According to Microsoft’s Raymond Chen, it is one of the more baffling icon overlays (probably due to its rareness). The black-clock overlay is the NTFS extended attribute “offline” which indicates that it has been backed up to tape. In other words, the file is not currently accessible without first mounting the correct tape.
“But I don’t have a tape drive!” I hear you object. That is not surprising; neither do I. Raymond explains:
The black clock is particularly baffling because you sometimes see it even if your system is not equipped with Hierarchical Storage Management. When this happens, it's because some program (typically a setup program) didn't check error codes properly.
In my case, the file was created in 2010, likely in Windows 7 (it is stamped as being made in 2010). It was decompressed in Windows XP onto an NTFS volume created by Windows 7. A bug in 7-Zip or the contents of the file itself has probably caused an inconsistency that led to this bizarre behavior.
attrib command cannot show the attribute because XP was released in 2001 and is limited to the basic
RASH attributes (it does not show a few other attributes that can be seen in Vista+). However, if you enable the Attributes column in Windows XP Explorer, you can see the attribute indicated by an
A curiosity caused by the attribute is with the
1989.01.19 09:53 11,800 AGUY0.CMP
1989.01.19 09:54 (10,912) AGUY1.CMP
As you can see,
cmd indicates any files marked as being offline by enclosing their sizes in parentheses. It does not however affect the total bytes indicated at the bottom.
You can also use PowerShell to view it:
> dir * | select Name, Attributes | more
AGUY0.CMP Archive, NotContentIndexed
AGUY1.CMP ...emporary, Offline, NotContentIndexed
Another (messy) way to see it is to use the
> fsutil usn readdata AGUY0.CMP
File Attributes : 0x2020
> fsutil usn readdata AGUY1.CMP
File Attributes : 0x3120
You’ll notice that the attributes of the second file include the
0x1000 bitmask of the
FILE_ATTRIBUTE_OFFLINE attribute constant.
One curious (though understandable) observation is that in Vista+, the files that are marked as offline are automatically also marked as non-indexed (i.e., the
I attribute). However, using
attrib to remove the
I attribute does not strip them of the offline attribute; they no longer have the non-indexed attribute but remain marked as offline.
Figure 1: Screenshot of offline files in Windows 7 Explorer
You can strip the attribute with the
attrib command from newer versions of Windows. If that is not feasible, then you can also use a shell-extension like Febooti’s FileTweak or Attribute Changer. You can also use an alternative to
attrib or even
cmd itself like JPSoft’s Take Command. PowerShell can also be used to access and modify extended attributes, but it’s not as nice as
attrib or a shell-extension.