18

I have yet another problem with the System Volume Information folder on my machine. I'm using Windows 10 Home 21H2. The folder occupies ~150GB (that is ~60% of my C: drive)

Among other sources, I used information from here

I tried:

  • Cleaning using CleanMgr.exe (normal & admin)
  • Reducing space for Sytem Restore points (to 10%)
  • Deleting all System Restores (there were none)
  • Disabling System Restore
  • Checked Volume Shadow Copy
    • vssadmin list shadows reports no shadows exist
    • vssadmin list shadowstorage reports 0MB used for shadows, max 1% storage for shadows
  • Checked Windows Backups
    • wbadmin get versions reports no backups
  • Tried DiskShadow tool, does not exist (only for Windows Server?)

Nothing helped, size only reduced minimally

I used the FolderSize tool to analyze the storage, and found out that the largest part is occupied by single files with GUIDs as names (there are >100 of them, dating back to the year 2018):

File sizes in FolderSize

I understand the importance of the System Volume Information folder and you should not mess with it. But from the link above, the relevant data like backups, quotas, deduplication, etc. is stored not in those files. They seem to be Disk Snapshots.

My question: Is it safe to delete those files?

Update from comments:
Output of vssadmin list shadowstorage:

C:\WINDOWS\system32>vssadmin list shadowstorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

No items found that satisfy the query.

Update 2:
I checked using a hexeditor, and then a self-made program. ALL files only contain 0-Bytes (many of them of several GBs).

Udate 3:
I followed @harrymc advice and moved the files to another folder (using Linux Live USB) and observed the system for several days, if the system runs correctly and if new files appear.

In this time, I used the laptop as usual, hibernated , restarted, shut down, and had a Windows Update installed. I experienced no issues

The files did not reappear.

Also, system checks as pointed out by others (dism, chkdsk, sfc) did not report any issues

I made some statistics, and found out that at the beginning, the files were created back-to-back, so the creation date of a file was the same as the last-written date of a previous file. Then some gaps started to show up (regions where no file existed), of 1-3 days, and recently there were gaps of 1-2 months.

The last file was from 6.10.2022, I moved the files on 12.10.2022 (so ~1 week later).

11
  • From admin CMD Prompt, you could copy one of those files to your desktop, and try to open it using 7-Zip. If you can't access the SVI folder, then try launching CMD.exe as System
    – w32sh
    Oct 11, 2022 at 3:36
  • Could you include the output of vssadmin list shadowstorage?
    – harrymc
    Oct 11, 2022 at 8:43
  • Try: In an elevated PowerShell, run Start-DedupJob -Type GarbageCollection -Priority High -Volume "C:".
    – harrymc
    Oct 11, 2022 at 12:53
  • @harrymc I don't have the Start-DedupJob Cmdlet. From what I gather from the resources, deduplication applies only to windows server, but I have Windows 10 home. And as there is no Start-DedupJob, I don't think this is about deduplication garbage...
    – king_nak
    Oct 11, 2022 at 21:15
  • @w32sh I managed to open such a file (~4GB) in a hex editor. It was all NULL-Bytes... This looks like pure garbage
    – king_nak
    Oct 11, 2022 at 21:32

4 Answers 4

4
+150

If these files are garbage, full of zeros, you could move them all elsewhere. If no problem arises for a few days, they can be deleted. If this is hard to do in Windows, use a Linux Live USB.

Watch to see if the files return. If they do, you can check whether this happens at a certain time, for example after boot, and trace this period using Process Monitor, which can also do boot-time monitoring if required, to find the process that creates them. I wouldn't be surprised if that process turns out to belong to Windows.

5
  • 1
    I followed this advice and moved the files using a linux live system. I will watch the system for a few days
    – king_nak
    Oct 13, 2022 at 13:52
  • I updated my question with findings. The files did not reappear, so no further investigation for now. I'll except your answer as there is nothing todo at the moment #
    – king_nak
    Oct 17, 2022 at 10:37
  • This answer is too generic to be very useful. The correct answer is superuser.com/a/1784954/235533 below. Asker, please move the green checkmark. Feb 27 at 23:26
  • @foobarbecue: Restore Point files are not all-zero.
    – harrymc
    Feb 28 at 6:32
  • @harrymc, I see. I hadn't read Update 2, sorry. Feb 28 at 22:13
13

These are restore points. If you don't think you need to rollback something, you can delete them as follows:

  1. Click on the Windows Icon and search for "Advanced" to open the "Advanced System Settings"
  2. System protection > Configure...
  3. Delete all restore points for this drive

enter image description here

1
  • You sure, are a legend! Dec 26, 2023 at 6:52
4

Here's another command, which can clear SVI not reachable by vssadmin:

wmic shadowcopy delete /nointeractive

More here:

https://notes.ponderworthy.com/disable-sentinelone-to-permit-svi-cleanup

1

This folder contains Windows restore point, if you enabled system protection, they are stored here. I find this feature is really useful if you try something really stupid like install third party storage controller (Intel rapid...) and end up with can't be uninstalled -- create restore point before install, install them, not satisfy, do system restore, and they're gone.

If you do hope to clean this folder, go to control panel, all control panel items, recovery, configure system restore, select desired drive, configure, delete. This is a safe way to erase big files under System Volume Information. You may also turn off this feature so files no longer generated.

If there are still large file, delete use Linux tool chain, they are no longer linked to your current running system (safe to treat as dead files).

1
  • Agree. In my case on Win10 22H2 in that folder was 3 big files. Then I checked restore points and there was automatically created at the same dates. Have cleared restore points and files from SVI disapeared.
    – Vit
    Mar 26, 2023 at 18:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .