Announcement

Collapse
No announcement yet.

Shadow copies files not deleted

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Shadow copies files not deleted

    Hi,

    I run a win2003 R2 SP2 server that had shadow copies enabled for the drive E:
    I have disabled shadow copy on that drive and deleted the previous versions. However when i browse to System Volume Information folder on the E: drive i see a bunch of files that stay here.

    I have tried to stop the shadow copy service and tried to delete the copy using vssadmin but it says it couldnt find any files.
    When i try to delete the file manually it says that the files are used by another process and cant be deleted.

    Any ideas?

  • #2
    Re: Shadow copies files not deleted

    Isn't that the System restore data which you also can disable by rightclicking my computer?
    Marcel
    Technical Consultant
    Netherlands
    http://www.phetios.com
    http://blog.nessus.nl

    MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
    "No matter how secure, there is always the human factor."

    "Enjoy life today, tomorrow may never come."
    "If you're going through hell, keep going. ~Winston Churchill"

    Comment


    • #3
      Re: Shadow copies files not deleted

      Originally posted by Dumber View Post
      Isn't that the System restore data which you also can disable by rightclicking my computer?
      That could be the case on XP or Visa but I don't think Server has System Restore.

      System Volume Inforatmion stores more than just Shadow Copies. Could also be DFSR metadata.

      Comment


      • #4
        Re: Shadow copies files not deleted

        You're so true...
        I missed that...
        Marcel
        Technical Consultant
        Netherlands
        http://www.phetios.com
        http://blog.nessus.nl

        MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
        "No matter how secure, there is always the human factor."

        "Enjoy life today, tomorrow may never come."
        "If you're going through hell, keep going. ~Winston Churchill"

        Comment


        • #5
          Re: Shadow copies files not deleted

          The System Volume Information folder has got the System and Hidden attributes ticked and it's only accessible by the built-in system account and not the Administrators by default (At least in win2003).
          Not quite sure why the snapshots are not deleted from there when you manually deleted them but you can try to edit the ACL on the folder and try to delete files from there afterwards.
          I haven't tried this myself, so it's just a thought.

          Cheers
          Caesar's cipher - 3

          ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

          SFX JNRS FC U6 MNGR

          Comment


          • #6
            Re: Shadow copies files not deleted

            Have you stopped both the "Microsoft Software Shadow Copy Provider" and the "Volume Shadow Copy" services when trying to delete the files manually?

            Comment


            • #7
              Re: Shadow copies files not deleted

              both services are stopped when i try deleting the files. DFS is also stopped.

              I have granted manually the full rights to my account on the folder and subfolders.

              Still impossible to delete any files.

              Forgot to mention: this server is running SharePoint services, could that be a reason those files are still there?
              Also we run legato networker that uses snapshots technology...
              Last edited by toto; 9th July 2008, 08:50.

              Comment


              • #8
                Re: Shadow copies files not deleted

                Have you tried Process Monitor which is an enhancement of FileMon? http://technet.microsoft.com/en-us/s.../bb896645.aspx
                Mayby that'll shed some more light into it.
                Caesar's cipher - 3

                ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

                SFX JNRS FC U6 MNGR

                Comment


                • #9
                  Re: Shadow copies files not deleted

                  are you also running the index service?
                  Marcel
                  Technical Consultant
                  Netherlands
                  http://www.phetios.com
                  http://blog.nessus.nl

                  MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
                  "No matter how secure, there is always the human factor."

                  "Enjoy life today, tomorrow may never come."
                  "If you're going through hell, keep going. ~Winston Churchill"

                  Comment

                  Working...
                  X