Home / server / Questions / 42697
Accepted
Aaron
Asked: 2009-07-20 05:36:35 +0800 CST

View files set for deletion during the next system restart

  • 772

Note:

  • NTFS - version 3.1 - used fsutil to obtain information
  • Microsoft Windows XP [Version 5.1.2600]

Question:

  • Method (or tool) to obtain, a list of files set for deletion during the next system restart?
windows ntfs

1 Answers

  1. Best Answer

    There is a free MS/Sysinternals program called pendmoves that can show you the list of files waiting to be deleted/moved on reboot.

    You can also look at the following registry key for a list of pending operations:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations

    The API operation that does this is called MoveFileEx() with the MOVEFILE_DELAY_UNTIL_REBOOT option.

    More information in this KB.

    FYI, to manually add a working entry to this area of the registry you can do the following:

    1. Start REGEDT32 (W2K) or REGEDIT (WXP) and navigate to: HKLM\System\CurrentControlSet\Control\Session Manager

    2. W2K: Edit, Add Value..., Data Type: REG_MULTI_SZ, Value Name: PendingFileRenameOperations, OK

    WXP: Edit, New, Multi-String Value, [enter] PendingFileRenameOperations

    1. In the Data area, enter "\??\" + filename to be deleted. LFNs may be entered without being embedded in quotes. To delete "C:\Long Directory Name\Long File Name.exe", enter the following data:

    \??\C:\Long Directory Name\Long File Name.exe

    Then press OK.

    1. The "destination file name" is a null (zero) string. It is entered as follows:

    W2K: Edit, Binary, select Data Format: Hex, click at the end of the hex string, enter 0000 (four zeros), OK.

    WXP: Right-click the value, choose "Modify Binary Data", click at the end of the hex string, enter 0000 (four zeros), OK.

    1. Close REGEDT32/REGEDIT and reboot to delete the file.

    From this thread.

    Of course using movefile is easier than doing all that.

    • 5