System Reserved partition full [resolved]

[bobm]

In the last 12 months, I've had cause to update Windows 10 to the latest version on two occasions. However, in both cases, it failed as the System Reserved partition was full, thereby preventing access by the OS during the update. Following Microsoft instructions on how to remove unwanted files and folders from this partition resulted in the update completing successfully.

Analysis of why the partition was full identified that a significant amount was used by Everything related files. These had to be manually deleted by IT support as I don't have admin rights to this machine.

Is it possible to prevent Everything writing to this area, or if not, at least ensuring it leaves working space, say 50 MB, available for other applications to use?

Notes:
The attachment shows the state of reserved partition when it had been cleansed and the Win10 update installed.
The version of Everything currently in use is 1.4.1.928
Everything's index is cataloguing around 9.5 millions files.

[void]

Thank you for your post bobm,

Everything doesn't write to the System Reserved partition.

Everything should not access the System Reserved partition at all.

Analysis of why the partition was full identified that a significant amount was used by Everything related files.

Could you please send some more information?
What files were found?


Everything stores data in %LOCALAPPDATA%\Everything
Everything stores settings in %APPDATA%\Everything

edit:
If Store settings and data in %APPDATA%\Everything is disabled, Everything will store settings and data in the same location as your Everything.exe

Was it perhaps a large USN Journal?
The USN Journal is maintained by the NTFS driver (not Everything)

[bobm]

The admin who deleted the files can't remember the specific content, except for the presence of a folder named Everything.

Not sure if that relates to the USN journal, or if anything can be done if the journal is the culprit.

The symptom is that the partition starts relatively empty but then fills over a matter of several months.
The PC is powered up more or less 24/7 with manual daily writes to disk using .\Everything.exe -update

[horst.epp]

Sorry but this Reserved partition doesn't even have a drive letter.
Everything will never ever write into that partition.
So you have Windows itself or some system management tools running which write into it.

[raccoon]

Without seeing a sampling of the files themselves, I can only speculate as to what's happening, so just accept that I'm spitballing here.

A third-party antivirus software is storing data on Everything's activities because Everything naturally behaves suspiciously (that's its job) scanning all of your files including system files. Verbose logging all of Everything's volume access queries could easily fill a 300 MB file over a short period of time.

Note: Although the System Reserved Partition is reserved for boot and BitLocker files, a few third-party applications can write to it. These tend to be antivirus and security programs. Sometimes, they can populate the SRP with too much data, making it full and possibly leading to errors such as “We couldn’t update system reserved partition” with the error code 0xc1900104 or error code 0x800f0922 when attempting a Windows update.

citation: https://www.auslogics.com/en/articles/s ... n-windows/

See if your IT guy can identify the third-party antivirus he installed on your system and whitelist Everything as friendly.

See if running Everything as Administrator is another avenue to stop this excessive scrutiny. But this may not be wise as any program you open from Everything will also inherit Administrator privileges. Tools > Options > General > [x] Run as administrator

Another thing I would try is install Everything to a separate folder outside of \Program Files\, such as C:\Everything\, and turn off [ ] Store settings and data in %APPDATA%\Everything so that neither system-recognized folder is attempting to shadow-copy or log Everything's temporary files or database. This may also afford it lower scrutiny with antivirus software since most modern malware does its thing inside the User data folder. This requires an Administrator to migrate the files, but Everything won't need to be run As Administrator once migrated.

[bobm]

Thanks raccoon, that's most likely the explanation, though I'll get him to check the contents the next time the issue arises.

FWIW Everything is stored in d:\local\everything and the checkbox for Store settings and data in %APPDATA%\Everything is not enabled.

[void]

If Store settings and data in %APPDATA%\Everything is disabled, Everything will store settings and data in the same location as your Everything.exe