Solved How to delete "System Volume Information" folder on Win 7

[Master V]

As an FYI to those that (may still) need to get control of these system files...
Remember, the windows POWER SHELL is your friend. I can't emphasize enough how more useful it is. The Power Shell (PS) is to the 'elevated dos shell (Command Shell ran as Administrator) as the elevated dos shell is so the ‘Guest’ login. A little research and you can put a portable power shell right on your external drive, so it and its advanced functionality is always available.
(To get to the installed PS) [Start] -> All Programs -> Accessories -> Windows Power Shell
That being said; for what we’re trying to do here, in this thread, the Administrator level Command shell should work just fine.

This thread asks how to delete a system folder, so ….
WARNING!!! Always be explicit when using commands like "DEL" and “RmDir” as they can and will delete everything they can that matches with your command. PAY ATTENTION WHERE YOU'RE AT AND
WHAT YOU TYPE.
Now, legs begin….

1.) Open your command shell of choice, as an Administrator.
2.) Move to the BASE FOLDER containing what you want to work on.
E.g.: You want to work on "z:\System Volume Information", then you need to get to "z:\"
** HINT ** If you're just trying this out for the first time, go INTO 'System Volume Information'
so you can see the results without risking effecting the rest of the drive's contents.
3. Learn to love the simplicity of these 3 commands, in order:
[FONT=&quot]Attrib /S -r -a -h -s "z:\System Volume Information"[/FONT][FONT=&quot]
[/FONT][FONT=&quot]** NOTE: The combination of the switches "-r -a -h -s" is important, see below.[/FONT]
[FONT=&quot]Del /S /q "z:\System Volume Information"[/FONT] <- Deletes files
[FONT=&quot]RmDir /s /q "z:\System Volume Information"[/FONT]<-Deletes the folder

"Attrib" changes the attributes of a file.
"Del" deletes the named file. (OR EVERYTHING THAT MATCHES THE PATTERN SPECIFIED. BE SPECIFIC.)
“/S” tells the commands to progress down through all the sub-folders and files.
“/q” suppresses dialogs and confirmation queries
“-r” Removes the 'read only' attribute.
“-a” Removes 'archived' attribute
“-h” Removes 'hidden' attribute
“-s” Removes the 'system' attribute

The combination of "-r -a -h -s" in the Attrib command must be done all at the same time and in
that specific order. Normally it doesn't seem to matter what order the flags are in until you slam
head on into the system files roadblock, which is precisely when you need to remember the shell
processes the flags in reverse order. (The flags are processed Last Flag First.)

And why the inclusion of the all but superfluous archive switch? This little undocumented nightmare
is something of a trick windows used as a minor extra protection of its files from early on. I Know
I've fought this possibly accidental nightmare in a win 98 box but it may go as far back as
Win3. Thus far, as a safety precaution (accidental or not), it's proven to still work to this day.
This thread is proof of it.

In a nutshell, windows sees the 'a' flag and checks the name of the folder it's on... which happens
to be part of the 'special' folders list... so windows slaps the hidden and system files right back on it
to protect its "special folder".

An easy way to see if this little trick may be in use is to simply remember that Windows doesn't index
system or hidden files. So then why is the archive flag set? Even though the indexer does not
index system or hidden files, it is still watching drive activity for changes, and like a good little
intentional Trojan takes a look and what you did, which in turn also triggers the system validation --
which slaps the protective flags right back in place if you don't get them all at once.

What if the above didn’t work?
For the items that still stubbornly remain, use either "cacls", "icacls" (preferred), or "TakeOwn" (brute force) commands as follows:

THE “CACLS” METHOD :: This has been depreciated by " icacls " (which I’ll show last) ---

[FONT=&quot]cacls "z:\system volume information" /E /G YourLoginID:F[/FONT]

/E tells the command to EDIT the current ACLs (access control lists) - not make a new one
/G (/Grant) – give YourLoginID the abilities
:F ... Specifies the ability (permission) to add. NO SPACES between this and YourLoginID
F = FULL CONTROL, R = Read, W = Write, C = Change

At this point you should be able to use the regular GUI (windows explorer) or a normal dos
prompt to do what you want with the contents. Note: If you are not removing the actual
base folder itself, then make sure you reverse this setting on what remains. Do this by
changing the /G (Grant) to /R (Remove user). If you don't, you're leaving the system open
to viri, or possibly worse.

cacls "z:\system volume information" /E /R YourLoginID

THE “TAKEOWN” METHOD (or the Brute Force method) ---

[FONT=&quot]TakeOwn /F "z:\system volume information" /R[/FONT]

/F simply tells the command the next thing is the file/folder to work on
/R tells the command to recourse into sub directories.
Note: This command defaults to the current user, hence no ability to specify a Login ID.

As above, if you are leaving files/folders unchanged then you need to remove the access
your ID has to them to protect from viri. Simply use "/A" to specify ‘Administrators’ as the party to become the owner.
[FONT=&quot]TakeOwn /F "z:\system volume information" /R /A[/FONT]
You may now not be the owner but if you still have access to the folder then you [or a virus pretending to be you] can make still changes, so be sure to take YourLoginID privileges off.

[FONT=&quot]cacls "z:\system volume information" /E /R YourLoginID[/FONT]

THE “ICACLS” METHOD (Preferred) --

The nice thing about Icacls is that it blends a number of advanced commands into a single 'elevated' command. Almost all of the above can be done with "ICACLS" as long as you remember that it separates the specified folder from the contents of the specified folder. (Instead of working recursively on this folder AND everything in it, ICACLS works on either this folder OR everything in it. This separation of the tree [everything in a folder] from its root [the folder itself] is intentional.)
For easier reading here, I’m going to simply list the 2nd half of the ICACLS command (the blank). Just remember everything below starts with:
[FONT=&quot]ICACLS "z:\system volume information" ________________________________[/FONT]

*** Normally, you shouldn't need to take ownership of the folder or its contents for what this thread is asking for. But should you need to, ICACLS can do it “nicely” rather than by the brute force method TakeOwn uses:

[FONT=&quot] /setowner YourLoginID
/setowner YourLoginID /T[/FONT]
First we take ownership of the base folder (the root), and then we repeat the command telling it to take ownership of all items IN that folder (the rest of the tree) by appending “/T” to our command. We do these commands in this order because in order to make changes IN a folder, you have to have access to the folder.
In general, we really should not need, nor want, to take ownership of these system files if we don’t absolutely have to. The headache and responsibilities that come along with that ownership greatly outweigh the benefits in the long run. Instead, simply give yourself (YourLoginID) full access with:
[FONT=&quot]/grant YourLoginID:F[/FONT]
[FONT=&quot]/grant YourLoginID:F /T[/FONT]
Again, notice we first have to have permission of the root before we can give ourselves permission to work on the rest of the tree.
Note:
* Use "/grant:r" to explicitly define the exact permissions. (Entirely replace the permissions.)
e.g.: "/grant user:w" adds write ability, whereas "/grant:r user:w"
will set the user to be able to only write to the folder. (But no access to what he just put there.)
And, of course, when you’re done doing what you need to do we need to lock the file back down (if you didn’t outright delete it) to protect against viri. (We do these in the reverse order that we did above because we have to still have access to the ‘root’ before we can mess with the ‘tree’.

[FONT=&quot]/remove YourLoginID /T[/FONT] Remove access to everything IN the folder.
[FONT=&quot]/remove yourLoginID [/FONT] Remove access TO the specified folder itself.
( And if you took ownership: [FONT=&quot]/setowner Administrator /T[/FONT] .. And then again without the “/T”.)

Sorry this so long, it really isn't in action. I just felt it necessary to cover the bases and explain why. My external drives (installs, OS backups, etc) that I have to swap around would get so loaded with these 'restores' that I started getting "Drive low on space" alerts just plugging it in. To resolve this "build up" and make it easy to maintain I have a batch file in the root of each drive. (z:\WipeRestores.bat) which does all of the above.
-----WipeRestores.bat -----
@echo off
color 17
cls
if {%1}=={} (
Set tmpWorkingFile=System Volume Information
) else (
Set tmpWorkingFile=%1
)
Echo -- Processing root location: %tmpWorkingFile%
echo.
set tmpTakeControl = 0
set tmpBruteForce = 0

net session >nul 2>&1
if %errorLevel% == 0 (
Set tmpUserIsAdmin=1
) else (
Set tmpUserIsAdmin=0
)
if exist "%tmpWorkingFile%" (
attrib /S -r -a -h -s "%tmpWorkingFile%"
del /S /Q "%tmpWorkingFile%"
rmdir /s /q "%tmpWorkingFile%"
)
if exist "%tmpWorkingFile%" (
attrib /S -r -a -h -s "%tmpWorkingFile%"
del /S /Q "%tmpWorkingFile%"
rmdir /s /q "%tmpWorkingFile%"
)
if exist "%tmpWorkingFile%" (
attrib /S -r -a -h -s "%tmpWorkingFile%"
del /S /Q "%tmpWorkingFile%"
rmdir /s /q "%tmpWorkingFile%"
)
if not exist "%tmpWorkingFile%" goto ProgDone

:FirstAttemptComplete
echo.
echo.
choice /m "Add full control of folder to %username% and try again?"
set tmpTakeControl=%ERRORLEVEL%
if %tmpTakeControl% equ 1 (
Echo Applying full control changes.......
ICACLS "%tmpWorkingFile%" /grant %username%:F
ICACLS "%tmpWorkingFile%" /grant %username%:F /T
echo attempting to remove folders.....
attrib /S -r -a -h -s "%tmpWorkingFile%"
del /S /Q "%tmpWorkingFile%"
rmdir /s /q "%tmpWorkingFile%"
)

If not exist "%tmpWorkingFile%" goto progDone
echo.
echo.
choice /m "Use brute force to take ownership of the folders and try again?"
set tmpBruteForce=%ERRORLEVEL%
if %tmpBruteForce% equ 1 (
Echo Taking ownership of folder and contents.....
TakeOwn /F "%tmpWorkingFile%" /R
echo attempting to remove folders.....
attrib /S -r -a -h -s "%tmpWorkingFile%"
del /S /Q "%tmpWorkingFile%"
rmdir /s /q "%tmpWorkingFile%"
)

echo.
echo.

if exist "%tmpWorkingFile%" (
echo Unfortunately I was not able to remove the folder.
echo It might be necessary to run this batch file again.
echo If this is the second time, please examine the
echo folder conditions for issues not connected to
echo folder permissions.
echo.
echo.
)


rogDone
set tmpTakeControl =
Set tmpUserIsAdmin =
set tmpBruteForce=
set tmpWorkingFile=

echo ----- End of line. -----

 

[Schmik]

Hello all,

I quickly read all posts and, well all of this takes time to perform, I mean burn an ubuntu CD and so on.
If I understood well FuryoftheStars just asked on a way to remove the folder "System volume inofrmation"

there's a simple way to do so : (the quotation marks are NOT needed, except if specified before)

considering you have Total Control on the folder "System Volume Information" :
Step 1 : click on "Start" type "run" and press Enter (or step 1 :Win+R)
step 2 : in the command prompt window called "Run" type "cmd" and press Enter
Step 3 : type the drive letter and a semicolon and press Enter (eg: "I:" and press enter)

Step 4 : the quotation marks are needed for this step
type : rmdir "System Volume information" /S /Q
Press Enter

Done

 

[arioprobo]

OMG, thats veryveryvery easy, yesterday i got the same problem,
google it and get this post, read it desperately...
fortunately i read it to the end...

IT WORKS!!

Thanks A LOTs MR. SCHMIK

DONE!

 

[alan10]

SUGGESTION :-
Once you have removed that folder it is very easy to absolutely prohibit any other Windows system from creating a new one.
Just create a FILE (not a FOLDER) with the name "System Volume Information"
Windows does not have the intelligence to delete the file so that it can recreate a folder with that name,
though I normally write protect as well just to be sure.

 

[FuryoftheStars]

So, out of all the various suggestions given here, I find that Schmik's to be the easiest and more... acceptable as something having to be done on a regular basis. Of course, Win 7 will auto recreate the folder after a few seconds, even if you have system restore turned off for that drive, but there will be nothing else in it other than a log file.

As such, thank you alan10 for pulling my attention back to this thread (no, I never unsubscribed from it), and yes, that seems to be the simplest way to keep Windows from recreating it. Note to anyone who reads this thread in the future and tries this, make sure you have the file ready to rename/move in there as you won't have very long to do it.

 

[itsthetooth]

Hello all,

I quickly read all posts and, well all of this takes time to perform, I mean burn an ubuntu CD and so on.
If I understood well FuryoftheStars just asked on a way to remove the folder "System volume inofrmation"

there's a simple way to do so : (the quotation marks are NOT needed, except if specified before)

considering you have Total Control on the folder "System Volume Information" :
Step 1 : click on "Start" type "run" and press Enter (or step 1 :Win+R)
step 2 : in the command prompt window called "Run" type "cmd" and press Enter
Step 3 : type the drive letter and a semicolon and press Enter (eg: "I:" and press enter)

Step 4 : the quotation marks are needed for this step
type : rmdir "System Volume information" /S /Q
Press Enter

Done

I have tried everything, these directions you gave, ended up with the prompt telling me access denied, just like windows does. I have tried cacls too, and it's like the prompt ignores anything past cacls. I have reformatted my drive like 4 times. I also reset my bios too. Every time I call up a cmnd prompt it always starts me out (c:\docume~1\lowfat>) I have even tried going directly to c prompt using cd\ which does get me c prompt only but still cacls or your directions still dont work.

 

[Callender]

Works for me

itsthetooth - This works for me. (Elevated Command Prompt). Check out what the folder actually contains before you delete it.



Example is System Volume Information Folder on external drive letter F.

Deleted it no problem. I could also use third party software to delete it.

For any other user reading this - don't attempt to delete System Volume Information folders unless you understand why you want to delete them!

 

[itsthetooth]

Well I guess that would be the problem, I'm using windows xp, not windows 7. I have already done a reg search for system volume information and it comes up with nothing. The folder is located on the C drive, and any attempt to access it either through windows or though command prompt, I'm told access is denied. I understand that if I delete this file that I won't be able to restore my computer, but thats fine as long as it deletes the virus locking me out.

 

[alan10]

WITHOUT having access to System Volume Information ( S.V.I. ),
you can choose which partitions to monitor for System Restore purposes.
If C:\ is monitored/protected then S.V.I. is "In Use" and unlikely to go without a fight.
You may need to fully disable anything which is using S.V.I.,
and possibly reboot,
before you can take down S.V.I.

 

[itsthetooth]

Well as far as I understand, it is supposed to be disabled. I have the restore feature turned off which I'm reading should do just that, in addition to removing any files in that folder. But either something else is blocking the access or a file in there is.

 

[alan10]

Well as far as I understand, it is supposed to be disabled. I have the restore feature turned off which I'm reading should do just that, in addition to removing any files in that folder. But either something else is blocking the access or a file in there is.

WizTree is the fastest way of seeing what is on a disk.
My restore is turned off, but Wiztree shows me five files totalling 8.3 MB within "C:\System Volume Information".
It also shows me 3 files in H:\"C:\System Volume Information".
You can get Wiztree from :-
Antibody Software - Home

Regards
Alan

 

[itsthetooth]

Thank you for that. I installed it, and scaned. It does show that I have a traffic log in the SVI accounting for 100% and another file called MountPointmanagmentremotedatabase. Info online says the last one is normal, but this one accounts for 0% of the folder. A scan through Trends housecall online virus scan always shows that this traffic log is always there, even after I first formatt the computer. It's locked, how the heck can I get it out? I tried cacls, I made sure my settings were correct in the tools to view and allow access, but I get access denied through both windows and command prompt.

 

[alan10]

I tried cacls, I made sure my settings were correct in the tools to view and allow access, but I get access denied through both windows and command prompt.

Have you explored the many facilities that are CRYPTICALLY listed via
CACLS /?

My Laptop had XP and CACLS allowed me full control of S.V.I.

How about ICACLS, which comes in Win7 but not in XP
This is a big brother to CACLS.

Perhaps some third party tool might help you.

Otherwise a Linux or WinPE Boot recovery CD should have full access.

 

[Ztruker]

Delete it from a live Linux CD like Puppy Linux or Linux Mint?

Good tutorial here: http://www.sevenforums.com/tutorials/287439-emergency-kit-save-your-files-dead-os.html

Forget the part about saving your data, just use it to delete the SVI folder.

 

[itsthetooth]

Thank you

It's great advice, but it sounds to complicated. I would not be able to learn a new OS. I'm however in agreeance with just deleting the file. I was able to remove the traffic.log that was hiding in the SVI folder, it only had a form with the number "1" in it. It has however since then reappeared.

 

[itsthetooth]

I had to reinstall windows yesterday

I did a boo boo in the registry and locked myself out of the computer, so had to reinstall windows. Now when I install wiztree, it no longer is able to help me get into that svi file to delete it.

 

[Callender]

Tracking logs

Those are logs created by windows. If you delete them they will be recreated. If you've got any concerns about system volume information on your windows partition all you can really do is to disable system restore - reboot - then enable system restore in order to clear out all old restore points and possible infections that might be hiding in them. As for the rest of what's contained in SVI - it;s best to leave it alone if it's on your windows partition.

 

[itsthetooth]

Ok, then just a few problems

I don't understand why there would be a "traffic.log" in my restore files. Traffic isn't suppose to be saved in an SVI folder, only restore points. In addition, Trend's house-call is identifying it as a rootkit, that claims to delete it, but it just reappears. I guess house-call could be giving me a false positive. But if that's the case, it still doesn't explain why I'm locked out of that file. I have set the viewing on those folders so that I should have access to them, but I get a pop up box that says access is denied. It does this with the restore turned on or off. It also does it in safe mode. And while it once allowed me to gain access through wiztree and delete it, after another windows reinstall, now wiztree can't delete it. That's pretty odd isn't it?

 

[alan10]

I don't understand why there would be a "traffic.log" in my restore files.

I see no such thing.
I see a tracking.log

I remember finding that on Win XP this was a list identifying which volumes were mounted and whether they were being monitored for system restore purposes.

If Wiztree could delete something BEFORE you reinstalled Windows,
and is unable to delete AFTER Windows installation,
that demonstrates that NORMAL WINDOWS SELF PROTECTION is NOW in force,
BUT WAS CRIPPLED before the reinstall.

I envy the adventurous spirit in which you meddle with Windows system files until it is broken, but

WARNING :-

When you SLIGHTLY damage Windows you may again initially fail to recognize that self protection is broken,
BUT any hacker that penetrates malware protection as a result of Windows degradation may access all passwords and bank/credit card information etc that could be exposed.

 

[Callender]

Traffic log?

I see that I managed to mix up traffic.log and tracking.log!

Anyway, my understanding of it is limited but I don't see it on my machine and I've checked through all folders in System Volume Information.

I reckon that you might consider starting a new thread on this. I think that there is a way to force delete this file if you want to but it would be best to have a system image backup before attempting to delete it.

System Restore Points are contained in the System Volume Information folder too.

Here's what's in the SVI folder on my machine:



If I understand correctly you've disabled System Restore and deleted all old system restore points but it's still being detected in SVI?

Now if you're saying that this traffic.log file still exists after a reformat and reinstall of windows then I guess that it must be legitimate. If I've misunderstood what you're saying and you want to go ahead and delete it anyway try the following tool and use it to browse to the file and choose to force delete it. (The risk is that't you'll brick your machine and need to reinstall windows if you haven't made a system image backup).

http://www.sevenforums.com/system-security/320434-power-tool-1-6-released.html

EDIT:

I paid attention to the advice alan10 gives in his earlier posts and System Volume Information has been removed from my windows partition and does not get re-created. The method works well.