How to delete "System Volume Information" folder on Win 7

Page 6 of 6 FirstFirst ... 456

  1. Posts : 46
    Microsoft Windows 7 Professional 64-bit 7601 Multiprocessor Free Service Pack 1
    Thread Starter

    Dostka, that isn't an option with all drives.

    Just to reiterate... under "normal" circumstances, this is solved using methods pointed out in posts 22 & 24 on page 3. Now, obviously there are certain things that must be disabled first (System Restore for target volume, for example), but it does work.

    The other thing to note is that other programs may store info in there as well. For example, I just tried removing the "System Volume Information" (SVI going forward) folder off from an external drive of mine but had issues with a single file not wanting to delete no matter what I did. Process Explorer showed it as in use by the System process the moment I connected the drive. When I did some research on the file, I found it was actually being created by our Anti-virus program (Symantec Endpoint Protection 12.1) in use here. Now, while hooking the external up to another PC that does not have the AV does allow me to remove the SVI folder, no matter what I do to lock out permissions on the "place holder" SVI file, the AV is still able to gain control of it, rename it, and then recreate the normal SVI folder.

    But, for those situations where you can delete the SVI folder and not have something else recreate it (*cough*Symantec*cough*)... here's a simple batch string that automates posts 22 & 24 that you can use to delete it:

    takeown /f "X:\System Volume Information" /a /r /d y
    icacls "X:\System Volume Information\*" /grant:r administrators:F /t /l
    rmdir "X:\System Volume Information" /s /q
    *>"X:\System Volume Information"
    Notes and commands explained:

    • The file must be run as administrator (elevated permissions).
    • Replace all "X:\" with your appropriate drive letter. You can also remove that if the .bat file is to be run only from the drive(s) you wish to remove the SVI folder from.
    • "takeown" is used to force taking ownership of directories and/or files that you otherwise do not have permission to change ownership on. You will need this if you otherwise are unable to edit permissions. The switch "/a" grants the ownership to the administrators group. You can remove it so it grants ownership to the account in use. "/r" is so it works on all subdirectories and files. "/d y" is so it responds "yes" to any questions of (essentially) "are you sure you want to take ownership".
    • "icacls" is used to make sure you have full control over everything. "/grant:r administrators:F" is used to grant full (":F") permissions to the "administrators" group while removing (":r") all other permission entries. I did this in case of a situation where you add administrators, but your user account is specifically listed as deny (seems that would take precedence). You can replace "administrators" with any user name or group that you feel appropriate for your situation. "/t" makes it work on all "matching" subdirectories and files. "/l" performs the operation on a symbolic link rather than the link's target.
    • "rmdir" is used to delete the SVI directory. "/s" removes all subdirectories and files while "/q" suppresses the "are you sure" messages.
    • The final line is meant simply to create a 0 byte, extension-less file by the same name as the normal SVI folder, thus preventing "normal" recreation of the folder and contents. As such, the "*" is used simply as an invalid command to be outputted (">") to the appropriate file and location.

    While all of this does work, there are obviously caveats to it. If there is even 1 file or folder within it that is in use by something else, rmdir will fail. If there is something else that is monitoring the directory and has been setup to be able to take over your extension-less file to rename and recreate the folder, then you're hosed; you'll never be able to truly get rid of it.

    Win some... lose some.
      My Computer

  2. Posts : 2
    7 / 64

    boot off Hirens
    It's easier than, all that messing around in hyperspace.
      My Computer

  3. Posts : 1
    Seven Ultimate 64 bits

    Hi to everyone.

    I'm sorry for being perhaps, out of topic, you'll tell me about...
    My question is the perfect opposite to the topic, but i did'nt found any topic in which post my problem...

    This is the situation;

    *VSS has been disabled.

    *VS copies has been deleted, previously were deleted the store points (i'm a Little confused about these two apparently different things: Restore Points/Shadow Copies).

    *Restore System has been disabled.

    Plugging the disc to another machine i've been able to "see" into "System Volume Information" folder, through Recuva, large deleted (but recoverable) files with this kind of names; {3cfc80e0-be42-11e5-a950-f46d04d75d0c}{3808876b-c176-4e48-b7ae-04046e6cc752}, ...are this large files Restore Points or Shadow Copies?, are the same thing, or very different?

    Well, just in order to experiment i've saved one of those files & after a lot of trys i've been able to mount this file as a virtual DVD-rom (through a non-commercial version of DaemonTools Light). Just in case, i've made an image of this virtual unit through Testdisk. Later i've used Photorec & extracted thousands of files from from the .dd image.

    Obviously, this restore point (or shadow copy?) has not the files that really matters, mostly of the files are Little images, txt's, system files, & all kind of temporary files coming from the activity of the web browsers.

    I'm begging for someone who tell me that is posible to get back a deleted shadow copy, or several of them. The problem is that i don't know where to search for those "Sadow Copies", or if those files has some kind of name to search for.

    I was able to "rebuild" the "System Volume Information" folder, these are the files i've recovered:

    *SPP (folder in which is contained the "OnlineMetadataCache" sub-folder)

    *{7048df7f-d34b-11e5-b260-f46d04d75d0c}{3808876b-c176-4e48-b7ae-04046e6cc752} (large system file).

    *{3808876b-c176-4e48-b7ae-04046e6cc752} (64kb system file).

    *MountPointManagerRemoteDatabase (0kb system file).


    The very unknown (for me!) thing, is how to set the relationship between this recovered "System Volume Information" folder & the Windows registry. I assume/wonder that if this relationship is rebuilted, we'll be able to recover entirely deleted shadow copies. Can someone tell me if i'm totally wrong about this?

    I've made some proofs, as delete many large files from my disk when System Restore is active, & later, obviously, i was able to recover all those file by simply navigate into the restore points through "System Restore Explorer" & "ShadowExplorerPortable" apps.

    How to rebuild a recovered SVI folder-WindowsRegistry relationship; is there a chance?

    I'm sorry for this so large question...

    Thx a lot in advance for the sacrifice of this part of your valuable time!
    Last edited by JasonGreenlight; 18 Feb 2016 at 14:14.
      My Computer

  4. Posts : 3

    This worked for me on a external passport drive that is running UNIX I think, but I had assigned a drive letter to it in Windows 10. Worked perfectly and quick. Wish I had found this earlier.

    How to Delete System Volume Information Folder - YouTube
      My Computer

  5. Posts : 2
    windows 7

    FuryoftheStars said:

    takeown /f "X:\System Volume Information" /a /r /d y
    icacls "X:\System Volume Information\*" /grant:r administrators:F /t /l
    rmdir "X:\System Volume Information" /s /q
    *>"X:\System Volume Information"
    It works and I am impressed. Took me an hour to just find this code
      My Computer

Page 6 of 6 FirstFirst ... 456

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 08:31.
Find Us