31

Under Windows 10 cmd.exe, the command del *.tmp may silently delete files like project.tmpl.

Is there some option, workaround, registry entry, or ritual sacrifice to prevent this?

For the incredulous: on my machine, on which the C: drive was formatted by a Windows 10 installer in 2020:

Demo

(where the French error message means file not found).

9
  • 1
    Are you asking if there is a registry edit that makes Windows ignores the del command? del *.tmp should only delete files with the .tmp file exttension that exist within the directory the command was issued in.
    – Ramhound
    Apr 26, 2021 at 14:44
  • 15
    @Ramhound I think by default globs in windows match 8.3 filenames in addition to the long filenames. That is probably why the OP is asking. Apr 27, 2021 at 10:16
  • 14
    Wow, that's a trap. Apr 27, 2021 at 12:16
  • 1
    @TimSeguine there's no globbing in Windows. file.exe *.txt passes the raw *.txt string to the file.exe. Windows also doesn't split arguments and the program must parse its own command line to get the list of tokens. In reality the C runtime does that for you
    – phuclv
    Apr 27, 2021 at 16:51
  • 4
    As already written in various answers, the problem is that a file normally has an "8.3" file name; probably project.tmpl has the "8.3" name PROJEC~1.TMP. The Windows API provides a function (SetFileShortName()) that allows changing (renaming) the "8.3" file name of a file without changing the "long" name. So your file might still be named project.tmpl but the "8.3" name may be project.tpl instead of projec~1.tmp. Unfortunately, I didn't find out if there is a "ready" command line command or if you'd have to write a short C/C++ program to do this... Apr 28, 2021 at 9:28

4 Answers 4

36

A file may have short DOS 8.3 names and all internal commands from DOS era also work with both long and short name for compatibility reasons1 so a file with long extension may be accidentally matched. There are many similar questions:

It'd be better to use PowerShell because short names aren't matched anymore. dir in cmd must match the short names in order to not break legacy programs. PowerShell doesn't have that limitation. Just run Remove-Item *.tmp or any of its aliases like rm *.tmp, del *.tmp

In cmd you'll have to filter with findstr like this

for /F "delims=" %f in ('dir /B ^| findstr /I /E ".tmp"') do @del "%f"

(Replace %f with %%f in a batch file)

There are also many other solutions such as forfiles (as that's not a cmd's internal command) that you can find in How can I get the "dir" and "copy" commands to operate on "*.xyz" but not "*.xyz~"?


However it'll be even better to disable 8.3 name generation and remove all the short names. In fact since Windows 8 and Windows Server 2012 newly formatted volumes will have 8.3 name generation disabled by default for performance reasons. That'll also help avoid situations like this: WinXP dir command: 3 and 4 char extensions are the same?

In fact, recent versions of Windows Server don’t even enable 8.3 naming when you format new data volumes.

https://docs.microsoft.com/en-us/archive/blogs/josebda/windows-server-2012-file-server-tip-disable-8-3-naming-and-strip-those-short-names-too

If your drive still has 8.3 name generation enabled then run the following command to disable it on drive C:

fsutil 8dot3name set C: 1

or run fsutil 8dot3name set 1 to disable it on all volumes

The setting can also be set in registry. The corresponding key is HKLM\System\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation. The value for the fsutil and the registry key is like this

  • 0: Enables 8dot3 name creation for all volumes on the system.
  • 1: Disables 8dot3 name creation for all volumes on the system.
  • 2: Sets 8dot3 name creation on a per volume basis.
  • 3: Disables 8dot3 name creation for all volumes except the system volume.

If the names are there it can also be removed with fsutil 8dot3name strip

Note that fsutil must be run with admin privileges


1Old commands list their files using the old FindFirstFile API which matches both long and short names. See Why does FindFirstFile find short names?. New code should use FindFirstFileEx instead to avoid that

14
  • 3
    While I confess I could use powershell in the case at hand, there are times where it's not an option because cmd.exe is invoked by some essential legacy tool (like Keil's uVision 4).
    – fgrieu
    Apr 26, 2021 at 16:01
  • 1
    @phuclv I wonder if there is another factor which enables 8.3 names? Like @fgrieu I also have Windows 10 machine which has only ever had W10 installation and see same issue with cmd.exe del *.tmp. It seems fsutil 8dot3name strip C: doesn't turn off 8.3 as it warns of many registry keys using 8.3 filenames - though I won't risk "/f" option.
    – DuncG
    Apr 26, 2021 at 17:30
  • 3
    @fgrieu can't you just run PS script from batch script in that case?
    – PTwr
    Apr 26, 2021 at 23:31
  • 3
    Disabling 8.3 names generation will work out badly if you learn to rely on having this and then accidentally delete some files on a flash drive (which might've been formatted and populated on another machine) this way.
    – Ruslan
    Apr 27, 2021 at 21:38
  • 4
    @Ruslan relying on 8.3 names will work out badly because those names aren't shown by default and can be changed arbitrarily, so a naive wildcard like *1.* may delete all files because short names tend to have a number in their names. Never use short names in any cases. All applications already support long names. Anything that doesn't accept a long path or path with spaces is shitty and must be thrown away
    – phuclv
    Apr 28, 2021 at 2:35
9

The reason this happens is that Windows has retained compatibility with file names from MS-DOS, where file names were limited to a 3-character extension. To facilitate the transition, Windows 95 introduced a compatibility mode where every file has an “8.3” alias, also known as the file's “short name”: in addition to project.tmpl, the same file is also accessible as PROJEC~1.TMP. You can see these short names in directory listings with dir /x. The wildcard pattern *.tmp matches this alternative name (file names are case-insensitive). Microsoft documents this for dir; it applies to other commands as well, including del.

I can reproduce the behavior you've observed on my corporate Windows 10 machine (not upgraded from a previous Windows 10). I have local admin privileges, but not domain admin, and I'm not allowed to run fsutil 8dot3name query c: (Error: Access is denied.).

If you control the part of the system that's producing the temporary files, a robust workaround is to give them an extension that is anything but 3 (or 0) characters long. *.tm or *.temp would not match 8.3 aliases of file names with a different extension. Alternatively, put those temporary files in a separate directory and just remove the whole directory when you want to delete them.

2
  • Did you elevate your cmd window before trying (must have „Administrator:“ in title). I don’t think this is or normally prevented from local admins.
    – eckes
    Apr 28, 2021 at 1:12
  • 1
    @eckes Yes, as I wrote, I tried this as local administrator (or whatever it means when I start a cmd window using “run as administrator” and it says “Administrator” in the window title). Apr 28, 2021 at 8:40
8

In addition to the CMD-based solution provided in phuclv's answer, you can use the not-well-known-but-very-cool FORFILES command:

FORFILES /M *.tmp /C "CMD /C ECHO @path && DEL @path"

The "search mask" parameter (/M) does not match on the 8.3 names, hence .tmp and .tmpl are two different extensions without any additional filtering. The search mask is also case-insensitive.

For example:

C:\TEMP>echo a > del_test_1.tmp

C:\TEMP>echo a > del_test_2.TMP

C:\TEMP>echo a > del_test_3.tmpl

C:\TEMP>dir *.tmp
 Volume in drive C is Windows
 Volume Serial Number is B0F0-812B

 Directory of C:\TEMP

04/28/2021  11:46 AM                 4 del_test_1.tmp
04/28/2021  11:48 AM                 4 del_test_2.TMP
04/28/2021  11:48 AM                 4 del_test_3.tmpl
               3 File(s)             12 bytes
               0 Dir(s)  179,312,234,496 bytes free

C:\TEMP>FORFILES /M *.tmp /C "CMD /C ECHO @path && DEL @path"

"C:\TEMP\del_test_1.tmp"
"C:\TEMP\del_test_2.TMP"

C:\TEMP>dir *.tmp
 Volume in drive C is Windows
 Volume Serial Number is B0F0-812B

 Directory of C:\TEMP

04/28/2021  11:48 AM                 4 del_test_3.tmpl
               1 File(s)              4 bytes
               0 Dir(s)  179,310,305,280 bytes free
4

You need one for loop to avoid some 3rd file with additional characters after ".tmp" to be deleted too...

for /t tokens^=* %i in ('where .:*.tmp')do echo\ del "%~i"

The where command will return only files .end with .tmp (only)...

You can also try /Recursive:

for /t tokens^=* %i in ('where/r "D:\MyProject\Folder" *.tmp')do echo\ del "%~i"

  • I can't explain the reason for this event that happened to you, but it happens to me too...

  • Now I know... @phuclv explained in his answer ... plz, consider his answer

> reg query "HKLM\System\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem
    NtfsDisable8dot3NameCreation    REG_DWORD    0x0

enter image description here

enter image description here


  • Using For /fwith whereto keep files *.tmp*

enter image description here

  • I also don't know how to explain why this event doesn't happen with @spikey_richie...
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .