Black-clock icon overlay?

file-attributes

While I was cleaning up some (very) old files, I decompressed a .zip file which contained some old files from 1989. I was surprised to find that some of the files are showing a black clock icon overlay as seen below.

I opened a command-prompt and checked them with attrib, but found nothing unusual. I also checked the Advanced Attributes dialog for them and still found nothing unusual.

What the heck is going on and how can I get rid of it?

Figure 1: Windows Explorer showing files with black-clock overlays

Screenshot of Windows Explorer showing unknown black-clock icon overlays

Solution 1:

Meaning

According to Microsoft’s Raymond Chen, it is one of the more baffling icon overlays (probably due to its rareness). The black-clock overlay is the NTFS extended attribute “offline” which indicates that it has been backed up to tape. In other words, the file is not currently accessible without first mounting the correct tape.

Explanation

“But I don’t have a tape drive!” I hear you object. That is not surprising; neither do I. Raymond explains:

The black clock is particularly baffling because you sometimes see it even if your system is not equipped with Hierarchical Storage Management. When this happens, it's because some program (typically a setup program) didn't check error codes properly.

In my case, the file was created in 2010, likely in Windows 7 (it is stamped as being made in 2010). It was decompressed in Windows XP onto an NTFS volume created by Windows 7. A bug in 7-Zip or the contents of the file itself has probably caused an inconsistency that led to this bizarre behavior.

Observations

Windows XP’s attrib command cannot show the attribute because XP was released in 2001 and is limited to the basic RASH attributes (it does not show a few other attributes that can be seen in Vista+). However, if you enable the Attributes column in Windows XP Explorer, you can see the attribute indicated by an O.

A curiosity caused by the attribute is with the dir command:

1989.01.19  09:53            11,800 AGUY0.CMP
1989.01.19  09:54          (10,912) AGUY1.CMP

As you can see, cmd indicates any files marked as being offline by enclosing their sizes in parentheses. It does not however affect the total bytes indicated at the bottom.

You can also use PowerShell to view it:

>  dir * | select Name, Attributes | more

Name                                                                 Attributes
----                                                                 ----------
AGUY0.CMP                                            Archive, NotContentIndexed
AGUY1.CMP                               ...emporary, Offline, NotContentIndexed

Another (messy) way to see it is to use the fsutil command:

> fsutil usn readdata AGUY0.CMP
…
File Attributes  : 0x2020
…

> fsutil usn readdata AGUY1.CMP
…
File Attributes  : 0x3120
…

You’ll notice that the attributes of the second file include the 0x1000 bitmask of the FILE_ATTRIBUTE_OFFLINE attribute constant.

One curious (though understandable) observation is that in Vista+, the files that are marked as offline are automatically also marked as non-indexed (i.e., the I attribute). However, using attrib to remove the I attribute does not strip them of the offline attribute; they no longer have the non-indexed attribute but remain marked as offline.

Figure 1: Screenshot of offline files in Windows 7 Explorer

Screenshot of offline files in Windows 7

Solution

You can strip the attribute with the attrib command from newer versions of Windows. If that is not feasible, then you can also use a shell-extension like Febooti’s FileTweak or Attribute Changer. You can also use an alternative to attrib or even cmd itself like JPSoft’s Take Command. PowerShell can also be used to access and modify extended attributes, but it’s not as nice as attrib or a shell-extension.