Which files were moved to the “SIS Common Storage” folder by the groveler service?

Der vorherige Eintrag in diesem Blog ist die Deutsche Fassung dieses Artikels.

We have:

  • A Win2000-Server that used to be a RIS-testserver a while ago.
  • A Directory on D:\ named “SIS Common Storage”

RIS has beed uninstalled long ago, the folder remained – about 3GB in size with 5800something files, most of them named like

48dea770-1cda-11db-8780-000a5e029b89.sis.

Metapad shows that PDF-docs, bitmap images, .EXE-files and others among them. Google lets you find quickly that the “Groveler” service moves duplicate files on volumes with RIS-images once into this folder and replaces the original files with NTFS-Links containing “reparse points”.

The “groveler” service was removed together with RIS once ago, it has not moved files to the SIS-folder since them. The default Windows tools do not let you see if there are just orphans lying around in “SIS Common Store” (i.e. files that were not deleted together with their links in the filesystem), or what is there inside this folder at all.

The FSutil.exe from Windows 2003 server is ist generally designed to show this “reparse point” info contained in files, but only for one file or folder at a time:

Additionally it has a bug not showing correct GUID info of SIS reparse points. Well done, idiots.

After a lot of “googeling around” one may find the improved tool FSutil2.exe, (not at Microsoft!) which has amongst others fixed this bug:

Thanks!

An example in the provided readme for FSutil2.exe reads:

Interesting for us: The line “CSid: 4B0C4C00-FEA2-11D3-8D9C-00C04F4700A8″ – The file poked by fsutil.exe reparsepoint query has actually a reparse point with tag SIS in its metadata and – guess what – is placed in the folder “SIS Common Store” with the filename 4B0C4C00-FEA2-11D3-8D9C-00C04F4700A8.sis!

We scan the drive D:\ for files with SIS reparse points.

Writing a few batch files that accomlpish this shouldn’t be a problem. I guessed most of the files in “SIS Common Store” were dead files from “RIS-times”, so I don’t need automated file renaming and stuff..

The first batch lists the content of drive D:\ into a text file:

The next one reads the previously created file (FSutil.exe itself does not support recursion) and tests every file for reparse points:

files_reparsepoint.txt can be searched with grep grep from the Unix tools for SIS reparse points.

You then have a list of relations of files on the drive and the “{GUID}.sis” files. Excerpt:

Of the about 5800 files a total of 6 was still still present in the system, that means on D:\ there were 6 files with SIS reparse points linking to files inside the “D:\SIS Common Store” – I copied these and deleted the rest after making a backup.

Der Eintrag "Which files were moved to the “SIS Common Storage” folder by the groveler service?" ist vor mehr als einem Jahr geschrieben oder zuletzt editiert worden und unter Umständen veraltet oder nicht mehr korrekt.

Ähnliches

Seiten und Einträge, gefunden nach Tags.

4 Kommentare

  1. Kommentar von Devlar

    Was bedeutet CSid in zeile:
    CSid: 4B0C4C00-FEA2-11D3-8D9C-00C04F4700A8

    ?

  2. Kommentar von Stefan

    Die ID der Datei, die gleich bleibt, auch wenn die Datei umbenannt wird.

  3. Kommentar von Devlar

    Danke Stefan fuer dein erstes Antwort. Mein problem ist es, dass ich mit SIS backup API soll identifizieren dies GUID (so genannt Common Store File – GUID.sis). Ich weiss schon das ID bleibt, aber wie kann ich diesen ID von den Datei bekommen?

  4. Kommentar von Devlar

    got it already :)

Hinterlasse einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind markiert *


× 6 = dreißig sechs

Du kannst folgende HTML-Tags benutzen: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">

© 2001-2015 onderka.com / Stefan Onderka | Über, impressum und Lizenz | RSS Einträge | RSS Kommentare | 51q @ 0,307s | 353.877 Spammer