Can't shrink partition due to mystery file
My system came with win xp. I installed Win7 in a separate partition, volume E. That was a while ago. I don't need xp anymore and now I want to shrink the C partition so that I can grow E. I deleted most files from C but since the boot manager is there I'm not totally deleting the partition. However I cannot shrink the partition because of a system file that's at the end. FSUTIL reports that the file name is "$LogFile::$DATA". I can't find it using any method I know of, I don't know what it is, but I want to get rid of it. What is it, and how can I delete it or otherwise shrink the partition? Here's what I have now:
Solution 1:
This is not a mystery file.
It's documented in loads of books and WWW sites about NTFS. This is one of several files — $MFT, $MFTMirr, $Volume, $Bitmap, $Boot, and so forth — that are integral parts of the NTFS on-disc structures. They have these names by convention, but the names don't appear in any directories seen by application-mode Win32 code — and thus end users. They have fixed, well-known, node numbers in the Master File Table. $LogFile is MFT entry #3, and it is used for NTFS transaction logging.
::$DATA denotes a data stream of the transaction log file. (This denotes the default data stream of a file, in fact.) You cannot shrink your volume because the place where that stream is stored is currently at the end of the volume. You need to relocate the contents of $LogFile to nearer the beginning of the volume, a task which some (not all) disc defragmentation tools are capable of.
You don't get to delete $LogFile, or indeed any of the other metadata files. That will prevent the correct operation of NTFS.
Further reading
- Anthony J. Sammes and Brian Jenkinson (2007). The New Technology File System. Forensic computing. (2nd edition). Springer. ISBN 9781846283970.
Solution 2:
You have to turn off system restore before you can resize the partition.
See more here.
Solution 3:
I managed to use the Free version of Paragon Partition Manager.
- I had to create an adjacent partition to be able to shrink the main partition using the 'shrink' option.
- It took forever for the initial scan before it started - with no percentage warning and some quite patronizing messages with bad grammar telling me 'we are nearly there' and 'dont take this for granted' or some such. I think this phase is just to make sure the drive isn't bad - and that's probably a good safeguard.
- Initially it forced a reboot but the drive is an external USB drive and it couldn't find it on boot. So I just removed the drive letters so within Windows it was then able to do it.
In the end it did work just fine though and moved a $Bitmap file that nothing else seemed to want to move (Defraggler / Contig).