Solved System Volume Information has 336 Files filled with 180GB of nulls

[gmgolner]

I just discovered that my System Volume Information folder on my C:\ (system) drive has 336 files that have appeared over the past several years, and they're totally filled with nulls (Hex 00), to the tune of about 180 GB. I've managed to gain enough access (invoked super user, changed some permissions) to be able to look into them and ascertain the nulls, but have not been able to manually delete them. I haven't found out how they're being created, but I'm now running spacesniffer with a filter that should pop up a flag as soon as another is generated. I hope another shows up soon, as I might be able to relate it to something I'm doing at the time.

I'm doing as much of the experimenting as I can on a mounted backup image. It seems to behave pretty much the same as the real system drive.

Since 180 GB is a lot of space, I'd like to get rid of these files. System Protection is turned off, and I've used the 'Delete' button, but that only deleted the valid restore points. The 180 GB of nothing remains.

Any suggestions on getting this mess cleaned up would be seriously appreciated.

Thanks,
Mike

 

[Ztruker]

One easy way here: http://www.sevenforums.com/tutorials/287439-emergency-kit-save-your-files-dead-os.html

Ignore the "Save your data" part, just use Linux Mate which is very Windows like so easy to use, to delete the files/folders you want to get rid of.

 

[gmgolner]

Thanks for showing me the light

Thank you so much for your post. Your suggestion was the key to solving this problem, which I had struggled with for so many days. The 180 GB of 'nothingness' has been successfully removed, my system drive is now a much more normal size, and I'm once again smiling. So a really big Thank You for your help with this.

And Thank You also to whs, who took the time to produce the very detailed and helpful tutorials used in this process.

As a final thought, I guess I'm left more than a little bit incredulous that it takes a free Linux deployment to clean up a mess that Microsoft makes it virtually impossible to fix. Microsoft does many things well, but this time, maybe not so much.

So thanks again to Ztruker for the suggestion, and to whs for the tutorials. You folks are awesome.

 

[Ztruker]

You're welcome. I'm sure there are ways to do this from Windows but it seems every time someone asks it takes a lot of fiddling to finally make it work. Linux Mint Mate is so much easier and it always works.

whs did a really great job on the tutorial for sure.

 

[logicearth]

It is difficult to work with "System Volume Information" while booted in Windows because it is a protected system location filled with information vital to the inner workings of the system. They don't want users to inadvertently delete/mess with it and break their computers. Not only that, but Windows also keeps a lot of open handles to various things within it making it that much harder.

There are ways to also do this with the Windows Recovery Console, it just doesn't have a fancy UI todo it.

 

[gmgolner]

Thanks for your added thoughts, logicearth.

Regarding your comment on working in the SVI folder, I agree that it needs to be heavily protected. That's why when I was experimenting, I was doing so on a mounted image of SVI, not on the real thing. I guess I would come at it from the other end, though, and wonder how something (I still am trying to find out what) was able to put 180 GB of nulls into this heavily protected folder. Seems something can get access to it much more easily than I can. OTOH, I've been around long enough to realize that I'm looking for a simple answer to a really complex question, and probably should know better by now.

Very interesting comment you made about the possibility of using the Windows Recovery Console. I probably didn't use the right 'Magic Phrase', but in all of the Googling I did over 3-4 days, I never even saw a hint of this. Thanks for making me aware of it.

Though I hope to never need to use any of this again, I love knowing as much as I can about things.

Best regards,
Mike

 

[cluberti]

While 180GB is large, it's not the largest I've ever seen. A lot of the SVI growth can be tracked back to old (orphaned) volume snapshots (usually caused by backup applications, but not always) and extremely large indexes stored by Windows Search. There can be other reasons, but this folder is (as you've found) very tightly locked down to the system only, and only certain things running as system can even put things here to begin with. Given the limitations on what can even write here, and knowing that volume snapshots and indexes are about the only thing the system can do natively that could write large bits of info here, that is always the first place I look.

I also use a WinPE recovery environment rather than a Linux environment, for what it's worth - I find the Win32 tools to manage and repair Windows boxes work better across multiple versions of Windows than their Linux variants.