1

I have a 300 GB HDD in a Windows 7 computer. The main partition C: in wich Windows is installed, was 280 GB, and yesterday had 120 GB of free space, but with "Disk management" a part of windows's program "computer management" the program could reduce C: but only by 30 GB, remaining 250 GB for C:, which is a reduction in size of only a quarter of the free space available.

This prompted me to search for answers, making me read this great first answer. I did the steps described in the answer except removing the file that it's producing the problem (I hope it's the one I suspect), because I don't know if I should try to remove or uninstall this file, and how do it without causing severe problems if that's possible.

So, here are the reports result of following the answer linked before

First, I searched on the Windows event log > application and found 2 events of ID 259, the ones referred in the answer, and they seem identical, so I will only reproduce the details of one of them:

Disclaimer: I know it's in spanish, I'm sorry for that: If you need I can translate it, no problem. But if you only need file location, then I don't need to translate it, also you may google translate.

Se inició un análisis de reducción de volumen en el volumen OS (C:). Esta entrada del registro de eventos contiene información acerca del último archivo no movible que podría limitar el número máximo de bytes reclamables.

 Detalles de diagnóstico:
 - El último archivo no movible parece ser: \ProgramData\Microsoft\Diagnosis\events01.rbs::$DATA
 - El último clúster del archivo es: 0x40b5688
 - Destino potencial de reducción (dirección LCN): 0x201538a
 - Las marcas de archivo NTFS son: ----D
 - Fase de reducción: <analysis>

 Para obtener más detalles acerca de este archivo, use el comando "fsutil volume querycluster \\?\Volume{d4dd19c7-01e3-11e2-9368-806e6f6e6963} 0x40b5688

I executed the command asked to execute in that report at the end. This is the result:

C:\Users\Nico>fsutil volume querycluster \\?\Volume{d4dd19c7-01e3-11e2-9368-806e
6f6e6963} 0x40b5688
Clúster 0x00000000040b5688 usado por ----D \ProgramData\Microsoft\Diagnosis\even
ts01.rbs::$DATA

It's the same info that's on the first report. At last , I include a more complete copy of all the report of the ID 259 event:

Nombre de registro:Application
Origen:        Microsoft-Windows-Defrag
Fecha:         18/12/2015 03:29:12 p.m.
Id. del evento:259
Categoría de la tarea:Ninguno
Nivel:         Información
Palabras clave:Clásico
Usuario:       No disponible
Equipo:        leon
Descripción:
Se inició un análisis de reducción de volumen en el volumen OS (C:). Esta entrada del registro de eventos contiene información acerca del último archivo no movible que podría limitar el número máximo de bytes reclamables.

 Detalles de diagnóstico:
 - El último archivo no movible parece ser: \ProgramData\Microsoft\Diagnosis\events01.rbs::$DATA
 - El último clúster del archivo es: 0x40b5688
 - Destino potencial de reducción (dirección LCN): 0x20153fa
 - Las marcas de archivo NTFS son: ----D
 - Fase de reducción: <analysis>

 Para obtener más detalles acerca de este archivo, use el comando "fsutil volume querycluster \\?\Volume{d4dd19c7-01e3-11e2-9368-806e6f6e6963} 0x40b5688".
XML de evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Defrag" />
    <EventID Qualifiers="16384">259</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-12-18T18:29:12.000000000Z" />
    <EventRecordID>56671</EventRecordID>
    <Channel>Application</Channel>
    <Computer>leon</Computer>
    <Security />
  </System>
  <EventData>
    <Data>OS (C:)</Data>
    <Data>\\?\Volume{d4dd19c7-01e3-11e2-9368-806e6f6e6963}</Data>
    <Data>\ProgramData\Microsoft\Diagnosis\events01.rbs::$DATA</Data>
    <Data>0x40b5688</Data>
    <Data>0x20153fa</Data>
    <Data>----D</Data>
    <Data>&lt;analysis&gt;</Data>
    <Binary>00000000C7000000AF00000000000000223679625372B2B9637B71360E00000000000000</Binary>
  </EventData>
</Event>

Note: The events were marked as defrag, I had defragged just before checking the event list, and 2 times, probably that's the reason of two of that kind events. I'm not entirely sure the events are of the defrag or of the disk manager.

Community
  • 1
Santropedro
  • 699
  • 1
  • 13
  • 24

1 Answers1

0

There are control records stored high up in the free space. Disk Management cannot move those and will give you only the free space beyond those control records. Use this program. It can move the control records.

whs
  • 1,301
  • 9
  • 10
  • I want a way to it without 3rd party. That guy's answer in my post was very upvoted, so there should be a way natively. – Santropedro Dec 19 '15 at 19:58
  • If you show me more evidence of those "control records", in form of articles on the web or a test for me to do, I'll follow your advice. – Santropedro Dec 19 '15 at 20:03
  • Read this. Although it was in the context of Vista, it is still the same. http://www.howtogeek.com/howto/windows-vista/working-around-windows-vistas-shrink-volume-inadequacy-problems/ – whs Dec 20 '15 at 02:38
  • You better look again. – whs Dec 20 '15 at 02:54
  • Now I have seen it. I will attempt it. – Santropedro Dec 20 '15 at 04:00