XP hard drive suddenly full. Bug?

A customer's XPP machine suddenly won't boot, either regularly, Last Good or Safe mode.

I took out the drive and installed it as a passenger in another machine. I ran a NOD32 virus check which came up clean but Tree Size revealed that there's only 18mb free space left on this 20gb drive. This is curious as the elderly customer only does a bit of bookwork and some emailing, and the last time I looked he hadn't used more than 5 or 6gb of his HDD.

A closer look at Tree Size reveals that the drive usage now breaks down to 1gb - program files, 3gb - Windows, 2gb - assorted, and the rest, 13.6gb, is in the System Volume Information folder.

This seems real strange and I'm wondering if a bug is responsible.

Does anyone know what might have occurred here? Or how it can be fixed? I guess I could try and empty the System Volume Information folder but I don't know if this would be wise.

TX

 

Hello TX,

I've run into this a few times - the problem is an app writing restore points, for example Norton in one instance, or a program like SpyBot that by default also writes RP's w/o the user realizing it.

XP's SR by defualt uses up to 12% (System Volume Information file) of the HD. By your description of the way the system is being used, half that or less would be adequate.

Right click My Computer > properties > SR tab and adjust the slder down and reboot. That'll get rid the excess.

If there is a problem (if SR is broken):

Shut SR off: My Computer > Properties > System Retore tab > Check "Turn off System Restore on all drives ".

Reboot.

Go back and re-enable SR - will create an initial restore point.

After re-establishing SR, a way to test the Restore function:

Take any executable file ( extention .exe) , and burn it out and/or move it to the My Documents folder and delete it from it's original location. SR does not monitor files in My Documents folder regardless of file type.

Then restore to the initial restore point created by the system; the deleted executable should be back in it's original location. Afterwards, you can delete the copy in My Documents.

Regards - Charles

 

Charles, thanks for your response. Unfortunately, it isn't that simple.

If you re-read my first post you'll see that the hard drive won't boot in it's normal host system. It won't boot into Last Known Good config or Safe Mode.

So there's no way of turning off or adjusting System Restore because the system can't be entered.

It's only because I've pulled the drive and have it running in my workshop machine that I can see the contents of the hard drive and the unusually large System Volume Information folder.

My question was: How can adjustments be made to the system from it's current situation?

 

Hi TX,

If you re-read my first post you'll see that the hard drive won't boot in it's normal host system. It won't boot into Last Known Good config or Safe Mode
I got that - your question was about SR - not about not being able to boot.

What I addressed is what may have caused the large restore file and what can be done about it once its back in the host system. If the two are connected, then the SR file size is a symptom, not a cause.

This seems real strange and I'm wondering if a bug is responsible.
To answer directly, probably a "broken" app, could be malware.

My question was: How can adjustments be made to the system from it's current situation?
Right now, run other anti-malware apps besides NOD, which while a strong AV, is not especially good at detecting trojans. MS's Anti-Spyware and SpySweeper are for the time being the best. The two combined is the best combo.

I guess I could try and empty the System Volume Information folder but I don't know if this would be wise.
No point in keeping it - there is nothing usefull in there, and a "restore" would not work given your description. And if it does turns out to be malware, it's in the restore file as well.

It may turn out that you may have to do a repair install (an option on the XP install disc) or full re-install once you're thru with this HD depending on what you find.

Regards - Charles

 

Thanks Charles. The internet is a brilliant source of information but it's a bit like a calculator - you need to ask your question correctly, plus you need to know roughly what your answer should be

What I should have asked was:

Is there anything I can do to remedy the situation, while this hard drive is sitting in a foreign location, so that when the drive is replaced into it's own environment, it will boot normally?

As I really don't want to get involved in a repair install or a reinstall unless it's absolutely necessary, I guess that I should also have asked: Does anyone know if the System Volume Information folder can be cleaned out without making the system unstable, given that the drive is located where it is now?

Whew!

I note that your suggestion is to empty the folder (or was it to delete it?) Ok, I thank you for that. It's pretty much what I would have suggested myself if I'd been asked. However, seeing as how I'll need to fix it if I get it wrong, I guess I'm fence-sitting to an extent and trying to find a known-to-be-safe solution before I jump. Could be, such a thing doesn't exist

Cheers.

 

Hi masonite,

Is there anything I can do to remedy the situation, while this hard drive is sitting in a foreign location, so that when the drive is replaced into it's own environment, it will boot normally?
A question that's hard to answer - you're the man on the spot with access to the system files. Since you have it in "the shop ", can you hook it up to be a boot drive? That would certainly make it easier to see what's actually happening.

Have you tried booting into the system with an XP cd?

Does anyone know if the System Volume Information folder can be cleaned out without making the system unstable, given that the drive is located where it is now?
I don't know that for sure because I never ran into this nor have I read of anyone else that ran into this particular situation - you're the first - BTW keep us posted. I would say it wouldn't cause a problem by emptying it, the system does that all the time when SR is disabled. And I think it does it by erasing/recreating.

Regards - Charles

 

Hi Charles.

I suppose I could hook it up to be boot drive, but the shop machine is a different mobo than what it's used to and it'd probably unsettle it's system.

But I can't see it booting anyway - it won't do it in it's home box. It gets the boot menu ok via the F8 key but Safe Mode won't kick in nor will the last known good configuration - it just keeps going back to the first boot screen, over and over.

I guess 18mb of free space just isn't enough to allow booting!

Someone else just made an interesting suggestion - so simple that it seems to good to be true. He said, why not turn System Restore OFF for that drive, via the host system?

Well, I checked, and of course the drive is showing up under the host's System Restore settings as being 'Monitored'. As yes, I guess I could turn that OFF. But something tells me that this won't work. Maybe it's the thought that such switching would only be relevant to the the host system and wouldn't affect this guest drive.

What do you think?

 

Hi masonite,

Well, I checked, and of course the drive is showing up under the host's System Restore settings as being 'Monitored'. As yes, I guess I could turn that OFF. But something tells me that this won't work. Maybe it's the thought that such switching would only be relevant to the the host system and wouldn't affect this guest drive.
LOL, it's so obvious - it would empty the file.

A few forehead slaps are in order - give your colleague a cookie.

Regards - Charles

 

LOL. Wish I could say it worked but nope - it didn't

As I said, I think the System Restore status is only relevant to the host system.

As I see it, I've have about 3 choices:
a) In the shop PC, try a disk cleanup or delete the SVI folder
b) In it's own box, try Winternal's ERD commander which would let me get access to the drive. But I don't think this would vary much from a). I'd still be unable to employ it's own system to make changes.
c) In the shop pc, clone the 20gb drive onto a spare 40gb unit, put the drive back into it's own box, turn off System Restore, remove the drive again and re-clone it back onto the original 20gb drive. Cor...what a performance

 

Hi TX,

LOL. Wish I could say it worked but nope - it didn't
Then I don't think it'll work on the host system either. You're going to have to use the deltree command.

Cor...what a performance
I think you're earning your salary and then some

Regards - Charles

 

Hi Charles. Well, the situation is growing steadily worse

First, I cloned the 20gb drive onto a spare 40gb hdd, so at least I've got the original to fall back on. I also figured that the system might not feel so constrained by lack of space, seeing as it now had more than 20gb of free space, and not a mere 18mb as before.

Then I tried booting the 40gb drive in the original box. No joy - same results as with the original.

Ran the Winternals ERD recovery CD and established that it WOULDN'T carry out a System Restore, even though this facility is on it's menu. Kept moaning about some kind of prob with the registry. (Who knows )

So I pulled the 40gb drive and reinstalled it into the shop pc. Then opened up the SVI folder and deleted 2\3 of the Restore files. Put the drive back into the original box - no change. Durn!

Ok, maybe a (shudder) repair install will work........Nope - just keeps looping and restarting.

What about a Recovery Console repair then?......

This is where I'm now at - trying to make sense of my options. I think one of 'em outta be 6 months on a tropical beach. Without a computer in sight

 

Hi TX,

I've asked one of the Mods to move this thread to the XP section, it'll get more views from people that don't look into the security section.

I think one of 'em outta be 6 months on a tropical beach.
Ditto, I've got a snow storm to deal with here in the North East US.

Regards - Charles

 

have you defraged that drive, sounds like it has missmatched the reg size. try it, it may help. then run check disk. this has help me in the past.

 

Hi Charles. This'll be my last post on the subject, as I'm having to do a system reinstall, which there's no point in dwelling on.

Just one thing I'll mention. Originally when the drive was trying to boot, there was a brief flash of blue screen with an error message, but it was gone too fast to read.

I've just spent an hour trying to piece the message together, a few characters at a time as they flashed on the screen and after I got about 75% of it, I did a google and got this:

<Stop c000021a {Fatal System Error}
The session manager initialization system process terminated unexpectedly with a status of 0xc0000017 (0x00000000, 0x0000000) The system has been shut down>

The message above actually applies to WinNT, but I'm assuming that the problem is similar to this XPP hassle.

So, it's hard to say exactly what it actually was, or what caused it. All I know is that I've got to rebuild the durn thing and I'm not loving it!

So thanks for your efforts, Charles, and anyone else who responded. Chalk it up to one more Microsoft Mystery!

 

masonite - sorry to hear you gotta scrub and start over. That's always a bummer.

For future reference, there is a setting change you can make - and IMO should make on a workstation - that causes the PC to stop at a blue screen in the event of a crash so you can easily see the details. The default setting is to automatically restart and while that may be good for production servers where you don't want them staying down, it just doesn't make sense for a workstation where you want to see the details.

As you found out, the change needs to be made while the system is running because when things get bad, you often can't recover from a crash long enough to change anything.

Get to the setting with a right-click on My Computer then left-click on properties, click the advanced tab, click the Startup & Recovery button

 

Thanks Newt - that's a good tip.

Cheers.