Wednesday, August 3, 2011

The Undeletable File and a Bunch of Dots



Error Deleting File or Folder
Cannot delete file: Cannot read from the source file or disk.

This error message does not seem too scary. It looks similar to other error messages that Windows produces. Maybe it could be more descriptive but when I first saw this I had no idea what it would take to delete this file...

The other day I was doing my annual domain account and user directory clean up tasks when I came across a problem. There was one user directory that I could not delete. I have encountered problems like this before so I started by modifying the ownership and permissions. I made my account the owner with full control of the file. Say good bye file, you are toast. Oh no! It didn't work. And I'm still getting the same message.

The next step for me is FileAssassin. If you don't know what FileAssassin is, it is a great little utility from the Malwarebytes people. It will delete a file if it is locked or otherwise unable to be removed. I have used it several times with great results. Hasta la vista, baby. What!?! It's still there? No luck with FileAssassin, this thing is stubborn.
  • Maybe I can just rename the file. Nope.
  • I will try opening fsmgmt.msc and see if the file is locked. Still no.
  • Alright, uncle! I give!

At this point, I thought I better start looking at this more closely. Right away I noticed something strange. The file is named .jpg. (dot-jpg-dot). It starts and ends with a period character.

I thought this was odd but I didn't understand how this would prevent me from removing the file.

After doing some research I discovered that the Win32 API does not allow a file name to end with a dot. NTFS will allow a file to end with a dot but the Win32 API blocks access to this. You can verify this by trying to save a file with the name ending in a dot. Windows will just drop the dot. If you try to save a file named "myfile.", you end up with a file named "myfile" sans ending dot. So how did I end up with this file on my server? Perhaps this file was put there by a Mac or a Linux machine which would not have to honor the Win32 API. I really don't know the answer but that is my best guess.

That is all well and good but what I really want to know is how to get rid of this file. I eventually ended up on this MSDN page. You can read it all if you want, but the short of the story is you can bypass the Win32 API by prefixing the path with "\\?\" which I will demonstrate below.

To delete a file that contains a dot or other illegal character in the name, open a command prompt type the following:

del \\?\C:\demo\.jpg. 



BLAMO!!! The file is gone!

Neat, huh? You will have to substitute your drive letter, path, and file name. If there are spaces in the path then you can wrap it in quotes. I've tried this on Windows Server 2003 R2, Windows Server 2008, Windows XP, and Windows 7. I think it will work on all modern versions of Windows.

While it took me too long to figure it out, it is a handy trick to have in your arsenal. If you want to have some fun with your friends, try running this command:

echo This file cannot be deleted. > \\?\%USERPROFILE%\Desktop\you-cannot-delete-this.

But I don't think you would want to do that...