A. When you shrink a volume, the system searches for the last file on the volume that can't be moved. The space after this file is the amount by which you can shrink a volume. There are some actions you can take to increase the amount you can shrink, but first you need to know which file is causing the problem. Open Event Viewer and check the application log for defrag events. One event will confirm that a shrink analysis was performed and identify the last file that can't be moved. The event will look similar to this:
Log Name: Application
Source: Microsoft-Windows-Defrag
Date: 4/13/2010 1:55:49 PM
Event ID: 259
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: SAVDALWKS01.savilltech.net
Description:
A volume shrink analysis was initiated on volume (C:). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.
Diagnostic details:
- The last unmovable file appears to be: \System Volume Information\\\{a1524e09-463c-11df-94cc-d8d3859a9860\\}\\{3808876b-c176-4e48-b7ae-04046e6cc752\\}::$DATA
- The last cluster of the file is: 0x10d8203
- Shrink potential target (LCN address): 0xafc7b2
- The NTFS file flags are: ---AD
- Shrink phase: <analysis> To find more details about this file please use the "fsutil volume querycluster \\?\Volume\\{57f23d49-4104-11df-ac3d-806e6f6e6963\\} 0x10d8203" command.
To get more information, run the command that it recommends and you can see the actual file.
C:\Windows\system32>fsutil volume querycluster \\?\Volume\\{57f23d49-4104-11df-ac3d-806e6f6e6963\\} 0x10d8203
Cluster 0x00000000010d8203 used by ---AD \System Volume Information\\\{a1524e09-463c-11df-94cc-d8d3859a9860\\}\\{3808876b-c176-4e48-b7ae-04046e6cc752\\}::$DATA
Here's another example, from after I turned off System Restore (which was the file above):
C:\Windows\system32>fsutil volume querycluster \\?\Volume\\{57f23d49-4104-11df-ac3d-806e6f6e6963\\} 0xfadcbb
Cluster 0x0000000000fadcbb used by ----D \ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb::$DATA
Now the problem is the Windows Search components index database. I turn off and disable Windows Search service and see
C:\Windows\system32>fsutil volume querycluster \\?\Volume\\{57f23d49-4104-11df-ac3d-806e6f6e6963\\} 0xf88150
Cluster 0x0000000000f88150 used by ----D \Users\josavi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat::$DATA
Now it's the Internet Explorer temporary files cache.
Once we know the file that's causing the problem, you can try to address it. Common files that cause problems are:
- Restore Points used by System Restore: To resolve, use the System Control Panel applet and disable System Restore for the volume.
- IE temporary files index: Clear the Internet Explorer temporary Internet Files or run Disk Cleanup.
- Windows Search Index: Disable the Windows Search service, stop the service, defrag, then enable it again.
- Pagefile: Set the pagefile size to 0, reboot the machine, shrink the volume, then re-enable the pagefile.
You may find third-party disk defrag programs have better luck moving "unmovable" files than the built-in defrag.
