I'd like to shrink an NTFS data partition on one of my servers. Unfortunately, it has an "unmovable file" located at an inconvenient position.
Here is the relevant event log entry:
A volume shrink analysis was initiated on volume Daten (C:\Daten). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.
Diagnostic details:
- The last unmovable file appears to be: \$Extend\$Deleted:$I30:$INDEX_ALLOCATION
- The last cluster of the file is: 0x1138f943
- Shrink potential target (LCN address): 0x18a51d6
- The NTFS file flags are: ----I
- Shrink phase: <analysis>To find more details about this file please use the "fsutil volume querycluster \\?\Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943" command.
The command mentioned at the bottom of the event log entry does not yield any useful additional information:
C:\> fsutil volume querycluster \\?\Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943
Cluster 0x000000001138f943 used by ----I \$Extend\$Deleted:$I30:$INDEX_ALLOCATION
(Note (note sure if it's relevant): The last thing I did on the drive was to delete all shadow copies.)
I am aware that $Extend
is not a "regular" folder but some kind of NTFS system file. Thus, my question:
What is this $Extend\$Deleted file system entry and how do I get rid of it? (Or, at least, get rid of its "unmovability" so that I can shrink my volume...)
I ran into the
$Extend\$Deleted
folder as well and have been combing the web for information. I'm not entirely satisfied with this answer, but here is what I found:$Extend
has been around for a long time,$Deleted
appears to be a relatively new addition, appearing in Windows 10 for client OS'es, unsure about server.$Deleted
when they have an open handle but a request has been made to delete them.$Deleted
but never get actually removed.$Deleted
files by booting to Windows, normally it seems these files should be cleared out upon reboot (since all handles will be released).