, restart your computer and hold Command + R to launch macOS Recovery, then run First Aid within Disk Utility. To check individual user files on a Mac, open Terminal and run diagnostic utilities such as md5 or shasum to calculate the cryptographic hash of the file and compare it against the source checksum.

How can I tell if an image file is corrupted without opening it?

You can identify corrupted images by checking their file size anomalies, viewing them in a hex editor to verify they begin with correct magic bytes (such as FF D8 FF for JPEG), or by running command-line bulk verification tools like ImageMagick. If the command identify filename.jpg returns structural parsing errors, the image file is corrupted.

How do I check if my hard drive is corrupting my files?

To verify if your storage media is corrupting files, check the drive's self-monitoring hardware parameters. On Windows, run the Command Prompt command wmic diskdrive get status, or use a third-party utility like CrystalDiskInfo to read the drive's S.M.A.R.T. attributes. High counts in Reallocated Sectors or Current Pending Sectors indicate physical hardware degradation that leads to file corruption.

Protect Your Data Assets from Silent Corruption

To secure your critical business documents and system configurations from silent data corruption, implement a automated, multi-tiered backup routine. Utilize robust storage file systems like ZFS or ReFS that feature automated self-healing data integrity verification to stop file damage before it impacts your workflow.