Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My system came with win xp. I installed Win7 in a separate partition, volume E. That was a while ago. I don't need xp anymore and now I want to shrink the C partition so that I can grow E. I deleted most files from C but since the boot manager is there I'm not totally deleting the partition. However I cannot shrink the partition because of a system file that's at the end. FSUTIL reports that the file name is "$LogFile::$DATA". I can't find it using any method I know of, I don't know what it is, but I want to get rid of it. What is it, and how can I delete it or otherwise shrink the partition? Here's what I have now:

pic1 pic2

share|improve this question
    
"$LogFile::$DATA" sounds like system restore. Is that on for your XP drive (within windows 7)? –  skub Jan 15 '12 at 4:24
    
Yes, it is on drive c, which was my xp drive, and I am running from a win7 boot. –  Elroy Flynn Jan 15 '12 at 4:28
    
Have you tried booting into a linux cd and looking on that drive for hidden files? But as skub said in that answer make sure system restore is off first. –  opsin Jan 15 '12 at 4:54
4  
The $LogFile file is a part of the NTFS filesystem metadata, it's used as part of journaling. The ::$DATA part of the name indicates the default $DATA stream of the file. I don't know why it's causing a problem, though. See Here and here –  Andrew Lambert Jan 15 '12 at 7:10
    
It is possible to move it with some boot defraggers, one of them was "Ultimate Defrag" (did not always work) . It is re-written when Cloning or Full imaging a parttion also. I would be using cheap trick methods, shrink partition on image recover, offline defrag and shrink. Use a partition shrinker has an offline/at boot mode (best). The OS isnt going to pull off most of this stuff correct, you need 3rd party things. –  Psycogeek Jan 15 '12 at 8:32

2 Answers 2

This is not a mystery file.

It's documented in loads of books and WWW sites about NTFS. This is one of several files — $MFT, $MFTMirr, $Volume, $Bitmap, $Boot, and so forth — that are integral parts of the NTFS on-disc structures. They have these names by convention, but the names don't appear in any directories seen by application-mode Win32 code — and thus end users. They have fixed, well-known, node numbers in the Master File Table. $LogFile is MFT entry #3, and it is used for NTFS transaction logging.

::$DATA denotes a data stream of the transaction log file. (This denotes the default data stream of a file, in fact.) You cannot shrink your volume because the place where that stream is stored is currently at the end of the volume. You need to relocate the contents of $LogFile to nearer the beginning of the volume, a task which some (not all) disc defragmentation tools are capable of.

You don't get to delete $LogFile, or indeed any of the other metadata files. That will prevent the correct operation of NTFS.

Further reading

  • Anthony J. Sammes and Brian Jenkinson (2007). The New Technology File System. Forensic computing. (2nd edition). Springer. ISBN 9781846283970.
share|improve this answer

You have to turn off system restore before you can resize the partition.

See more here.

share|improve this answer
    
that's not the issue (apparently). System restore was already turned off for drive c. I also turned it off for e:, but no joy. –  Elroy Flynn Jan 15 '12 at 5:03
    
Should C be set to "Active"? Not sure you can resize it while active. Shouldn't windows 7 partition be active or am I missing something? –  skub Jan 15 '12 at 5:05
1  
"Active" is just a single bit - AFAIK, telling the MBR which partition to boot from. If the bootloader in the MBR is smarter, it has its own list and doesn't even use the bit. –  grawity Jan 15 '12 at 13:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.