I was cleaning up an external USB drive that had a bunch of old data that I didn’t need any more. The drive was fine but had been used between a number of systems so I thought to do a quick “chkdsk” (this is an NTFS drive attached to a Windows XP system). It all checked out ok but claimed there was ~6GB of used space from 11000+ files! Huh? I deleted everything!
As the drive appeared empty but clearly wasn’t, there must be some hidden files and folders somewhere. It turns out that there’s a hidden, read-only, “system” folder called “System Volume Information” in the root directory of the drive and this contains system restore points…and this is where all the space was hiding!
- Click Start, then My Computer
- Double click on the drive icon for the disk drive in question
- Click on the Tools menu button and select Folder Options
- On the View tab, select “Show hidden files and folders”
- De-select the “Hide protected system files” option, if it’s selected (confirm the change if prompted)
- Click Ok at the bottom to make the changes
You should now see a folder called “System Volume Information” in the drive folder. It will be greyed out to show that it has hidden file attributes.
Now, in this case I don’t care about system restore points because this is an external USB drive that I just want to use for holding video and image files. Unfortunately the system restore functionality seems to be on by default for connected drives and at some point in time, a machine that this drive was connected to must have saved one or more restore points.
The first thing we can do is clean up the system restore images and disable system restores on this drive. To do this, right click on the drive in My Computer and select Properties. In the Properties pop up window, just below the pie chart showing the used vs. free space, click on the Disk Cleanup button. This then causes another dialog to pop up, at the bottom of which is a System Restore panel with a Clean up… button. Click on this button and select Yes. This will delete all but the last system restore point in the System Volume Information folder.
If this was the primary C: drive, I’d leave system restores active but, as I said earlier, in this case I don’t care about system restore points at all, so I will disable system restores entirely on this drive. To do this, get the System Properties dialog either by right clicking on My Computer and selecting Properties for by opening the Control Panel and clicking on System.
The System Properties dialog has a System Restore tab at the top. Click on that tab and you should see a list of drives and a Settings… button. Select the drive in question and click the Settings button, which will pop up another window from where you can disable system restores on this drive.
Phew! What a lot of clicking and pop up windows! Ok we’re nearly done but the one remaining system restore point within the System Volume Information folder is still hogging a load of space that I’d rather have back. This will have to be deleted by hand.
The problem is that although I can see the “System Volume Information” folder, I can’t access it. Any attempt to access it or delete it results in “Access denied!” In order to gain access to this folder, we need to change some access control list permissions from the command line using the CACLS command. To do this, fire up the command prompt (from either the Start -> Accessories menu or by clicking on Start, then Run and entering cmd before clicking Ok).
Once you have the command prompt window open, make sure to navigate to the root directory of the drive in question. For example, if you’re trying to clear out hidden space in “F:\System Volume Information” use the “F:” command and ensure you’re in the root directory (the prompt should read “F:\”). Naturally, substitute “F” for whatever drive letter is appropriate for your case. Next, run the CACLS command and grant yourself full access to the folder…an example is shown below but you need to substitute username with whatever your user name is…
processed dir: F:\System Volume Information
F:> _
Once this is done, you will find that you can click into the “System Volume Information” folder within the Windows explorer window and start deleting what’s left inside. Once it’s cleared out, you can delete the folder itself.
This process is documented on the Microsoft article How to gain access to the System Volume Information folder.
What’s the F after username:??? Is it the drive letter or just an F?
If my username is Teo and my letter is C, should I write
cacls “C:\System Volume Information” /E /G Teo:C
or
cacls “C:\System Volume Information” /E /G Teo:F
??
Ok I figured out, it is F literally (I guess it is half a byte of bit flags, i.e. all permissions)
Hi Teo, yes that’s right. The character after the username denotes the permissions, i.e.:
R – Read, W – Write, C – Change and F – Full.
See http://technet.microsoft.com/en-us/library/bb490872.aspx
Cheers!