How to Clean Up Large System Volume Information Folder on Windows Windows OS Hub.pdf
How to Clean Up Large System Volume Information Folder on Windows?
One of the servers (running Windows Server 2016) has run out of free disk space on a system drive (C:). I checked and cleaned all resource-consuming locations (WinSxS, TEMP folders, inactive user profiles, old update files, etc.), but it didn’t give a noticeable effect. There was still not enough disk space. At last, I have found that a large part of a system drive has been occupied by System Volume Information folder. In this article I will try to tell you how the System Volume Information folder is used on Windows, what is stored in it, and how to properly clean it up.
How to Access System Volume Information Folder on Windows?
The System Volume Information folder is automatically created at the root of each drive (be it a local HDD, SSD, removable USB flash drive, SD card). It stores system data related to System Restore, Indexing, File History, etc.
By default, the System Volume Information folder is hidden and only the NT AUTHORITYSYSTEM account can access it.
In order to show this folder, you need to disable the option “Hide protected operating system files” in File Explorer or run a PowerShell script:
$regkey = 'HKCU:SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced'
Set-ItemProperty $regkey Hidden 1
Set-ItemProperty $regkey HideFileExt 0
Set-ItemProperty $regkey ShowSuperHidden 1
Stop-Process -ProcessName explorer
Even the administrator cannot open it and view the contents of the folder. If you try to open the System Volume Information folder in File Explorer under any user (even under the built-in administrator account), you will receive an access denied error:
To view the contents of the folder, you have to assign yourself as the directory owner and grant your account the NTFS permissions to access it (this can be done through the Security tab in the folder properties). But it is much faster to assign yourself the owner and grant access to the directory from the command prompt:
takeown /f "C:System Volume information"
icacls "C:System Volume Information" /grant woshubjwolf:F
Check in the folder properties on the Security tab that your account now has full control permissions.
You can also view the contents of the System Volume Information directory by running the PowerShell console with NT AUTHORITYSYSTEM privileges:
PsExec.exe -i -s powershell.exe
To view the contents of a folder, run the command:
Get-ChildItem 'C:System Volume Information'
The folder size can be found with the following PowerShell command:
(Get-ChildItem 'C:System Volume Information' | measure Length -s).sum / 1Gb
To restore the original permissions on the System Volume Information folder, run:
icacls "C:System Volume Information" /setowner "NT AuthoritySystem"
icacls "C:System Volume Information" /remove woshubjwolf
What is System Volume Information Folder in Windows?
What is stored in the System Volume Information folder? I found information about the following services, which store their files in this folder (the list is not exhaustive):
WindowsImageBackup —system restore points on desktop Windows versions or System State backups made using Windows Server Backup (wbadmin) in server OSs;
The contents of Indexing Service database used for fast file search (including Outlook search);
Distributed Link Tracking Service database;
-
Disk snapshots made by Volume Shadow Copy, which can be used to recover older versions of files. For each snapshot, a separate file is created with a long ID as a name;
Base and chunks of the Data Deduplication service;
DFS Replication database (dfsr.db);
WPSettings.dat file – created by the storage service (StorSvc);
The USB drives will also store an IndexerVolumeGuid file that defines the unique disk label used by the Windows Search service;
AppxProgramDataStaging, AppxStaging – Windows UWP app backups (it can be used for recovery after removal).
If you are using shadow copies on your computer or server to roll back to old versions of files/system states, keep in mind that each new VSS snapshot saves data to the System Volume Information directory, increasing its size. The more often shadow copies are created and the more often the files on the disk change, the faster the size of this directory grows.
In the screenshot below, you can see that in the System Volume Information folder there is a system file larger than 160 GB.
How to Clean Up System Volume Information Folder?
Note. It is not recommended to manually delete files in System Volume Information folder, since it stores information for system recovery and data for some critical services.
You can radically clean up the System Volume Information directory by disabling the system restore points and file history. But this is not always acceptable.
Firstly, let’s see what is stored in this directory. Display the statistics of using shadow copies:
vssadmin list shadowstorage
As you can see, 10% of system drive (C:) space is allocated for shadow copy files and only 2% of which is used. If the value of Maximum Shadow Copy Storage space is set to UNBOUNDED, it means that the limit for shadow copies is not set and they can potentially take up all available free disk space. Windows by default allocates 10% of the total disk size for storing shadow copies.
You can reduce the disk usage limit of VSS to 2 GB using the vssadmin command. The vssadmin command has the following syntax:
vssadmin resize shadowstorage /on=[drive letter]: /For=[drive letter]: /MaxSize=[maximum size]
In our example it will look like this:
vssadmin resize shadowstorage /on=c: /for=c: /maxsize=2GB
If you create system state backups using WSB (Windows Server Backup), all old system state copies can be deleted as follows (in the Windows Server editions):
wbadmin delete systemstatebackup -keepversions:0
To quickly clean up old versions of VSS snapshots on Windows Server, use the diskshadow tool:
DiskShadow
Delete shadows OLDEST c:
Each time the command is run, the oldest shadow copy (snapshot) of the volume is deleted.
When you run the wbadmin delete systemstatebackup command in Windows 10, an error appears: “The DELETE BACKUP command is not supported in this version of Windows“. The fact is that on desktop OS (Windows 10/ 8.1/ 7), restore point and limits can only be managed from the Windows GUI. Open the System properties and click on the System Protection tab.
Select the system drive and click the Configure button. The quota configuration dialog box for storing system restore points will open. You can reduce the size of the disk for storing shadow copies. Here you can either delete all existing restore points (Delete button), or completely disable the creation of restore points by selecting Disable system protection.
To reduce the size of the System Volume Information directory you can also:
Move the VSS data to another NTFS drive (vssadmin add shadowstorage /for=c: /on=d: /maxsize=30%);
Disable or reconfigure the Windows File History feature;
-
Clean up system files using the built-in tool cleanmgr.exe (disk properties -> Disk Cleanup).
Clean Up Dedup ChunkStore in System Volume Information
When analyzing the contents of the System Volume Information folder on Windows Server, you may notice that the DedupChunkStore directory is consuming a lot of space. This means that file deduplication feature is enabled for this volume.
If the Windows Data Deduplication service found identical chunks (fragments) in files on a volume, it replaces them with a link to the unique chunk, which is saved to the System Volume Information directory. If you move or delete optimized files from a deduplicated volume, old chunks are not deleted immediately. These blocks are removed by a special GarbageCollection job that runs once a week. This is why space on a deduplication-enabled volume is not immediately reclaimed.
To immediately start the process of removing unused chunks, run the PowerShell command:
start-dedupjob -Volume C: -Type GarbageCollection
The next dedup job will check the integrity of the remaining chunks:
start-dedupjob -Volume C: -Type DataScrubbing
To monitor these tasks, use the Get-DedupJob cmdlet.
After the completion of the tasks, unused chunks in the System Volume Information directory will be deleted, and additional disk space will be freed.
Be careful when disabling data deduplication for a volume with the Start-DedupJob -Volume D: -Type Unoptimization command. This command will delete all chunks in the System Volume Information directory and the unoptimized files on the volume will revert to their original size. Therefore, before disabling optimization, make sure that there is enough free disk space.