Can't shrink partition due to mystery file

Question

My system came with win xp. I installed Win7 in a separate partition, volume E. That was a while ago. I don't need xp anymore and now I want to shrink the C partition so that I can grow E. I deleted most files from C but since the boot manager is there I'm not totally deleting the partition. However I cannot shrink the partition because of a system file that's at the end. FSUTIL reports that the file name is "$LogFile::$DATA". I can't find it using any method I know of, I don't know what it is, but I want to get rid of it. What is it, and how can I delete it or otherwise shrink the partition? Here's what I have now:

Answer 1

This is not a mystery file.

It's documented in loads of books and WWW sites about NTFS. This is one of several files — $MFT, $MFTMirr, $Volume, $Bitmap, $Boot, and so forth — that are integral parts of the NTFS on-disc structures. They have these names by convention, but the names don't appear in any directories seen by application-mode Win32 code — and thus end users. They have fixed, well-known, node numbers in the Master File Table. $LogFile is MFT entry #3, and it is used for NTFS transaction logging.

::$DATA denotes a data stream of the transaction log file. (This denotes the default data stream of a file, in fact.) You cannot shrink your volume because the place where that stream is stored is currently at the end of the volume. You need to relocate the contents of $LogFile to nearer the beginning of the volume, a task which some (not all) disc defragmentation tools are capable of.

You don't get to delete $LogFile, or indeed any of the other metadata files. That will prevent the correct operation of NTFS.

Further reading

• Anthony J. Sammes and Brian Jenkinson (2007). The New Technology File System. Forensic computing. (2nd edition). Springer. ISBN 9781846283970.

Answer 2

You have to turn off system restore before you can resize the partition.

See more here.