Causes and solutions of the problem of free space lack on the system partition during exploitation of Windows (Vista/7/8/8.1/10) operating system are analyzed in this research. Main objects of the file structure, system paths to them, their purpose and role in system partition space usage have been prospected.Some operating system settings that allow to manage relatively large system files and folders and adjust the amount of free space have also been explored. In the course of the research, a set of third-party software was used as an auxiliary tool to compare the cleaning eficiency of individual objects of the system partition and to form own cleaning methods. Commands sets for correct cleaning of such objects are ofered. They can be used for writing batch files and scripts, which allows automating the system partition optimizing process in the future.
The latest versions of the Windows OS family require more and more space for file structure
storage on hard disk in system volume. New components are added, updates and fixes are
installed, users’ data is stored, diferent backup copies fill the system volume, etc. As a result,
system volume where OS itself is stored gets filled with non-critical data, resulting in a free
space deficit that afects OS performance and functionality and even can afect updates and fixes
installation. The simplest solution for that would be extending system volume, but that is not
always possible, especially for solid-state drives or due to lack of free space on other partitions.
Besides, system volume size increase produces additional inconveniences while working with
this volume: it takes more time for backups to complete, its parameters change and restoration,
because it gets filled with a considerable number of insignificant files and directories taking big
size. The optimal solution for that is well-timed cleaning of negligible information. The OS itself
should clean such data automatically, but due to misconfiguration and possible periodic failures,
this is not always happening [
OS gets periodic updates and fixes, which adds new features into the system, fixes bugs or
security vulnerabilities [
..\SoftwareDistribution directory contains text file ReportingEvents – events journal. All events
replated to update procedure are stored into the journal: downloads, unpacking, installation,
integrity checks status, start and end date. In case of any errors, their identifiers are stored [
Space reclamation with this method depends on the number and type of updates and can reach a few gigabytes, sometimes even tens of gigabytes.
Directory %windir%\Installer (it is hidden) occupies on the system partition relatively large size
(several gigabytes). It includes the set of files with extensions .msi and .msp, and directories
with extensions .tmp-. There are installers required for removing and updating applications,
diferent program components installers, patches, non stabilized system updates files and other
data needed for the system and installed software in this system directory. Service “Windows
Installer” uses these files. The data in this file are very important when a software package
is updated or removed using “Control Panel” – “Programs and Features”. It is used to fix the
installation. Mistakes may occur in the process of such tasks implementation [
This directory should be cleared in a special way. Operating system Windows includes the
list of the current installers and patches, that can be accessed through WMI calls (Windows
Management Instruments)[
get-wmiobject Win32_Product | Sort-Object -Property Name |Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize.
Therefore, it is possible to write a script to automate the cleaning of the Installer directory.
All the data in the directory but not is the list named "orphan" files. These data may be removed
or deleted without compromising system functionality. The other way of the clearing is using
free utilite PatchCleaner [
Directories with extensions .tmp- are temporary in the studied directory and can be removed in the usual way.
Directory %windir%\Installer\$PatchCache$ is special in this directory. This directory may
appear during the system upgrade process and remain after it is completed. The base versions
of the directories, changing during the software upgrade stored in it. These changes are made
with msp-patches and help not to use installers during the upgrade process. If the installer will
not find these files, it will ask to use the disk or to write the path where the application was
installed from [
Another large system directory is located by %windir%\WinSxS path. WinSxS contains previous
versions of system files before updates and more. Thus with every Windows update, information
about file changes and backup copies of files are written into that directory, which later can
be used for rollback. After some time WinSxS directory can consume large space – several
gigabytes, and the size of the directory grows with every Windows update installed. In reality,
this directory consumes much less space than it appears. Many files in the Windows directory
are hard-linked to files in WinSxS directory. Therefore this directory cannot be cleaned in the
usual way without breaking OS integrity [
For safe operations on this directory embedded system must be used – DISM (Deployment
Image Servicing and Management). This command-line tool can be used to prepare Windows
disk images or to prepare Windows PE images. It also provides the following functionality:
adding, removal, and listing of packages and drivers; enabling and disabling of Windows
components; Windows update to next release; all platforms support (32-bit, 64-bit, and Itanium);
usage of old package manager scenarios and other [
DISM can provide detailed report for WinSxS storage: Dism.exe /Online /Cleanup-Image /AnalyzeComponentStore Example report provided at figure 1, where: • Windows Explorer Reported Size. . . – storage size without hard-links; • Actual Size of Components Store – storage size with hard-links (excluding hard-links pointing into Windows directory); • Shared with Windows – common files with Windows directory (important and used); • Backups and Disabled Features – backup copies and disabled components (optional, does not afect system usage); • Cache and Temporary Data – not required files.
Also, a recommendation is given about cleanup targets – Component Store Cleanup Recommended.
Also, DISM can perform Components Store cleanup: Dism.exe /Online /Cleanup-Image /StartComponentCleanup, and remove files required for update packages removal: Dism.exe /online /Cleanup-Image /SPSuperseded, after that, it will be impossible to remove installed packages.
There is an additional /ResetBase option for the /StartComponentCleanup parameter, which will delete all previous components versions.
DISM also performs storage health checks: Dism.exe /Online /Cleanup-Image /ScanHealth and restore components in case of damage: Dism.exe /Online /Cleanup-Image /RestoreHealth.
More detailed information about all DISM features and execution options can be found in
[
Oficial ability to compress system files appeared in the last versions of OS Windows. It is in contrast with the ability to compress an entire system partition in the NTFS file system, which existed in older Windows operating systems [15]. The system command line utility COPMACT was introduced to do this.
Files in Windows and Program Files are compressing, as well as store applications, which provides a significant share of space saved. It is clear from the DSIM report about the component storage (figure 1). In practice, the “compressed” system will work slower because of the development of hardware (such as new generations of processors, chipsets, solid state drives, etc.). This slowdown is small, but saves a few gigabytes of space. The utility described above is even able to give recommendations on the needs and feasibility of compression (figure 2). 6. Devices drivers %Windir%\System32\DriverStore\ is the path to the storage FileRepository. This storage keeps the devices drivers using by the operating system. This storage can use from a few to a few dozen gigabytes of space. The size of the used space depends on the number of the devices and the frequency of their updates. FileRepository storage includes not only the current versions of running devices drivers, but their previous versions (which are not in use and intended for operating system rollback). This storage also includes devices drivers, which are not currently connected with the system, but can be used sometimes. It is, for example, smartphones, cameras, modems etc.
It is impossible just to clear such a directory (DriverStore), because this cleansing will cause the entire system to fail or individual devices to shut down. However, cleaning the FileRepository will not cause the system to crash, but changing the hardware may require reinstalling the drivers for such devices from external sources.
Therefore the command line utility PNPUTIL is used for such cleansing. The key /e returns the drivers packages list from FileRepository (Fig.3). After analyzing such a list (by data, version, name), it is possible to remove not needed packages using the key /d.
Example: pnputil.exe /d oemXX.inf where oemXX.inf — file, identifying driver package, XX – driver number.
The next step – to recognize the currently using device driver. It is possible to complete this operation using Device Manager or device properties. And drivers not conforming to the current version can be removed [16, 17].
Such manipulations are more convenient to perform using external tools, such as Driver Store Explorer, for example [18].
Many software and hardware vendors store device drivers in a directory %windir%\System32\DriverStore\ and duplicate these drivers in the storages non typical for operating systems. Running the device drivers installer, the driver storage duplicates in the native software package, installed in the operating system. For example, directories with drivers for Xerox or Samsung printers locates not only in the storage %windir%\System32\DriverStore\, but in the directories %windir%\Drivers\Xerox\, %windir%\Drivers\Samsung\ and %systemdrive%\Program Files (x86)\Xerox\ and %systemdrive%\Program Files (x86)\Samsung\. Obviously, it was made for the compatibility of the software with operating systems older versions. Therefore, it is worth reviewing certain directories, containing similar directories for later publication, which does not afect the subsequent functions of the devices.
Hibernation is powering down a computer while retaining its state: current state of OS, programs and, data will be written into system file in system volume root – hiberfil.sys . During the next power-on, the system will read the contents of this file and will boot into its original state with all programs and windows opened, and user can work without spending time on launching applications. This state is similar to suspend mode, but with hibernation mode computer is not consuming any power because all data is written into a hard disk, while in suspend mode, some minimal amount of power is consumed to retain data in RAM. Both modes are equally important when work is temporarily stopped and power consumption should be considerably or completely decreased. Hibernation mode allows somewhat quicker bring the system into operation than its full boot, but slower than with suspend mode. We are interested in hiberfil.sys ifle, the size of which is proportional to RAM size. By disabling hibernation mode (in favor of full boot or suspend mode), we can save a considerable amount of disk space on the system volume consumed by the hiberfil.sys file.
It could be done via the OS system settings panel or command line: powercfg /h of To enable hibernation mode: powercfg /h on.
The primary purpose of swap files (for Windows, it’s pagefile.sys , swapfile.sys in system volume root) is to freed RAM from unused at the moment data by writing it into disk storage. In this way, the insuficient memory problem is solved. Often swap file is presented in the system as an addition to RAM and even considered as continuous memory space. In modern times RAM modules are cheap and most users have required, and even more than required, RAM installed, thus swap file usage is not required, but Windows is always creating it by default. Its size is automatically adjusted and is not zero, even if it’s not used, and can reach few gigabytes.
In this case, swap file usage can be disabled via the OS system settings panel or command line: wmic pagefileset delete .
All disk volumes (and system volume) have automatically created in root hidden directories System Volume Information, which can reach a few dozen gigabytes in size.
These directories contain Windows points of recovery (if points of recovery creation is enabled for the current volume), indexing service database, volume’s unique identifier, volume shadow copy data (if files history is enabled in Windows [ 19]). In other words, the System Volume Information directory contains data required for services operating with this volume and system recovery data.
This directory on the NTFS file system has not only “system” and “hidden” attributes, but permissions that limit user access to this directory also. To obtain access to that directory, its security properties should be changed in the “Security” tab for that directory. For the FAT, FAT32, exFAT filesystems, any user has permissions to change this directory.
Full access for such directory could be obtained the following command: cacls %systemdrive%\"System Volume Information" /g <username>:f where <username> – current user name. Or directory owner could be changed, which will grant access automatically: takeown /f "%SystemDrive%\System Volume Information" /r.
Points of recovery (which use the most space) could be deleted via the “System properties” panel, “System Protection” tab. This panel could be run the following commands: SystemPropertiesProtection or rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl„4
But this might not be enough to delete this directory completely, as there might be files and
directories used by running services, and the system will not allow to delete it. Thus before
deletion, such services should be stopped, particularly: “System protection”, “Volume Shadow
Copy”, “File History”. “File History” service is disabled by default unless user enabled it explicitly
(it requires separate storage) [19]. “System Protection” could be disabled via system registry
DisableSR parameter change (0 – disabled parameter, 1 – enabled parameter) at the following
path [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] (via
regedit editor), or by creating text file with .reg extension and following contents:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR"=dword:00000001
and executing this file. Value dword:00000000 – will enable “System protection”,
dword:00000001 – will disable. After that, most files could be deleted in the System Volume
Information directory.
10. Temporary files
There is a list with the paths to the directories with temporary files in the operating system.
These directories need to be cleaned periodically. This is the list of such directories:
%SystemDrive%\Temp\,
%SystemRoot%\Temp\,
%SystemRoot%\System32\DriverStore\Temp\,
%SystemDrive%\Users\<user>\AppData\Local\Temp\,
where <user> is the user account name.
11. Comparison of software products for the system partition
cleaning
It is possible to use third-party software products for the system partition cleaning. There are
a suficient number of them, both, commercial and free. We most often used the following
software products in the research process: Patch Cleaner [
Wise Disk Cleaner and DISM++ are most versatile tools, but in practice situations it is necessary to clean system partition space using the first software product and then use the second for a more complete cleaning. Patch Cleaner and Driver Store Explorer – highly specialized tools for thoroughly cleaning the Installer directory and driver repository, respectively. 12. Conclusions Non complete list of the operating system paths and directories, clearing which makes possible to save a lot of space on the system partition is represented in this research. But these directories occupy the largest repositories on the system partition.The file structure of the system partition is analyzed. The list of commands that can be used to write batch files, scripts, registry files, is the result of this analysis. It is shown that it is possible to automate the process of cleaning system partitions.
During the cleaning system partitions process, users may miss the errors, thereby afecting the operating system and its file structure. In such cases, users should use the system utility SFC. For example, to write in the command line: sfc /scannow,
It allows the user to check all protected system files and replace crashed files with their cached copies located in a compressed directory %WinDir%\System32\dllcache [22]. The system partition cleansing is not the only way to free the space. Moving the "heavy" directories to another (non-system) partition using hard links (mklink) [23] or moving the directories with users profiles during the operating system installation and exploitation are the other solutions to this problem [24, 25]. //docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/ dism-image-management-command-line-options-s14. [15] V. Sterkin, Compact OS: kak szhat sistemnyye fayly Windows 10 i sekonomit neskolko gigabayt, 2021. URL: https://www.outsidethebox.ms/17965/. [16] Kak ochistit papku FileRepository v DriverStore, 2017. URL: https://remontka.pro/ driverstore-filerepository-folder-windows/. [17] Kak udalit’ papku DriverStore v Windows, 2020. URL: https://nastroyvse.ru/opersys/win/ papka-driverstore-v-windows.html. [18] DriverStore Explorer, 2021. URL: http://https//archive.codeplex.com/?p= driverstoreexplorer. [19] Backup and Restore in Windows, 2021. URL: https://support.microsoft.com/en-us/ windows/backup-and-restore-in-windows-352091d2-bb9d-3ea3-ed18-52ef2b88cbef. [20] Dism++, 2019. URL: https://www.chuyu.me/uk/index.html. [21] Securely cleans up useless files and makes your computer run faster, 2021. URL: https: //www.wisecleaner.com/wise-disk-cleaner.html. [22] sfc, 2021. URL: https://docs.microsoft.com/en-us/windows-server/administration/ windows-commands/sfc. [23] Peremeshcheniye papok Windows so svyazannymi ssylkami (mklink), 2021. URL: https: //answer-id.com/ru/71043200. [24] Fishki Windows 10: kak gramotno peremestit polzovatelskiye papki na drugoy disk, 2020.
URL: https://www.outsidethebox.ms/17670/. [25] How to move the Users folder to another drive in Windows 10, 2015. URL: http://www. oszone.net/27689/windows_10_relocate_users_folder.