What Are $Extend\$Deleted File System Entries and How to Remove Them

disk-volumentfswindows-server-2008-r2

I'd like to shrink an NTFS data partition on one of my servers. Unfortunately, it has an "unmovable file" located at an inconvenient position.

Here is the relevant event log entry:

A volume shrink analysis was initiated on volume Daten (C:\Daten). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.

Diagnostic details:
– The last unmovable file appears to be:
\$Extend\$Deleted:$I30:$INDEX_ALLOCATION
– The last cluster of the file is: 0x1138f943
– Shrink potential target (LCN address): 0x18a51d6
– The NTFS file flags are: —-I
– Shrink phase: <analysis>

To find more details about this file please use the "fsutil volume querycluster \\?\Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943" command.

The command mentioned at the bottom of the event log entry does not yield any useful additional information:

C:\> fsutil volume querycluster \\?\Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943
Cluster 0x000000001138f943 used by ----I \$Extend\$Deleted:$I30:$INDEX_ALLOCATION

(Note (note sure if it's relevant): The last thing I did on the drive was to delete all shadow copies.)

I am aware that $Extend is not a "regular" folder but some kind of NTFS system file. Thus, my question:

What is this $Extend\$Deleted file system entry and how do I get rid of it? (Or, at least, get rid of its "unmovability" so that I can shrink my volume…)

Best Answer

I ran into the $Extend\$Deleted folder as well and have been combing the web for information. I'm not entirely satisfied with this answer, but here is what I found: