"Cannot delete empty folder"

Nov 8, 2010 at 2:16 PM
Edited Nov 8, 2010 at 2:24 PM

Hi,

I am having a mysterious behaviour.

I created a VHD from a VSS snapshot.

Now I want to delete some of the stuff in it. I recursively delete folders and files. (Just like the ntfs.directory.delete(path, recursive=true) function.)

I am getting errors:  Unable to delete non-empty directory, although there is no file in it. (I checked with mounting VHD to Win7 OS.)

I get the same error, when I want to delete it via the Explorer. (I can e.g. renamed it.)

But if i create or move a file into it and press delete then in the Explorer, it works!?

What is happening here? It seems that the MFT is somehow "confused" or damaged and the file creation "repairs" it?

 

Do you have an idea?

What I actually just want is: Remove a directory structure from my VHD file.

 

Regards,

Jango

Coordinator
Nov 9, 2010 at 1:06 AM

Hi,

How did you create the original VHD?  (which tools, etc)

It's possible there's something strange in the file system.  It would be interesting to run DiscUtil's ntfsdump on the VHD.  That will display a lot of the underlying data structures in NTFS and may provide a clue as to the problem.

To capture the NTFS info, run:  ntfsdump myfile.vhd > output.txt

It generates a *lot* of output, so if you delete all the other files from the VHD first, it will cut down a lot on the output.

 

Cheers,

Ken

Nov 9, 2010 at 10:58 AM

Hi Ken,

I used your code for creating VHD from VSS snapshot. The VSS snapshot was made using alphavss. I dumped the NTFS.

My case: I want to delete the \Users\User\Documents folder, which is empty. I deleted all files recursively including hidden/system. It is empty now.

The structure is this:

 

+-Users\ (463)
| +-User\ (63097)
| | +-Documents\ (63106)
| | +-Favorites\ (63104)
| | +-Music\ (63102)
| | +-Pictures\ (63101)

 

Here is the dump of the MFT from Documents, I see three things at the bottom, Reparse points?!  (Eigen~1, ..)

Do I have to remove them before deleting? If so, how? I cannot see them?

 

FILE (Documents)
  File Number: 63106
  FILE RECORD (DOCUME~1)
                Magic: FILE
    Update Seq Offset: 48
     Update Seq Count: 3
    Update Seq Number: 9
     Log File Seq Num: 257188652
      Sequence Number: 2
      Hard Link Count: 2
                Flags: InUse, IsDirectory
     Record Real Size: 632
    Record Alloc Size: 1024
            Base File: MFT:0 (ver: 0)
    Next Attribute Id: 8
      Attribute Count: 7
     Index (Self Ref): 63106
  STANDARD INFORMATION ATTRIBUTE (No Name)
          Creation Time: 30.04.2010 10:05:26
      Modification Time: 08.11.2010 11:02:00
       MFT Changed Time: 08.11.2010 11:02:00
       Last Access Time: 08.11.2010 11:02:00
       File Permissions: ReadOnly
           Max Versions: 0
                Version: 0
               Class Id: 0
            Security Id: 839
          Quota Charged: 0
         Update Seq Num: 0
    ATTRIBUTE RECORD
                Type: StandardInformation
        Non-Resident: 0
                Name: 
               Flags: None
         AttributeId: 0
         Data Length: 72
             Indexed: 0
  FILE NAME ATTRIBUTE (No Name)
    FILE NAME RECORD
       Parent Directory: MFT:63097 (ver: 3)
          Creation Time: 30.04.2010 10:05:26
      Modification Time: 30.04.2010 10:05:26
       MFT Changed Time: 30.04.2010 10:05:26
       Last Access Time: 30.04.2010 10:05:26
         Allocated Size: 0
              Real Size: 0
                  Flags: Directory
          Ext Attr Size: 0
              Namespace: Dos
              File Name: DOCUME~1
    ATTRIBUTE RECORD
                Type: FileName
        Non-Resident: 0
                Name: 
               Flags: None
         AttributeId: 3
         Data Length: 82
             Indexed: 1
  FILE NAME ATTRIBUTE (No Name)
    FILE NAME RECORD
       Parent Directory: MFT:63097 (ver: 3)
          Creation Time: 30.04.2010 10:05:26
      Modification Time: 30.04.2010 10:05:26
       MFT Changed Time: 30.04.2010 10:05:26
       Last Access Time: 30.04.2010 10:05:26
         Allocated Size: 0
              Real Size: 0
                  Flags: Directory
          Ext Attr Size: 0
              Namespace: Win32
              File Name: Documents
    ATTRIBUTE RECORD
                Type: FileName
        Non-Resident: 0
                Name: 
               Flags: None
         AttributeId: 2
         Data Length: 84
             Indexed: 1
  OBJECT ID ATTRIBUTE (No Name)
      Object ID: e345df78-2c42-11df-a904-000c29e08d45
    ATTRIBUTE RECORD
                Type: ObjectId
        Non-Resident: 0
                Name: 
               Flags: None
         AttributeId: 7
         Data Length: 16
             Indexed: 0
  INDEX ROOT ATTRIBUTE ($I30)
    Length: 56 bytes
      Data:  30 00 00 00 01 00 00 00 00 10 00 00 01 00 00 00 10 00 00 00 28 00 00 00 28 00 00 00 01 00 00 00...
    ATTRIBUTE RECORD
                Type: IndexRoot
        Non-Resident: 0
                Name: $I30
               Flags: None
         AttributeId: 6
         Data Length: 56
             Indexed: 0
  INDEX ALLOCATION ATTRIBUTE ($I30)
    Length: 4096 bytes
      Data:  49 4E 44 58 28 00 09 00 7C 75 38 0F 00 00 00 00 00 00 00 00 00 00 00 00 28 00 00 00 70 01 00 00...
    ATTRIBUTE RECORD
                Type: IndexAllocation
        Non-Resident: 1
                Name: $I30
               Flags: None
         AttributeId: 4
         Starting VCN: 0
             Last VCN: 0
       Comp Unit Size: 0
       Allocated Size: 4096
            Real Size: 4096
       Init Data Size: 4096
            Data Runs: +87725[+1]
  BITMAP ATTRIBUTE ($I30)
    Length: 8 bytes
      Data:  01 00 00 00 00 00 00 00
    ATTRIBUTE RECORD
                Type: Bitmap
        Non-Resident: 0
                Name: $I30
               Flags: None
         AttributeId: 5
         Data Length: 8
             Indexed: 0
  INDEX ($I30)
    R:
          E
            :i0:
                  {EIGENE~1-->MFT:63164 (ver: 2)}
                  {EIGENE~2-->MFT:63165 (ver: 2)}
                  {EIGENE~3-->MFT:63166 (ver: 2)}
                  E

 

I also found the MFT:63106 of "documents" here in the Dump:

MFT Reference: MFT:63106 (ver: 2)
   Birth Volume: 9252ca7c-d328-4f57-a617-6ad086109ec9
       Birth Id: e345df78-2c42-11df-a904-000c29e08d45
   Birth Domain: 00000000-0000-0000-0000-000000000000
  OBJECT ID INDEX ENTRY
             Id: e345df79-2c42-11df-a904-000c29e08d45
--------------------
                  {[Key-Id:e345df78-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:63106 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df78-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                    :i8:
                          {[Key-Id:e345df4e-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62547 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df4e-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df4f-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62536 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df4f-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df50-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62545 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df50-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df51-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62539 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df51-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df52-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62548 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df52-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df53-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62538 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df53-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df54-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62541 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df54-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df55-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62540 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df55-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df56-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62542 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df56-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          {[Key-Id:e345df57-2c42-11df-a904-000c29e08d45]-->[Data-MftRef:MFT:62549 (ver: 2),BirthVolId:9252ca7c-d328-4f57-a617-6ad086109ec9,BirthObjId:e345df57-2c42-11df-a904-000c29e08d45,BirthDomId:00000000-0000-0000-0000-000000000000]}
                          E

 

And here is one of the three Eigen~1 ReparsePoint:

FILE (EIGENE~1)
  File Number: 63164
  FILE RECORD (EIGENE~1)
                Magic: FILE
    Update Seq Offset: 48
     Update Seq Count: 3
    Update Seq Number: 4
     Log File Seq Num: 257188302
      Sequence Number: 2
      Hard Link Count: 1
                Flags: InUse, IsDirectory
     Record Real Size: 480
    Record Alloc Size: 1024
            Base File: MFT:0 (ver: 0)
    Next Attribute Id: 5
      Attribute Count: 4
     Index (Self Ref): 63164
  STANDARD INFORMATION ATTRIBUTE (No Name)
          Creation Time: 30.04.2010 10:05:27
      Modification Time: 30.04.2010 10:05:27
       MFT Changed Time: 08.11.2010 11:02:00
       Last Access Time: 30.04.2010 10:05:27
       File Permissions: Hidden, System, ReparsePoint, NotIndexed
           Max Versions: 0
                Version: 0
               Class Id: 0
            Security Id: 837
          Quota Charged: 33193560
         Update Seq Num: 0
    ATTRIBUTE RECORD
                Type: StandardInformation
        Non-Resident: 0
                Name:
               Flags: None
         AttributeId: 0
         Data Length: 72
             Indexed: 0
  FILE NAME ATTRIBUTE (No Name)
    FILE NAME RECORD
       Parent Directory: MFT:63106 (ver: 2)
          Creation Time: 30.04.2010 10:05:27
      Modification Time: 30.04.2010 10:05:27
       MFT Changed Time: 30.04.2010 10:05:27
       Last Access Time: 30.04.2010 10:05:27
         Allocated Size: 0
              Real Size: 0
                  Flags: Directory
          Ext Attr Size: 0
              Namespace: Dos
              File Name: EIGENE~1
    ATTRIBUTE RECORD
                Type: FileName
        Non-Resident: 0
                Name:
               Flags: None
         AttributeId: 3
         Data Length: 82
             Indexed: 1
  INDEX ROOT ATTRIBUTE ($I30)
    Length: 48 bytes
      Data:  30 00 00 00 01 00 00 00 00 10 00 00 01 00 00 00 10 00 00 00 20 00 00 00 20 00 00 00 00 00 00 00...
    ATTRIBUTE RECORD
                Type: IndexRoot
        Non-Resident: 0
                Name: $I30
               Flags: None
         AttributeId: 1
         Data Length: 48
             Indexed: 0
  REPARSE POINT ATTRIBUTE (No Name)
                    Tag: a0000003
                   Data: 00 00 2E 00 30 00 26 00 5C 00 3F 00 3F 00 5C 00 43 00 3A 00 5C 00 55 00 73 00 65 00 72 00 73 00...
    ATTRIBUTE RECORD
                Type: ReparsePoint
        Non-Resident: 0
                Name:
               Flags: None
         AttributeId: 4
         Data Length: 104
             Indexed: 0
  INDEX ($I30)
    R:
          E

 

Does this information tell you something?

 

Kind regards,

Jango

 

Coordinator
Nov 10, 2010 at 12:07 AM

Thanks for the info.

Looking at this, the reparse points are marked Hidden System, which means they won't be enumerated by default.  You can do this to ensure the these files are deleted:

            fs.NtfsOptions.HideHiddenFiles = false;
            fs.NtfsOptions.HideSystemFiles = false;

As part of this, I found that DiscUtils is not correctly tidying up reparse points if a file or directory is deleted that has an attached reparse point.  I've uploaded a fix that corrects that.

Cheers,

Ken

Nov 10, 2010 at 8:06 AM
Edited Nov 10, 2010 at 9:55 AM

 

 

Thank you Ken for the quick reaction.

I made some progress.

At first I saw that I was missing

                                ntfs.NtfsOptions.HideDosFileNames = false;

as somehow those Reparsepoints are only treated as that.

After that, these Reparsepoints appeard in the dir.GetDirectories() list.

 

After your fix, they were removed successfully!

 

Many thanks for your great library,

Jango

Coordinator
Nov 11, 2010 at 12:49 AM

You might want to run chkdsk on the volume - I'm pretty sure it's invalid to have files (or directories) with just a DOS name, which is why you're seeing weird behaviour. There should either be two directory entries for each reparse point (the short name and the long name), or a single Win32AndDos name.

 

Cheers,

Ken