8

My system came with win xp. I installed Win7 in a separate partition, volume E. That was a while ago. I don't need xp anymore and now I want to shrink the C partition so that I can grow E. I deleted most files from C but since the boot manager is there I'm not totally deleting the partition. However I cannot shrink the partition because of a system file that's at the end. FSUTIL reports that the file name is "$LogFile::$DATA". I can't find it using any method I know of, I don't know what it is, but I want to get rid of it. What is it, and how can I delete it or otherwise shrink the partition? Here's what I have now:

pic1 pic2

Elroy Flynn
  • 181
  • "$LogFile::$DATA" sounds like system restore. Is that on for your XP drive (within windows 7)? – skub Jan 15 '12 at 04:24
  • Yes, it is on drive c, which was my xp drive, and I am running from a win7 boot. – Elroy Flynn Jan 15 '12 at 04:28
  • Have you tried booting into a linux cd and looking on that drive for hidden files? But as skub said in that answer make sure system restore is off first. – opsin Jan 15 '12 at 04:54
  • 4
    The $LogFile file is a part of the NTFS filesystem metadata, it's used as part of journaling. The ::$DATA part of the name indicates the default $DATA stream of the file. I don't know why it's causing a problem, though. See Here and here – Andrew Lambert Jan 15 '12 at 07:10
  • It is possible to move it with some boot defraggers, one of them was "Ultimate Defrag" (did not always work) . It is re-written when Cloning or Full imaging a parttion also. I would be using cheap trick methods, shrink partition on image recover, offline defrag and shrink. Use a partition shrinker has an offline/at boot mode (best). The OS isnt going to pull off most of this stuff correct, you need 3rd party things. – Psycogeek Jan 15 '12 at 08:32
  • Not sure if anyone has suggested it, but I think you need to defrag your hard disk before you adjust the partitions. I remember having to do this (or it being highly recommended) before partition changes. – skub Jan 15 '12 at 15:35

6 Answers6

6

This is not a mystery file.

It's documented in loads of books and WWW sites about NTFS. This is one of several files — $MFT, $MFTMirr, $Volume, $Bitmap, $Boot, and so forth — that are integral parts of the NTFS on-disc structures. They have these names by convention, but the names don't appear in any directories seen by application-mode Win32 code — and thus end users. They have fixed, well-known, node numbers in the Master File Table. $LogFile is MFT entry #3, and it is used for NTFS transaction logging.

::$DATA denotes a data stream of the transaction log file. (This denotes the default data stream of a file, in fact.) You cannot shrink your volume because the place where that stream is stored is currently at the end of the volume. You need to relocate the contents of $LogFile to nearer the beginning of the volume, a task which some (not all) disc defragmentation tools are capable of.

You don't get to delete $LogFile, or indeed any of the other metadata files. That will prevent the correct operation of NTFS.

Further reading

  • Anthony J. Sammes and Brian Jenkinson (2007). The New Technology File System. Forensic computing. (2nd edition). Springer. ISBN 9781846283970.
JdeBP
  • 27,013
1

I got bored trying to solve exact same problem from inside Windows. Not internal nor third-party tools mentioned here and in the neighboring answers helped me. So I resorted to Linux and just used Gnome Disk Utility utility Resize function with no repercussions whatsoever.

But it must be noted that I previously turned off Pagefile, Hibernation, System Restore and System protection as per this answer

conscio
  • 11
1

No defrag solution worked simply or quickly.

Instead, I moved a stuck file with a free version of EaseUS Partition Master. In minutes I had it installed, rebooted, and my partition shrunk.

You run the UI under Windows straight after installation, and after selecting the shrink operation, and clicking Apply, it will ask to reboot and shrink the volume while offline.

Jacob Bruinsma
  • 401
1

You have to turn off system restore before you can resize the partition.

See more here.

Community
  • 1
skub
  • 2,793
  • 14
  • 16
  • 3
    that's not the issue (apparently). System restore was already turned off for drive c. I also turned it off for e:, but no joy. – Elroy Flynn Jan 15 '12 at 05:03
  • Should C be set to "Active"? Not sure you can resize it while active. Shouldn't windows 7 partition be active or am I missing something? – skub Jan 15 '12 at 05:05
  • 1
    "Active" is just a single bit - AFAIK, telling the MBR which partition to boot from. If the bootloader in the MBR is smarter, it has its own list and doesn't even use the bit. – u1686_grawity Jan 15 '12 at 13:44
1

I managed to use the Free version of Paragon Partition Manager.

  • I had to create an adjacent partition to be able to shrink the main partition using the 'shrink' option.
  • It took forever for the initial scan before it started - with no percentage warning and some quite patronizing messages with bad grammar telling me 'we are nearly there' and 'dont take this for granted' or some such. I think this phase is just to make sure the drive isn't bad - and that's probably a good safeguard.
  • Initially it forced a reboot but the drive is an external USB drive and it couldn't find it on boot. So I just removed the drive letters so within Windows it was then able to do it.

In the end it did work just fine though and moved a $Bitmap file that nothing else seemed to want to move (Defraggler / Contig).

mwfearnley
  • 7,423
Simon
  • 662
0

The only working solution was to shrink partition with MiniTool Partition Wizard which will move files at boot-time and shrink partition to desired size. If it writes something about filesystem error then run chkdsk /F /R C: in cmd.exe after Windows loads, it will suggest to run this at boot-time, reboot, wait while file system is checked, then again try to shrink partition with Partition Wizard.

mixel
  • 471