#StackBounty: #windows-server-2008-r2 #ntfs #disk-volume What are $Extend$Deleted file system entries and how do I get rid of them?

Bounty: 50

I’d like to shrink an NTFS data partition on one of my servers. Unfortunately, it has an “unmovable file” located at an inconvenient position.

Here is the relevant event log entry:

A volume shrink analysis was initiated on volume Daten (C:Daten). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.

Diagnostic details:
– The last unmovable file appears to be:
$Extend$Deleted:$I30:$INDEX_ALLOCATION
– The last cluster of the file is: 0x1138f943
– Shrink potential target (LCN address): 0x18a51d6
– The NTFS file flags are: —-I
– Shrink phase: <analysis>

To find more details about this file please use the “fsutil volume querycluster \?Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943” command.

The command mentioned at the bottom of the event log entry does not yield any useful additional information:

C:> fsutil volume querycluster \?Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943
Cluster 0x000000001138f943 used by ----I $Extend$Deleted:$I30:$INDEX_ALLOCATION

(Note (note sure if it’s relevant): The last thing I did on the drive was to delete all shadow copies.)

I am aware that $Extend is not a “regular” folder but some kind of NTFS system file. Thus, my question:

What is this $Extend$Deleted file system entry and how do I get rid of it? (Or, at least, get rid of its “unmovability” so that I can shrink my volume…)


Get this bounty!!!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.