Access denied trying to delete file…but is it really there at all?

Topic

New Reply

Well it happens to all of us sometimes…..I’m stumped, help!

My wife downloaded a 590 MB BBC iPlayer wmv file for later viewing on my workstation. After viewing, we now want to remove it from the machine.

Simple, you would think…..err no. Every attempt to access the file results in Access Denied. Viewing the owner of the file results in “unable to display current owner”

Things I have tried:

[*]Turn of Simple File Sharing and grab ownership – same result: access denied
[*]Reset file attributes using command prompt (run as admin) – same result: access denied
[*]Delete from command prompt (run as admin) – same result: access denied
[*]Various “forced file removers” – yup, you got it….access denied

So, not to be beaten, I resorted to booting the machine off a Linux Live CD, browse to the file in the on the Windows disk, and…..the file was not there!

Rubs eyes in disbelief, tries again and gets same result.

Boot machine back into Windows, browse to file and it is listed. Fire up Ubuntu from within VirtualBox, browse to file and it is not listed. This really got me confused – Windows shows the file present, but Linux, running in real time does not: see attached.

28852-now-you-see-it-now-you-dont

So the question: am I seeing some strange effect of the Windows file system, indexing a file that is not there, or could Linux be fooled into mis-reading the NTFS volume?

Any ideas on whether the file is present and if so how to remove it?

Reply | Quote

Replies

Does thisitemhelp any? I’m from the colonies so I’m not familiar with the Iplayer. Visited Scotland twice and absolutely love the country.

Jerry

Reply | Quote

Hi Jerry,

yes looked at that. Unfortunately, there is no file in the Videos folder that refers to this download. She downloaded it from the online page rather than using the Desktop app (which is not installed in this machine). Windows shows it in the Downloads folder, but Linux does not find it.

And just to confirm I haven’t gone completely nuts, I checked again. Here’s the screen shot of the Downloads directory with the machine running on the Linux Live CD. It’s sorted by file size. A 590MB file is by far the largest file in that folder and should be top of the list after the sub-folders:

28853-Linux-Downloads-folder

I’m tempted to go with the Linux response: it’s not there. But why then is Windows showing it present; and if it’s not there, how do I get rid of it (queue title music from the X-Files!).

:confused:

Reply | Quote

Have you tried running a chkdsk /f on the drive where the problem file is?

Reply | Quote

Thanks Browni,

I haven’t yet run a check disk on the drive. It’s a large drive, so could take a long time and there have been no other indications of drive issues – it’s only a year old an other monitoring tools suggest it’s clean.

Having said that, if there is an index problem, perhaps a chkdsk will find it…..not sure why a Linux VM or a boot from live CD wouldn’t pick up the same issue if it’s there. Anyway, I think I’ll start the chkdsk running overnight so there is no downtime impact.

Reply | Quote

….well that took a lot less time than expected: and Success!

Thanks Browni.

Attached the chkdsk log file:

Code:

Level	Date and Time	Source	Event ID	Task Category
Information	04/09/2011 23:47:34	Microsoft-Windows-Wininit	1001	None	”

Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows7.


A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 3)…
  378368 file records processed.                                         

File verification completed.
  778 large file records processed.                                   

  0 bad file records processed.                                     

  0 EA records processed.                                           

  93 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 3)…
  465444 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 3)…
  378368 file SDs/SIDs processed.                                        

Cleaning up 553 unused index entries from index $SII of file 0x9.
Cleaning up 553 unused index entries from index $SDH of file 0x9.
Cleaning up 553 unused security descriptors.
Security descriptor verification completed.
  43539 data files processed.                                           

CHKDSK is verifying Usn Journal…
  33798200 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

 727451647 KB total disk space.
 159078088 KB in 273174 files.
    173648 KB in 43540 indexes.
         0 KB in bad sectors.
    501359 KB in use by the system.
     65536 KB occupied by the log file.
 567698552 KB available on disk.

      4096 bytes in each allocation unit.
 181862911 total allocation units on disk.
 141924638 allocation units available on disk.

Internal Info:
00 c6 05 00 33 d5 04 00 2c 69 08 00 00 00 00 00  ….3…,i……
52 88 00 00 5d 00 00 00 00 00 00 00 00 00 00 00  R…]………..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  …………….

Windows has finished checking your disk.
Please wait while your computer restarts.

As can be seen halfway down the log, chkdsk did find a problem with the index an fixed it. Browsing for the offending file in Windows no longer shows it is present. Perhaps the file had been removed but the index not updated correctly. Still not sure why Linux did not list the file since it appeared in the index.

Anyway, I’ve learnt something tonight – not to always trust the independent OS to give a true picture about what is happening in the Index and/or on the disk.

Reply | Quote

Glad it worked for you. TBH, it was the only thing I could think of trying other than what you had already tried.

As to why it happened and Linux couldn’t see the index entry, I haven’t got the foggiest idea!

Reply | Quote

The other option a person might try is to use System Restore or restore from an Image to a point before the download was done.

Reply | Quote

Indeed Ted, an image restore would have worked as well. Although I’m not convinced that a system restore would work as the file in question was a user file (Windows media video) which system restore (in theory) shouldn’t touch.

Reply | Quote

I’ve been thinking about this overnight. Perhaps Linux may not have shown the file due to differences in the way that OS processes the Index and/or Master File Table. Maybe Windows was blindly reflecting what was (incorrectly) in the index, whereas Linux was perhaps a bit smarter?

Unfortunately, System restore would not have worked because as Browni noted it was a user file rather than a system file.

In theory a Restore from Image would have removed it, but as you can see in the first screen shot it was downloaded around 3 weeks ago. There had been many changes to user files since then and an image restore would have lost all those changes. After an Image Restore, I could have then loaded more recent backups and restored any individual missing files, but that would have been quite a bit of work and I couldn’t guarantee to find everything.

Another thing I looked at was the Previous Versions feature in Windows 7 – to see if I could restore an earlier indexed version of the file (to then delete it again)…..there were no previous versions to restore! I also attempted to recover the single file from my dynamic backups – I could mount the backups but any attempt to manipulate the file or recover it resulted in the same Access Denied. Other files were not affected.

I’m curious that the index entry could have become corrupt with no other apparent impact on any system function, but I guess the Access Denied message was Windows way of say “you can’t do that because it’s not there!” Would have been better if Windows had been smart and reported “The file is no longer present, do you want to fix the index?”

Reply | Quote

Tinto, This is the biggest reason why ALL my data is on a seperate drive from my OS and apps. This way I can restore my OS and apps without touching the data. Just a few days ago I restored to an Image approx. 3 weeks old, and afterward all the changes to data during those 3 weeks was accessed with all changes still present. That is the wonder of partitioning in my mind.

To be honest I also did not think a System Restore would work either. I mentioned it because in, some senarios that others reading this post might encounter, it would work. In fact in my setup (I recreate Images of my OS and apps regularly so the Image restoration is always up to date) I have System Restore turned off.

Reply | Quote

Tinto, This is the biggest reason why ALL my data is on a seperate drive from my OS and apps. This way I can restore my OS and apps without touching the data. Just a few days ago I restored to an Image approx. 3 weeks old, and afterward all the changes to data during those 3 weeks was accessed with all changes still present. That is the wonder of partitioning in my mind.

Ted,

perhaps I’m misunderstanding you, but the file was a .wmv media file downloaded into the UsersRichardDownloads folder, not to a System folder.

If partitioning had been in use on the machine, the User Data partition rather than System Partition would have needed to be reverted to remove the offending file, thereby loosing all changes to User data since the download.

Reply | Quote

I missed the statement where you mentioned the downloaded file was listed as in the downloads folder. Yes in your case, restoration would have reverted all data back to what it was at the time the Image was created. As a general rule however, keeping the data separate from the OS does allow restoration of the OS or apps without touching the data.

I guess from my perspective I did not consider the Downloads folder as the folder of choice for downloading this type of file. In my case I use this folder to store downloaded apps. I do see your point about this particular downloaded file on your system. In my case I have a separate folder I call My Downloads which still resides on my C Drive that I use to download things like this that might be temporary. (This does still allow me to utilize the restore Image route in my case) That way if I want to save something more permanently I move it to the appropriate folder on the D Drive.

Reply | Quote