The System Volume Information folder is a hidden and protected folder located at the root of every drive or partition. It’s even found on your SD card, USB pen drive, and external hard disk if you have connected them to your Windows computer earlier. It’s is not a virus or malware.
But, what exactly is the System Volume Information folder? Why is the folder so huge? Can you delete the folder?
This System Volume Information FAQ page has answers to all your questions.
What is the System Volume Information folder?
System Volume Information (SVI) is the datastore folder used by the System Restore feature. However, it’s not only used by the System Restore feature. It’s also used by Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), to store the encryption keys. In addition, SVI stores metadata and information used by Windows Backup, System Image Backup, Volume Shadow Copy service, and Windows Search indexing.
Why is System Volume Information not accessible?
The System Volume Information folder is restricted using NTFS permissions. By default, only the NT AUTHORITYSYSTEM account (“LocalSystem”) has access (Full control) to the folder and its subfolders.
Even if you’re logged in as an administrator, you’ll see the following error message when accessing the folder:
Location is not available System Volume Information is not accessible. Access is denied.
If you need to get into the folder to check its contents, see the next paragraph.
How to gain access to System Volume Information
Only the SYSTEM account has full access to the SVI folder by default. No other user or group can view the contents of this directory.
However, you can gain access to the System Volume Information folder using two methods:
Option 1: Run Command Prompt under the SYSTEM account
Using Microsoft’s PsExec.exe utility or other third-party tools, you can start a Command Prompt session under the SYSTEM account. It lets you view, modify or delete the contents of System Volume Information.
For more information, see the article How to Run a Program as SYSTEM (LocalSystem) Account in Windows
This option is preferred as there is no need to modify the folder permissions or access control entries (ACE or ACL) and later revert to the default.
Note that you can’t run File Explorer under the LocalSystem account. If you want to manage the SVI folder using GUI, you may use a third-party tool like File Commander or Total Commander (run as SYSTEM)
Option 2: Take ownership & assign full access to your account
(This is not the preferred method. There are hundreds or thousands of files in the SVI folder, and you don’t want to mess up their permissions. But, if you need to do that, follow the steps below:)
You can modify the access control entry to assign your user account full control permissions for System Volume Information and its subfolders and files:
First, you need to change ownership of those files individually — using Takeown.exe or via File Explorer.
From an admin Command Prompt window, run the following commands:
To gain access to the System Volume Information folder only:
takeown /f "C:System Volume information" icacls "C:System Volume Information" /grant username:F
You should be able to do a directory listing of the System Volume Information folder, but not in the subfolders. If that doesn’t serve your purpose and you want to alter the permissions recursively (across subfolders), run the set of commands mentioned below:
Restore the default permissions
If you’ve not made the permission changes recursively, you can restore the original permissions easily. To do so, run these two commands:
icacls "C:System Volume Information" /setowner "NT AuthoritySystem" icacls "C:System Volume Information" /remove username
You should see the message Successfully processed n files; Failed processing 0 files
As said earlier, the above commands (to restore the default permissions) won’t help if you’ve modified the SVI folder permissions, subfolders, and files en masse.
What does the System Volume Information folder contain?
Here is the typical directory structure of the System Volume Information folder on the system drive:
C:. │ IndexerVolumeGuid │ Syscache.hve │ WPSettings.dat │ ├───EDP │ └───Recovery ├───Windows Backup │ └───Catalogs │ GlobalCatalog.wbcat │ GlobalCatalogCopy.wbcat │ GlobalCatalogLock.dat │ ├───SPP │ └───OnlineMetadataCache │ └───SppCbsHiveStore │ └───SppGroupCache ├───SystemRestore │ └───AppxProgramDataStaging │ └───AppxStaging │ └───ComPlusStaging │ └───FRStaging │ └───FRStaging{8665F319-6B09-46AE-AAEE-75CF8D2D0EC8} └───WindowsImageBackup ├───Catalog │ BackupGlobalCatalog │ GlobalCatalog │ └───SPPMetadataCache {17466c2b-b1e0-4958-b962-c0c19974d1a0} {24499217-fe70-4f88-89e7-77fae19d93b5} {4149d215-92c7-447c-bcb6-0cbfbe517afd} {4277e4fa-9920-40c7-b307-22bcf52d492d}
- Remove Shortcut Virus from USB, Pen Drive, SD Card, Hard Drive
- How Can I View vCard on PC? Expert Suggested Method
- Add Settings Context Menu In Windows 10
- Public cloud vs private cloud: What’s the difference?
- How to play DVDs in Windows 10 for free
Read more:
The Volume Shadow Copy, System Restore, Microsoft Software Shadow Copy Provider, and the Windows Backup services store data in SPP, SystemRestore, and other folders.
- IndexerVolumeGuid is a file used by the Windows Search service. The file contains the GUID of the current volume or partition. The search indexer, instead of just relying upon a drive-letter, uses the volume GUID for indexing. This is because the drive letters can change every now and then, especially for flash drives and external hard disks, but the volume GUIDs won’t.
- Tracking.log in the System Volume Information folder is used by the Distributed Link Tracking Client service (TrkWks) in Windows, which tracks links to files on NTFS-formatted partitions. It tracks links in scenarios where the link is made to a file on an NTFS volume, such as shell shortcuts and OLE links. If that file is renamed, moved to another volume, Windows uses Distributed Link Tracking to find the file.
Remember seeing this “Problem with Shortcut” prompt before?
You must have seen this “missing shortcut” message If Distributed Link Tracking service is turned off and the shortcut target is moved or deleted from your system, Windows fails to track the link.
- WPSettings.dat – (No info available)
- {GUID_n} files may be used by Volume Shadow Copy service
- AppxProgramDataStaging contains a backup of your AppRepositoryPackages folder under ProgramData folder.
- AppxStaging contains a backup of your WindowsApps folder.
Why is System Volume Information not visible in Explorer?
System Volume Information is hidden and protected for obvious reasons. This means it won’t show up in File Explorer unless you configure Folder Options → View tab to show hidden and protected system files.
After you dismiss the dialog by pressing OK, you should see the SVI folder on each drive.
Can I delete the System Volume Information folder?
It is not advisable to delete the SVI folder. The folder, as said before, is not just the System Restore snapshots store folder. Because it contains information and metadata used by Backup, Volume Shadow Copy, and Search indexer, this folder should not be deleted, especially if it’s a system drive or the drive included in the Windows Search index.
On USB flash drives and SD cards, you may delete the folder if you don’t plan to include its locations in the Search index. However, I’d recommend leaving the folder as it is even on external drives, as it takes not much disk space. As the folder is hidden and protected (attributes: System + Hidden), it won’t be much of an annoyance.
However, if you need to delete the folder for some reason (e.g., malware infestation) and let Windows create a new folder, run these commands from the admin Command Prompt:
(Assuming C: drive)
cd /d c: takeown /f "System Volume Information" /r /d y rd /s /q "System Volume Information"
Alternately, you can run Command Prompt under System privileges and delete the SVI folder by running the 3rd command only.
Why is System Volume Information too large?
System Volume Information can consume gigabytes of disk space if System Restore is enabled on the drive. In Windows 8 and earlier, Windows used to create a restore point daily. If the disk space allocation is incorrect or generously set by the user, then the SVI folder can occupy huge disk space–even hundreds of gigabytes.
In the following screenshot from a Windows 7 computer, you can see that the System Volume Information folder occupying 300GB of disk space on a 500GB hard disk drive.
(You can easily track disk space usage using WinDirStat or TreeSize.)
Here’s a case where the SVI folder in Windows Server 2008/2012 occupying more than 300GB. This is most likely caused by scheduled system state backups using Windows Server Backup Features from Server Manager.
You can reduce the disk space allocation using the vssadmin.exe command-line:
From an admin Command Prompt, run “vssadmin list shadowstorage“. This will list the amount of storage used.
Shadow Copy Storage association For volume: (C:)\?Volume{098cc206-0000-0000-0000-500600000000} Shadow Copy Storage volume: (C:)\?Volume{098cc206-0000-0000-0000-500600000000} Used Shadow Copy Storage space: 18.577 GB (92%) Allocated Shadow Copy Storage space: 18.89 GB (94%) Maximum Shadow Copy Storage space: UNBOUNDED (100%)
Running the command below will set a limit to the space used — e.g., 5GB.
vssadmin resize shadowstorage /For=C: /On=E: /MaxSize=5GB
You should see the message Successfully resized the shadow copy storage association.
Additionally, the old system state backups created using Windows Server Backup can be deleted using the following command in Windows Server:
wbadmin delete systemstatebackup -keepversions:0
Windows 10
The above wbadmin command-line is valid for Windows Server editions only. When you run the command on Windows 10, you’ll see the following error:
Warning: The DELETE SYSTEMSTATEBACKUP command is not supported in this version of Windows. The operation ended before completion.
On Windows 10, you can use the System Properties GUI to increase or decrease the disk space allocation for System Restore or the Volume Shadow Copy feature. And, the old restore points and shadow copies can be deleted using Disk Cleanup. Using Disk Cleanup, you can clear all but the latest Restore Point and Shadow Copy.
- Windows 7 is EOL: What next?
- How To Set BIOS or UEFI Password In Windows 10
- [Fixed] Not Enough Storage Is Available To Process This Command
- How to fix microphone not working on Microsoft Teams
- Working with Gridlines in Excel: How to Add, Remove, Change, and Print Gridlines
Read also:
- Start Disk Cleanup as administrator and select the system partition. Click on More Options. Click Clean up…
This option removes all but the most recent restore point. It also erases shadow copies and older Backup images as part of restore points. As a result, the System Volume Information folder’s disk space usage will be remarkably reduced.
Unlike earlier versions of Windows, Windows 10 doesn’t automatically create restore points every 24 hours. It creates it only when needed so that there won’t be unnecessary restore points. But if you need, you can create one daily using a custom script with Task Scheduler.
If you’re using low capacity hard disk, you can either lower the disk space allocation for System Restore or clear all restore points to save disk space.
- Launch
sysdm.cplfrom the Run dialog - Click “System Protection”
- Select the drive for which you want to reduce the disk space allotment. Click Configure.
This tab shows the current disk usage by System Restore in the SVI folder. - Under Disk Space Usage, drag the Max Usage slider towards the left.
If you reduce the slider to the left, the disk space allocation to the System Restore feature is lowered, keeping the SVI folder size low. The oldest restore points are purged automatically (FIFO) so that the System Restore doesn’t use more space than what you allocated.
- Click OK, OK.
Prevent System Volume Information Creation on USB drives
The System Volume Information folder appears on the root of every disk partition in your system. The folder is created on external hard drives, SD cards, and USB flash drives as well.
Let’s now see how to prevent the creation of the SVI folder on your USB flash drive, external drive, or SD card formatted with NTFS.
On USB flash drives or SD cards, the Windows Search Indexer SearchIndexer.exe creates the System Volume Information (SVI) folder and two files: IndexerVolumeGuid and WPSettings.dat in that folder. The IndexerVolumeGUID file stores the unique identifier (GUID) of the current partition or volume.
Step 1: Delete the System Volume Information folder on USB
On NTFS volumes, the SVI folder by default can be accessed only by the SYSTEM account, which has the Full Control permissions. You can remove the System Volume Information folder using the following commands from an admin Command Prompt.
Replace H: in the following example with the actual drive letter of your USB/SD card media. Make sure you don’t inadvertently remove the SVI folder in your system partition or elsewhere.
cd /d h: takeown /f "System Volume Information" /r /d y rd /s /q "System Volume Information"
This removes the folder along with the sub-folders (if any) and files.
Step 2: Prevent the creation of System Volume Information on a USB drive
The SVI folder is created by the Windows Search indexer program, which runs under the SYSTEM account. This is the process that creates the SVI folder along with the two files in it.
By denying Write access for the SYSTEM account to the root directory of a USB drive, you can stop the SVI folder from being created. This, of course, works only if your USB drive uses the NTFS file system.
Important: Don’t perform the following steps on a USB drive or SD media if you’re using it as a storage volume for File History, Windows Backup, System Image Backup, etc. If you deny ‘write’ access to the SYSTEM account on the drive, none of those tools will be able to work correctly.
From an admin Command Prompt, run the following command:
icacls h: /deny system:W
The above command denies “Write” access to the SYSTEM account on the root of H: (USB media drive-letter).
If you want to do this via the Security tab → Advanced Security Settings, configure it as shown in the image below:
How to reverse or undo the Permission entry?
To undo or reverse the above permission setting, run this command:
icacls h: /remove:d system
With the “Deny” permission entry removed, the SYSTEM account will now be able to write to the root of the drive. Search indexer will create the System Volume Information folder on the drive.
I hope this article provided detailed information about the System Volume Information folder in Windows.
Source: https://www.winhelponline.com/blog/what-is-system-volume-information-can-i-delete/