System Volume Information folder occupied 100 gb

Tejo

New Member
Messages
21
I have been noticing recently, my C drive gets occupied fully even if there are no bigger programs installed.
Out of 150gb, after uninstalling few programs, the space left was 30gb. Day by day it started decreasing and i saw 20gb today.

I used the disk cleanup tool and it shows only 100mb after selecting all fields.


I was worried still that space was not freeing and ran this program WinDirStat. Here are the screenshots.
a.jpg b.jpg

System Volume information folder occupies 75% of space - meaning 100gb.
There are lot of files which were around 1gb - 2gb and they are created from 2013.

Can somebody tell me why 100 gb? I read that this service is important but why is it taking this much of space..please help to remove these unwanted older files if any.

FYI, I tried below options after googling and also searching in this forum:
  • Used disk clean up tool and selected more options > system restore and shadow copies > delete
  • Disabling and Enabling System restore
  • Deleting shadow copies through VSSAdmin Delete Shadows command
  • Virus scan in System Volume Information folder (after taking ownership of that folder) through Kaspersky and ESET SS
  • Manual delete of the files.
  • Selecting delete option in System Protection > Configure
  • Changing maximum usage to some x%

I have tried all these methods but still those files are existing. Please help



 

My Computer

System One

  • OS
    Windows 7 / Windows 8
    Computer type
    Laptop
System Volume Information contains:
  1. System Restore points
  2. Distributed Link Tracking Service databases for repairing your shortcuts and linked documents.
  3. Content Indexing Service databases for fast file searches
  4. Information used by the Volume Shadow Copy.

Since you cannot delete anything from this folder while Windows is running. The quick way is to delete the whole folder using Linux Slacko Puppy.
  1. Download the ISO (160MB) :Slacko Puppy Linux . Click one of the link shown on screen shot #1.
  2. Create a bootable USB Using Rufus - Create bootable USB drives the easy way
  3. Boot from USB, the screen should look like the screen shot. From the bottom left #2 of the screen. The HDs mounted as sda1, sda2 ... and one of these is your C: Drive.
  4. Find the System Volume Information, right click and delete it.
  5. Disconnect the USB and reboot Windows, a new System Volume Information folder should be created

2014-07-07_13-55-42.png
 

My Computer

System One

  • OS
    8.1x64PWMC Ubuntu14.04x64 MintMate17x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Brewed
    CPU
    I7 4970K OC'ed @4.7 GHz
    Motherboard
    MSI-Z97
    Memory
    16 GB G-Skill Trident X @2400MHZ
    Graphics Card(s)
    NVIDIA GeForce GTS 450
    Sound Card
    X-Fi Titanium Fatal1ty Professional Series
    Monitor(s) Displays
    Dual HP-W2408
    Screen Resolution
    1920X1200
    Hard Drives
    256 GB M2 sm951, (2) 500GB 850EVO, 5TB, 2 TB Seagate
    PSU
    Antec 850W
    Case
    Antec 1200
    Cooling
    Danger Den H20
    Keyboard
    Logitech
    Mouse
    Logitech Performance Mouse MX
    Internet Speed
    35/12mbps
    Browser
    Firefox
System Volume Information contains:
  1. System Restore points
  2. Distributed Link Tracking Service databases for repairing your shortcuts and linked documents.
  3. Content Indexing Service databases for fast file searches
  4. Information used by the Volume Shadow Copy.

Since you cannot delete anything from this folder while Windows is running. The quick way is to delete the whole folder using Linux Slacko Puppy.
  1. Download the ISO (160MB) :Slacko Puppy Linux . Click one of the link shown on screen shot #1.
  2. Create a bootable USB Using Rufus - Create bootable USB drives the easy way
  3. Boot from USB. From the bottom left #2 of the screen. The HD mounted as sda1, sda2 ... and one of these is your C: Drive.
  4. Find the System Volume Information, right click and delete it.
  5. Disconnect the USB and reboot Windows, a new System Volume Information folder should be created

ok..but is it safe to delete them that way? later OS problems will not come right?
Also let me know if I have to delete all the files in that folder or only few?
 

My Computer

System One

  • OS
    Windows 7 / Windows 8
    Computer type
    Laptop
ok..but is it safe to delete them that way? later OS problems will not come right?
Also let me know if I have to delete all the files in that folder or only few?
I've done it and nothing broke. Just delete the whole folder, a new one will be created.
 

My Computer

System One

  • OS
    8.1x64PWMC Ubuntu14.04x64 MintMate17x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Brewed
    CPU
    I7 4970K OC'ed @4.7 GHz
    Motherboard
    MSI-Z97
    Memory
    16 GB G-Skill Trident X @2400MHZ
    Graphics Card(s)
    NVIDIA GeForce GTS 450
    Sound Card
    X-Fi Titanium Fatal1ty Professional Series
    Monitor(s) Displays
    Dual HP-W2408
    Screen Resolution
    1920X1200
    Hard Drives
    256 GB M2 sm951, (2) 500GB 850EVO, 5TB, 2 TB Seagate
    PSU
    Antec 850W
    Case
    Antec 1200
    Cooling
    Danger Den H20
    Keyboard
    Logitech
    Mouse
    Logitech Performance Mouse MX
    Internet Speed
    35/12mbps
    Browser
    Firefox
ok..but is it safe to delete them that way? later OS problems will not come right?
Also let me know if I have to delete all the files in that folder or only few?
I've done it and nothing broke. Just delete the whole folder, a new one will be created.

Ok bro..one last thing..My laptop came with W8 pre-installed. So there is factory image which is useful to restore system.
So that wont be affected right if we delete all these files?
 

My Computer

System One

  • OS
    Windows 7 / Windows 8
    Computer type
    Laptop
My laptop came with Windows 8 pre-installed. So there is factory image which is useful to restore system.
So that wont be affected right if we delete all these files?
No, should not affect anything.
 

My Computer

System One

  • OS
    8.1x64PWMC Ubuntu14.04x64 MintMate17x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Brewed
    CPU
    I7 4970K OC'ed @4.7 GHz
    Motherboard
    MSI-Z97
    Memory
    16 GB G-Skill Trident X @2400MHZ
    Graphics Card(s)
    NVIDIA GeForce GTS 450
    Sound Card
    X-Fi Titanium Fatal1ty Professional Series
    Monitor(s) Displays
    Dual HP-W2408
    Screen Resolution
    1920X1200
    Hard Drives
    256 GB M2 sm951, (2) 500GB 850EVO, 5TB, 2 TB Seagate
    PSU
    Antec 850W
    Case
    Antec 1200
    Cooling
    Danger Den H20
    Keyboard
    Logitech
    Mouse
    Logitech Performance Mouse MX
    Internet Speed
    35/12mbps
    Browser
    Firefox
@topguncp, any thoughts on how to stop the situation from reoccurring? If the files were Restore Points (volume shadow copies) Tejo should be able to confirm that by comparing the vssadmin list shadows command against the list he showed in the attachment?

It just seems something has gotten out of control and needs to be determined what and why. If limiting the space used for shadow copies might help, what number should be used?

I have seen other threads where this appears to be happening. Currently my C: drive only shows 3 Shadow Copies...it is only a 124 GB partition and is showing 3.45 GB used out of 6.21 GB available, which is 5% of the drive.

Also, I was wondering why, if they were shadow copies, VSSadmin could not remove them...?

Anyway, just thinking out loud....
 

My Computer

System One

  • OS
    Windows 8.1 x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Grown
    CPU
    i7 3770K
    Motherboard
    ASUS P8Z77 -v Pro, Z87-Expert
    Memory
    16 G
    Graphics Card(s)
    EVGA GTX 680 Classified (2)
    Hard Drives
    Kingston SSD 240 GB
@topguncp, any thoughts on how to stop the situation from reoccurring? If the files were Restore Points (volume shadow copies) Tejo should be able to confirm that by comparing the vssadmin list shadows command against the list he showed in the attachment?

It just seems something has gotten out of control and needs to be determined what and why. If limiting the space used for shadow copies might help, what number should be used?

I have seen other threads where this appears to be happening. Currently my C: drive only shows 3 Shadow Copies...it is only a 124 GB partition and is showing 3.45 GB used out of 6.21 GB available, which is 5% of the drive.

Also, I was wondering why, if they were shadow copies, VSSadmin could not remove them...?

Anyway, just thinking out loud....


Good point actually.. followed the method thru linux and deleted those shadow copies..saved 90gb.
But we need to find out how to stop it from reoccuring.
I set the limit space for shadow copies as 2%. But the real problem was why those were not getting deleted even thru vssadmin commands and delete option.
 

My Computer

System One

  • OS
    Windows 7 / Windows 8
    Computer type
    Laptop
I suppose what happens next depends on the activity you see in the folder. We can hope, removing the folder will have removed any corruption that might have contributed to the problem.

If the files start building up again, it will be up to you to keep track of when they are created to see if you can tie it to anything. Maybe some type of task, or a piece of software, or whatever. Keep us advised...
 

My Computer

System One

  • OS
    Windows 8.1 x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Grown
    CPU
    i7 3770K
    Motherboard
    ASUS P8Z77 -v Pro, Z87-Expert
    Memory
    16 G
    Graphics Card(s)
    EVGA GTX 680 Classified (2)
    Hard Drives
    Kingston SSD 240 GB
But the real problem was why those were not getting deleted even thru vssadmin commands and delete option.
If you type: vssadmin delete shadows /?, you get the help below:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Delete Shadows /For=ForVolumeSpec [/Oldest] [/Quiet]
Delete Shadows /Shadow=ShadowId [/Quiet]
Delete Shadows /All
- For the given ForVolumeSpec deletes all matching shadow copies.
If /Oldest is given, the oldest shadow copy on the volume is deleted
If /All is given, then all shadow copies on all volumes that can be
deleted will be deleted. If /Shadow=ShadowId is given, the shadow copy
with that Shadow Copy ID will be deleted. Only shadow copies that have
the ClientAccessible type can be deleted.

- The Shadow Copy ID can be obtained by using the List Shadows command.
When entering a Shadow Copy ID, it must be in the following format:
{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
where the X's are hexadecimal characters. This ID can be obtained
through the List Shadows command.

I suppose what happens next depends on the activity you see in the folder. We can hope, removing the folder will have removed any corruption that might have contributed to the problem.

If the files start building up again, it will be up to you to keep track of when they are created to see if you can tie it to anything. Maybe some type of task, or a piece of software, or whatever. Keep us advised...
That's what I thought and while you guys discussed about this, I did try to create restore points then delete with Vssadmin and It worked perfectly. Since you have accumulated about 100GB's over the year, I would think that the Folder is badly corrupted.

You can try to manually create a couple of restore points then use VssAdmin to delete to see how it goes. If it does not work then you have a problem. It's time to start monitoring the event log on Volume Shadow Copy.
@topguncp, any thoughts on how to stop the situation from reoccurring? If the files were Restore Points (volume shadow copies) Tejo should be able to confirm that by comparing the vssadmin list shadows command against the list he showed in the attachment?

It just seems something has gotten out of control and needs to be determined what and why. If limiting the space used for shadow copies might help, what number should be used?

I have seen other threads where this appears to be happening. Currently my C: drive only shows 3 Shadow Copies...it is only a 124 GB partition and is showing 3.45 GB used out of 6.21 GB available, which is 5% of the drive.

Also, I was wondering why, if they were shadow copies, VSSadmin could not remove them...?

I found out over the years that Restore Points are very unreliable and become corrupted after a while, and in the last week I was involved in helping 2 other cases with it.
His problem is unique as it does not happen to you. Myself, the first thing I do after Windows Installation is to turn the dam thing off and make a backup image and that is the sure way. I don't like the idea of restore points sitting in the same place where Windows is and beleive it or not, the $RECYCLE BIN and System Volume Information are where Hackers love to inject their Viruses into.

Here's another glitch about Restore Point. See the screen shot. In the past I have seen as many as 40 listed on other people PC.

1.png
 
Last edited:

My Computer

System One

  • OS
    8.1x64PWMC Ubuntu14.04x64 MintMate17x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Brewed
    CPU
    I7 4970K OC'ed @4.7 GHz
    Motherboard
    MSI-Z97
    Memory
    16 GB G-Skill Trident X @2400MHZ
    Graphics Card(s)
    NVIDIA GeForce GTS 450
    Sound Card
    X-Fi Titanium Fatal1ty Professional Series
    Monitor(s) Displays
    Dual HP-W2408
    Screen Resolution
    1920X1200
    Hard Drives
    256 GB M2 sm951, (2) 500GB 850EVO, 5TB, 2 TB Seagate
    PSU
    Antec 850W
    Case
    Antec 1200
    Cooling
    Danger Den H20
    Keyboard
    Logitech
    Mouse
    Logitech Performance Mouse MX
    Internet Speed
    35/12mbps
    Browser
    Firefox
Just thought I would throw in how my System Volume Information folder looks on my C: partition. The three "OnDiskSnapshotProp" entries are the same as I show for the C: drive in Vssadmin list shadows /for=c: command.
 

Attachments

  • RestorePts.jpg
    RestorePts.jpg
    94.3 KB · Views: 208

My Computer

System One

  • OS
    Windows 8.1 x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Grown
    CPU
    i7 3770K
    Motherboard
    ASUS P8Z77 -v Pro, Z87-Expert
    Memory
    16 G
    Graphics Card(s)
    EVGA GTX 680 Classified (2)
    Hard Drives
    Kingston SSD 240 GB
Actually I tried all the vssadmin commands. Even though the files were present in the disk, they were not shown in the list shadows command.
So it somewhat makes sense that something is wrong..But it is corrupted or not I do not know bcz i never messed up with shadow copies. All the time I was wondering why the space became less even after uninstalling most of the programs. Finally i deleted them as u said and now i got the 100gb back and happily installed some programs yesterday..

But I still suspected abt those shadow copies and took a look after installing few programs. To my surprise 2 new shadow copies are created each 500mb. So it seems when i install something these copies are getting created.

@topgundcp, your point actually makes sense. Instead of creating restore points, its better to have something like a backup image.

Further, since my laptop came with W8 pre-installed, there seems to have a factory image already present in a hidden partition. There is a recovery application given by samsung so than i can launch it and restore to factory version. Also during boot, I saw something like "F4 Recovery", so does this mean I can restore system to factory version even if windows completely gets corrupted right? If it is so, then can happily disable the system restore option i guess.
 

My Computer

System One

  • OS
    Windows 7 / Windows 8
    Computer type
    Laptop
But I still suspected abt those shadow copies and took a look after installing few programs. To my surprise 2 new shadow copies are created each 500mb. So it seems when i install something these copies are getting created.
Restore points are created from some 3rd party applications, Windows Updates, scheduler and manually so it is normal.

@topgundcp, your point actually makes sense. Instead of creating restore points, its better to have something like a backup image.
Yes, you can recover Windows from factory image as if you just bought the PC. However, you'd have to reinstall all the applications needed. Making a backup image will restore back to when you created it and will include all your applications.

If you are happy with the result. Please mark it solved. Thanks
 

My Computer

System One

  • OS
    8.1x64PWMC Ubuntu14.04x64 MintMate17x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Brewed
    CPU
    I7 4970K OC'ed @4.7 GHz
    Motherboard
    MSI-Z97
    Memory
    16 GB G-Skill Trident X @2400MHZ
    Graphics Card(s)
    NVIDIA GeForce GTS 450
    Sound Card
    X-Fi Titanium Fatal1ty Professional Series
    Monitor(s) Displays
    Dual HP-W2408
    Screen Resolution
    1920X1200
    Hard Drives
    256 GB M2 sm951, (2) 500GB 850EVO, 5TB, 2 TB Seagate
    PSU
    Antec 850W
    Case
    Antec 1200
    Cooling
    Danger Den H20
    Keyboard
    Logitech
    Mouse
    Logitech Performance Mouse MX
    Internet Speed
    35/12mbps
    Browser
    Firefox
If it is still creating entries in the folder, do they agree with what the vssadmin shows for shadow copies in that partition? How many has it created and are they shown like the attachment I posted?

Vssadmin has several switches. There are two switches you might try and include the listings in your next post. We can compare it to ours. Remember, you can copy the text from a command prompt and paste in your response.

Vssadmin List Providers

Vssadmin List Writers

Since I have basically no experience with this, something may show up when we compare the entities involved.
 

My Computer

System One

  • OS
    Windows 8.1 x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Grown
    CPU
    i7 3770K
    Motherboard
    ASUS P8Z77 -v Pro, Z87-Expert
    Memory
    16 G
    Graphics Card(s)
    EVGA GTX 680 Classified (2)
    Hard Drives
    Kingston SSD 240 GB
Back
Top