System Volume Information 16GB

[Outpost]

Hi,

On one of my servers we have a logical drive E:\ at 53GB capacity. I noticed it was getting a bit on the low side and ran the utility windirstat.info/ It has picked up 30 system volume information files which are 500-600MB each.
The earliest one is from the end of October up to today.
I would like to know what these files are and why there are 30 of them. Is it safe to delete them? the old ones anyway.

Thanks

[djm968]

Is the server a DC? Could be apps that have been deployed via GPO.

[cookie_monster]

They could be shadow copy files.

[Outpost]

Yes it is a dc (child) with no GPO applications apart from Office 2003 and no shadow copies are enabled although it does run backup exec.

[Michael]

The problem is without knowing for sure they could be anything. In which case, leave well alone. I wouldn't want to create you work on a Friday afternoon. That's just cruel!

[cookie_monster]

Can you post the name and extension of one of the files?


As stated i would leave alone for now.

[Outpost]

They come up as system files, here's one 31{3808876b-c176-4e48-b7ae-04046ebcc752} I'm just puzzled why there's so many of them and it appears they delete themselves after a set time.
They've probably been there all along.

[Michael]

Are they created and deleted after a consistent period of time?

[cookie_monster]

They sound sooooo like shadow copy files to me, 30 is the maximum amont of shadow copy files and they delete themselves after this amout.

Shadow copies don't have to be stored on the volume that it is enabled on.

[cookie_monster]

ooops sorry it 64 per volume so at 2 per day that just over 30 days, oh well

[Outpost]

It does seem like shadow copies although it is disabled and there are no 'Previous versions' tab on folder properties.

[link470]

Hmm, thinking to my home machine, you said you use Backup Exec? If I'm not mistaken that's a Symantec product, and I use Norton SystemWorks Premier at home. I have no idea if this is connected, but with Norton SystemWorks, it uses the "Norton Protected Recycle Bin" and it keeps copies of everything you delete either for a certain period of time, or until you right click the recycle bin and select "Empty Norton Protected Files". That gets rid of all the files that were being held, and for me, those files are held in a hidden System Volume Information folder. Check if you're running a Norton Protected Recycling Bin.

[cookie_monster]

I noticed some posts earlier on that suggested backup exec so i checked our servers and i don't see any files like that. We use backup exec 11d.

[PiqueABoo]

backup exec so i checked our servers and i don't see any files like that

Don't know about 11D but for previous versions, BE typically interacts with VSS to get a shadow copy of whatever made. Then something bad happens and those VSS copies don't get cleaned up.

IME they always show up in Explorer's Shadow Copies tab (r-click any drive). If you see them and you're lucky, then restarting the still running Volume Shadow Copy service actually works and that cleans up the old shadow copies. However sometimes the VSC service won't stop and you need to restart the server.

I'd start with a:

vssadmin list writers

If you see any with an Error status, get that VSC service restarted one way or another.

[Outpost]

You're spot on PiqueABoo!!!!

I couldn't see any shadow copies but I restarted the Volume Shadow Copy Service and just like cillit bang the dirt is gone.

Thanks to all for your help.