Research methods and tools for cleaning the system partition of Windows operating systems Andrii P. Stupin, Vitalii V. Bulatetskyi, Lesia V. Bulatetska, Tetiana O. Hryshanovych and Yuliia S. Pavlenko Lesya Ukrainka Volyn National University, 13 Volya Ave., Lutsk, 43025, Ukraine Abstract Causes and solutions of the problem of free space lack on the system partition during exploitation of Windows (Vista/7/8/8.1/10) operating system are analyzed in this research. Main objects of the file structure, system paths to them, their purpose and role in system partition space usage have been prospected.Some operating system settings that allow to manage relatively large system files and folders and adjust the amount of free space have also been explored. In the course of the research, a set of third-party software was used as an auxiliary tool to compare the cleaning efficiency of individual objects of the system partition and to form own cleaning methods. Commands sets for correct cleaning of such objects are offered. They can be used for writing batch files and scripts, which allows automating the system partition optimizing process in the future. Keywords operating operation system, partition, cleanup, Windows, command-line interpreter, batch file, registry 1. Introduction The latest versions of the Windows OS family require more and more space for file structure storage on hard disk in system volume. New components are added, updates and fixes are installed, users’ data is stored, different backup copies fill the system volume, etc. As a result, system volume where OS itself is stored gets filled with non-critical data, resulting in a free space deficit that affects OS performance and functionality and even can affect updates and fixes installation. The simplest solution for that would be extending system volume, but that is not always possible, especially for solid-state drives or due to lack of free space on other partitions. Besides, system volume size increase produces additional inconveniences while working with this volume: it takes more time for backups to complete, its parameters change and restoration, CS&SE@SW 2021: 4th Workshop for Young Scientists in Computer Science & Software Engineering, December 18, 2021, Kryvyi Rih, Ukraine " Stupin.Andrij2018@vnu.edu.ua (A. P. Stupin); bulatetsky.vitaly@vnu.edu.ua (V. V. Bulatetskyi); bulatetska.lesya@vnu.edu.ua (L. V. Bulatetska); hryshanovych.tatiana@vnu.edu.ua (T. O. Hryshanovych); pavlenko.yulya@vnu.edu.ua (Y. S. Pavlenko) ~ https://vnu.edu.ua/uk/personal/bulateckiy-vitaliy-viktorovich (V. V. Bulatetskyi); https://vnu.edu.ua/uk/personal/bulatecka-lesya-vitaliivna (L. V. Bulatetska); https://vnu.edu.ua/uk/personal/grishanovich-tetyana-oleksandrivna (T. O. Hryshanovych); https://vnu.edu.ua/uk/personal/pavlenko-yuliya-stepanivna (Y. S. Pavlenko)  0000-0002-9883-4550 (V. V. Bulatetskyi); 0000-0002-7202-826X (L. V. Bulatetska); 0000-0002-3595-6964 (T. O. Hryshanovych); 0000-0002-4065-045X (Y. S. Pavlenko) © 2022 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). CEUR Workshop Proceedings http://ceur-ws.org ISSN 1613-0073 CEUR Workshop Proceedings (CEUR-WS.org) 135 because it gets filled with a considerable number of insignificant files and directories taking big size. The optimal solution for that is well-timed cleaning of negligible information. The OS itself should clean such data automatically, but due to misconfiguration and possible periodic failures, this is not always happening [1]. In this research, we will prospect mechanisms and ways to free space on the system volume, which will help us solve this problem. Therefore, the purpose of the work is to determine the system folders, the size of which significantly affects the occupied system partition space, to explore their functions, ways to reduce their size, by identifying and removing redundant information in their content, to identify operating system settings leading to significant use of system partition space, to review the tools for implementing these methods. 2. Updates and fixes OS gets periodic updates and fixes, which adds new features into the system, fixes bugs or security vulnerabilities [2]. Updates center downloads all required files to keep the operating system up to date into %windir%\SoftwareDistribution\Download directory. During package unpacking, documents are placed into SoftwareDistribution directory [3]. This means that after the update procedure finishes, these directories could be emptied. All previous file versions are stored in Windows.$BT or Windows.old directories in the root of system volume for one month, which helps to rollback in case of any issues. If everything works as expected and more free disk space is required, or the user is confident that rollback will not be required, directory contents could be removed by the “Disk Cleanup” system tool (command name: cleanmgr) [3]. ..\SoftwareDistribution directory contains text file ReportingEvents – events journal. All events replated to update procedure are stored into the journal: downloads, unpacking, installation, integrity checks status, start and end date. In case of any errors, their identifiers are stored [3]. Space reclamation with this method depends on the number and type of updates and can reach a few gigabytes, sometimes even tens of gigabytes. 3. Installer Directory %windir%\Installer (it is hidden) occupies on the system partition relatively large size (several gigabytes). It includes the set of files with extensions .msi and .msp, and directories with extensions .tmp-. There are installers required for removing and updating applications, different program components installers, patches, non stabilized system updates files and other data needed for the system and installed software in this system directory. Service “Windows Installer” uses these files. The data in this file are very important when a software package is updated or removed using “Control Panel” – “Programs and Features”. It is used to fix the installation. Mistakes may occur in the process of such tasks implementation [4, 5] This directory should be cleared in a special way. Operating system Windows includes the list of the current installers and patches, that can be accessed through WMI calls (Windows Management Instruments)[6]. It is possible to review the actual list using the next command in the command shell environment PowerShell: get-wmiobject Win32_Product | Sort-Object -Property Name |Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize. 136 Therefore, it is possible to write a script to automate the cleaning of the Installer directory. All the data in the directory but not is the list named "orphan" files. These data may be removed or deleted without compromising system functionality. The other way of the clearing is using free utilite PatchCleaner [7]. Directories with extensions .tmp- are temporary in the studied directory and can be removed in the usual way. Directory %windir%\Installer\$PatchCache$ is special in this directory. This directory may appear during the system upgrade process and remain after it is completed. The base versions of the directories, changing during the software upgrade stored in it. These changes are made with msp-patches and help not to use installers during the upgrade process. If the installer will not find these files, it will ask to use the disk or to write the path where the application was installed from [8]. When the upgrade is finished the directory $PatchCache$ becames to be no longer. 4. WinSxS Another large system directory is located by %windir%\WinSxS path. WinSxS contains previous versions of system files before updates and more. Thus with every Windows update, information about file changes and backup copies of files are written into that directory, which later can be used for rollback. After some time WinSxS directory can consume large space – several gigabytes, and the size of the directory grows with every Windows update installed. In reality, this directory consumes much less space than it appears. Many files in the Windows directory are hard-linked to files in WinSxS directory. Therefore this directory cannot be cleaned in the usual way without breaking OS integrity [9]. For safe operations on this directory embedded system must be used – DISM (Deployment Image Servicing and Management). This command-line tool can be used to prepare Windows disk images or to prepare Windows PE images. It also provides the following functionality: adding, removal, and listing of packages and drivers; enabling and disabling of Windows components; Windows update to next release; all platforms support (32-bit, 64-bit, and Itanium); usage of old package manager scenarios and other [10, 11, 12, 13]. DISM can provide detailed report for WinSxS storage: Dism.exe /Online /Cleanup-Image /AnalyzeComponentStore Example report provided at figure 1, where: • Windows Explorer Reported Size. . . – storage size without hard-links; • Actual Size of Components Store – storage size with hard-links (excluding hard-links pointing into Windows directory); • Shared with Windows – common files with Windows directory (important and used); • Backups and Disabled Features – backup copies and disabled components (optional, does not affect system usage); • Cache and Temporary Data – not required files. Also, a recommendation is given about cleanup targets – Component Store Cleanup Recom- mended. 137 Figure 1: DISM storage report. Also, DISM can perform Components Store cleanup: Dism.exe /Online /Cleanup-Image /StartComponentCleanup, and remove files required for update packages removal: Dism.exe /online /Cleanup-Image /SPSuperseded, after that, it will be impossible to remove installed packages. There is an additional /ResetBase option for the /StartComponentCleanup parameter, which will delete all previous components versions. DISM also performs storage health checks: Dism.exe /Online /Cleanup-Image /ScanHealth and restore components in case of damage: Dism.exe /Online /Cleanup-Image /RestoreHealth. More detailed information about all DISM features and execution options can be found in [14]. 138 5. System files compression (CompactOs) Official ability to compress system files appeared in the last versions of OS Windows. It is in contrast with the ability to compress an entire system partition in the NTFS file system, which existed in older Windows operating systems [15]. The system command line utility COPMACT was introduced to do this. Files in Windows and Program Files are compressing, as well as store applications, which provides a significant share of space saved. It is clear from the DSIM report about the compo- nent storage (figure 1). In practice, the “compressed” system will work slower because of the development of hardware (such as new generations of processors, chipsets, solid state drives, etc.). This slowdown is small, but saves a few gigabytes of space. The utility described above is even able to give recommendations on the needs and feasibility of compression (figure 2). Figure 2: Information returned by COMPACT utility (a – compression recommendation (Windows 7), b – information that the system is compressed (Windows 10)). In particular, to find out the compression status and get recommendations, use the key: /CompactOS:query; to compress the space: /CompactOS:always, to cancel compression: /CompactOS:never. It is clear that the results will vary between individual specific operating systems. But it is possible to save about 20% of the space occupied by system files, which in absolute terms can be 2–3 gigabytes. 6. Devices drivers %Windir%\System32\DriverStore\ is the path to the storage FileRepository. This storage keeps the devices drivers using by the operating system. This storage can use from a few to a few dozen gigabytes of space. The size of the used space depends on the number of the devices and the frequency of their updates. FileRepository storage includes not only the current versions of running devices drivers, but their previous versions (which are not in use and intended for operating system rollback). This storage also includes devices drivers, which are not currently 139 connected with the system, but can be used sometimes. It is, for example, smartphones, cameras, modems etc. It is impossible just to clear such a directory (DriverStore), because this cleansing will cause the entire system to fail or individual devices to shut down. However, cleaning the FileRepository will not cause the system to crash, but changing the hardware may require reinstalling the drivers for such devices from external sources. Therefore the command line utility PNPUTIL is used for such cleansing. The key /e returns the drivers packages list from FileRepository (Fig.3). After analyzing such a list (by data, version, name), it is possible to remove not needed packages using the key /d. Example: pnputil.exe /d oemXX.inf where oemXX.inf — file, identifying driver package, XX – driver number. Figure 3: The fragment of the list generated by the command pnputil /e. The next step – to recognize the currently using device driver. It is possible to complete this operation using Device Manager or device properties. And drivers not conforming to the current version can be removed [16, 17]. Such manipulations are more convenient to perform using external tools, such as Driver Store Explorer, for example [18]. Many software and hardware vendors store device drivers in a directory %windir%\System32\DriverStore\ and duplicate these drivers in the storages non typical for operating systems. Running the device drivers installer, the driver storage duplicates in the native software package, installed in the operating system. For example, directories with drivers 140 for Xerox or Samsung printers locates not only in the storage %windir%\System32\DriverStore\, but in the directories %windir%\Drivers\Xerox\, %windir%\Drivers\Samsung\ and %system- drive%\Program Files (x86)\Xerox\ and %systemdrive%\Program Files (x86)\Samsung\. Obviously, it was made for the compatibility of the software with operating systems older versions. Therefore, it is worth reviewing certain directories, containing similar directories for later publication, which does not affect the subsequent functions of the devices. 7. Hibernation Hibernation is powering down a computer while retaining its state: current state of OS, programs and, data will be written into system file in system volume root – hiberfil.sys. During the next power-on, the system will read the contents of this file and will boot into its original state with all programs and windows opened, and user can work without spending time on launching applications. This state is similar to suspend mode, but with hibernation mode computer is not consuming any power because all data is written into a hard disk, while in suspend mode, some minimal amount of power is consumed to retain data in RAM. Both modes are equally important when work is temporarily stopped and power consumption should be considerably or completely decreased. Hibernation mode allows somewhat quicker bring the system into operation than its full boot, but slower than with suspend mode. We are interested in hiberfil.sys file, the size of which is proportional to RAM size. By disabling hibernation mode (in favor of full boot or suspend mode), we can save a considerable amount of disk space on the system volume consumed by the hiberfil.sys file. It could be done via the OS system settings panel or command line: powercfg /h off To enable hibernation mode: powercfg /h on. 8. Swap file The primary purpose of swap files (for Windows, it’s pagefile.sys, swapfile.sys in system volume root) is to freed RAM from unused at the moment data by writing it into disk storage. In this way, the insufficient memory problem is solved. Often swap file is presented in the system as an addition to RAM and even considered as continuous memory space. In modern times RAM modules are cheap and most users have required, and even more than required, RAM installed, thus swap file usage is not required, but Windows is always creating it by default. Its size is automatically adjusted and is not zero, even if it’s not used, and can reach few gigabytes. In this case, swap file usage can be disabled via the OS system settings panel or command line: wmic pagefileset delete. 141 9. System Volume Information All disk volumes (and system volume) have automatically created in root hidden directories System Volume Information, which can reach a few dozen gigabytes in size. These directories contain Windows points of recovery (if points of recovery creation is enabled for the current volume), indexing service database, volume’s unique identifier, volume shadow copy data (if files history is enabled in Windows [19]). In other words, the System Volume Information directory contains data required for services operating with this volume and system recovery data. This directory on the NTFS file system has not only “system” and “hidden” attributes, but permissions that limit user access to this directory also. To obtain access to that directory, its security properties should be changed in the “Security” tab for that directory. For the FAT, FAT32, exFAT filesystems, any user has permissions to change this directory. Full access for such directory could be obtained the following command: cacls %systemdrive%\"System Volume Information" /g :f where – current user name. Or directory owner could be changed, which will grant access automatically: takeown /f "%SystemDrive%\System Volume Information" /r. Points of recovery (which use the most space) could be deleted via the “System properties” panel, “System Protection” tab. This panel could be run the following commands: SystemPropertiesProtection or rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl„4 But this might not be enough to delete this directory completely, as there might be files and directories used by running services, and the system will not allow to delete it. Thus before deletion, such services should be stopped, particularly: “System protection”, “Volume Shadow Copy”, “File History”. “File History” service is disabled by default unless user enabled it explicitly (it requires separate storage) [19]. “System Protection” could be disabled via system registry DisableSR parameter change (0 – disabled parameter, 1 – enabled parameter) at the following path [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] (via regedit editor), or by creating text file with .reg extension and following contents: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] "DisableSR"=dword:00000001 and executing this file. Value dword:00000000 – will enable “System protection”, dword:00000001 – will disable. After that, most files could be deleted in the System Volume Information directory. 10. Temporary files There is a list with the paths to the directories with temporary files in the operating system. These directories need to be cleaned periodically. This is the list of such directories: %SystemDrive%\Temp\, 142 %SystemRoot%\Temp\, %SystemRoot%\System32\DriverStore\Temp\, %SystemDrive%\Users\\AppData\Local\Temp\, where is the user account name. 11. Comparison of software products for the system partition cleaning It is possible to use third-party software products for the system partition cleaning. There are a sufficient number of them, both, commercial and free. We most often used the following software products in the research process: Patch Cleaner [7], Driver Store Explorer [18], DISM++ [20], Wise Disk Cleaner [21]. Their main purpose is somewhat different from each other, but they contain tools for cleaning. In terms of functionality, their capabilities overlap, but some functions are better implemented in some, worse in others. The short comparison of software on the possibility of interaction with file objects, which were considered in this paper, represented in the table 1. Table 1 Comparison of system partition cleaning and optimization software (“-” – no such function, “satisfacto- rily” – insignificant cleaning, “good” – significant cleaning,“excellent” - almost complete cleaning) Object Patch Cleaner Driver Store Explorer DISM++ Wise Disk Cleaner Updates and fixes - - good excellent Installer good - satisfactorily satisfactorily WinSxS - - excellent satisfactorily Devices Drivers - excellent good - Temporary Files - - excellent good Wise Disk Cleaner and DISM++ are most versatile tools, but in practice situations it is necessary to clean system partition space using the first software product and then use the second for a more complete cleaning. Patch Cleaner and Driver Store Explorer – highly specialized tools for thoroughly cleaning the Installer directory and driver repository, respectively. 12. Conclusions Non complete list of the operating system paths and directories, clearing which makes possible to save a lot of space on the system partition is represented in this research. But these directories occupy the largest repositories on the system partition.The file structure of the system partition is analyzed. The list of commands that can be used to write batch files, scripts, registry files, is the result of this analysis. It is shown that it is possible to automate the process of cleaning system partitions. During the cleaning system partitions process, users may miss the errors, thereby affecting the operating system and its file structure. In such cases, users should use the system utility SFC. For example, to write in the command line: 143 sfc /scannow, It allows the user to check all protected system files and replace crashed files with their cached copies located in a compressed directory %WinDir%\System32\dllcache [22]. The system partition cleansing is not the only way to free the space. Moving the "heavy" directories to another (non-system) partition using hard links (mklink) [23] or moving the directories with users profiles during the operating system installation and exploitation are the other solutions to this problem [24, 25]. References [1] V. V. Bulatetsky, L. V. Bulatetska, G. S. Prutz, Methods and tools for clearing the space of the system partition of microsoft windows 10, Computer-integrated technologies: education, science, production (2018) 85–59. URL: http://cit-journal.com.ua/index.php/cit/issue/view/ 13. [2] S. Bondarenko, Zachem nuzhny obnovleniya Windows i programm?, 2019. URL: http: //it-uroki.ru/category/uroki/bezopasnost. [3] Kuda skachivayutsya i gde khranyatsya obnovleniya windows 10?, 2021. URL: https: //windows10i.ru/obnovleniya/gde-hranyatsya.html. [4] Mozhno li udalit papku Windows\Installer i fayly iz neyo, 2019. URL: https://remontka. pro/windows-installer-folder-delete/. [5] Kak ochistit’ papku Installer v Windows, 2016. URL: https://windowstips.ru/ kak-ochistit-papku-installer-v-windows. [6] Ochistka mesta na RDS ferme (Installer, ServiceProfiles, WinSxS), 2019. URL: http: //pyatilistnik.org/cleaning-rds-farm-space/. [7] 4 Ways to Safely Delete Unused MSI and MSP Files from Win- dows Installer Folder, 2020. URL: https://www.raymond.cc/blog/ safely-delete-unused-msi-and-mst-files-from-windows-installer-folder/. [8] Downloaded installations chto za papka, 2019. URL: https://kztarif.ru/kompjutery/ downloaded-installations-chto-za-papka. [9] Ochistka papki WinSxS v Windows 10, 8 i Windows 7, 2019. URL: https://remontka.pro/ winsxs-windows/. [10] DISM - Deployment Image Servicing and Management, 2019. URL: https://sites.google. com/site/raminaliyevit/veb-kasty/mswindows7/dism. [11] I. McLean, O. Thomas, MCTS Self-Paced Training Kit (Exam 70-680): Configuring Windows 7, Microsoft Press, Redmond, Washington A Division of Microsoft Corporation One Microsoft Way, 2010. [12] Kak gramotno umenshit razmer papki WinSxS v Windows 10, 8.1 i 8, 2020. URL: https: //www.outsidethebox.ms/15272/. [13] Manage the component store, 2014. URL: https://docs.microsoft.com/en-us/ previous-versions/windows/it-pro/windows-8.1-and-8/dn251569(v=win.10) ?redirectedfrom=MSDN. [14] DISM Image Management Command-Line Options, 2021. URL: https: 144 //docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/ dism-image-management-command-line-options-s14. [15] V. Sterkin, Compact OS: kak szhat sistemnyye fayly Windows 10 i sekonomit neskolko gigabayt, 2021. URL: https://www.outsidethebox.ms/17965/. [16] Kak ochistit papku FileRepository v DriverStore, 2017. URL: https://remontka.pro/ driverstore-filerepository-folder-windows/. [17] Kak udalit’ papku DriverStore v Windows, 2020. URL: https://nastroyvse.ru/opersys/win/ papka-driverstore-v-windows.html. [18] DriverStore Explorer, 2021. URL: http://https//archive.codeplex.com/?p= driverstoreexplorer. [19] Backup and Restore in Windows, 2021. URL: https://support.microsoft.com/en-us/ windows/backup-and-restore-in-windows-352091d2-bb9d-3ea3-ed18-52ef2b88cbef. [20] Dism++, 2019. URL: https://www.chuyu.me/uk/index.html. [21] Securely cleans up useless files and makes your computer run faster, 2021. URL: https: //www.wisecleaner.com/wise-disk-cleaner.html. [22] sfc, 2021. URL: https://docs.microsoft.com/en-us/windows-server/administration/ windows-commands/sfc. [23] Peremeshcheniye papok Windows so svyazannymi ssylkami (mklink), 2021. URL: https: //answer-id.com/ru/71043200. [24] Fishki Windows 10: kak gramotno peremestit polzovatelskiye papki na drugoy disk, 2020. URL: https://www.outsidethebox.ms/17670/. [25] How to move the Users folder to another drive in Windows 10, 2015. URL: http://www. oszone.net/27689/windows_10_relocate_users_folder. 145