Server Bug Fix: What are $Extend$Deleted file system entries and how do I get rid of them?

Original Source Link

I’d like to shrink an NTFS data partition on one of my servers. Unfortunately, it has an “unmovable file” located at an inconvenient position.

Here is the relevant event log entry:

A volume shrink analysis was initiated on volume Daten (C:Daten). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.

Diagnostic details:
– The last unmovable file appears to be:
$Extend$Deleted:$I30:$INDEX_ALLOCATION
– The last cluster of the file is: 0x1138f943
– Shrink potential target (LCN address): 0x18a51d6
– The NTFS file flags are: —-I
– Shrink phase: <analysis>

To find more details about this file please use the “fsutil volume querycluster \?Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943” command.

The command mentioned at the bottom of the event log entry does not yield any useful additional information:

C:> fsutil volume querycluster \?Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943
Cluster 0x000000001138f943 used by ----I $Extend$Deleted:$I30:$INDEX_ALLOCATION

(Note (note sure if it’s relevant): The last thing I did on the drive was to delete all shadow copies.)

I am aware that $Extend is not a “regular” folder but some kind of NTFS system file. Thus, my question:

What is this $Extend$Deleted file system entry and how do I get rid of it? (Or, at least, get rid of its “unmovability” so that I can shrink my volume…)

I ran into the $Extend$Deleted folder as well and have been combing the web for information. I’m not entirely satisfied with this answer, but here is what I found:

Tagged : / /

Leave a Reply

Your email address will not be published. Required fields are marked *