Microsoft Crypto folder

[ScorpionGTfx]

Hi all! I've Windows 7 64 bit Ultimate Edition, and after running several times MyDefrag, I noticed in my disk many little portion of red data (they seems like many dots) that cannot be moved. I can find them mainly in the first half part of the disk. For now they aren't a problem, because I have half disk free (in the upper part there is enough contiguous space to defragment my drive properly). But in a future they can be a problem. These little red dots represent the folder "C:\Documents and settings\All Users\Application Data\Microsoft\Crypto\RSA\Machinekeys\XXXXX" where XXX stands for other subfolders. What does this folder stand for? And there is a way to defragment it?

Thanks
Byee!

Edit:
Sorry, I made a mistake writing the path of little red dots, the real one is "C:\Users\<user_name>\AppData\Roaming\Microsoft\Crypto\RSA"

[BloodySword]

You can go and compress this folder with 7zip or rar and then truncate it. I think it is a cache or something. Do you encrypt files with NTFS or something?
Edit: I have read that this is a folder for IE where the CA-Certs are stored. You can try to compress them with any archiver, then delete them and then extragt them again. Perhaps this could defragment the files. Normally these files and folders should be movable.

Private Key Storage
Private keys for the Microsoft RSA-based cryptographic service providers (CSPs), including the Base CSP and the Enhanced CSP, are located in the user profile under RootDirectory\Documents and Settings\username\Application Data\Microsoft\Crypto\RSA. In the case of a roaming user profile, private keys reside in the RSA folder on the domain controller and are downloaded to the user's computer until the user logs off or the computer is restarted.

Because private keys must be protected, all files in the RSA folder are automatically encrypted by using a random symmetric key called the user's master key. The user's master key is 64 bytes in length and is generated by a strong random number generator. 3DES keys are derived from the master key and are used to protect private keys. The master key is generated automatically and is periodically renewed. It encrypts each file in the RSA folder automatically as the file is created.

For more information about CryptoAPI, see the Software Development Kit (SDK) link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources.

For more information about Data Protection API, see the Technet link on the Web resources page at http://www.microsoft.com/windows/reskits/webresources.

Caution

The RSA folder must never be renamed or moved. This is the only place the CSPs look for private keys. If you need additional protection for this folder, the administrator can provide additional file system security for users' computers or use roaming profiles.

Source Microsoft. But the link is broken when I paste it here...

[jeroen]

Are you sure it is the files? Encrypted files have 2 parts, the file itself and a file with encryption data, with the same name as the file but with "$EFS:$LOGGED_UTILITY_STREAM" appended to the name. These special files are normally invisible, but you can see them in your "MyDefrag.log" file. MyDefrag can defragment and optimize the files, but not the files with encryption data, they are unmovable.

[ScorpionGTfx]

You can go and compress this folder with 7zip or rar and then truncate it. I think it is a cache or something. Do you encrypt files with NTFS or something?
Edit: I have read that this is a folder for IE where the CA-Certs are stored. You can try to compress them with any archiver, then delete them and then extragt them again. Perhaps this could defragment the files. Normally these files and folders should be movable.

...
Caution

The RSA folder must never be renamed or moved. This is the only place the CSPs look for private keys. If you need additional protection for this folder, the administrator can provide additional file system security for users' computers or use roaming profiles.

No, I didn't nothing special to my disk. Just installed months ago Windows 7 and that's it.
For the advice you gave me, first thanks . Second: can it be a little dangerous to delete this files, even if for a small amount of time (the time to delete them and to extract them again from the .7z archive)?
.
.
Ops, I just checked again, and the folder I wrote before isn't the only one: there is another one named "C:\ProgramData\Microsoft\Crypto\RSA\Machinekeys\XXXXX", where XXXX stands for other subfolders with strange names.

Are you sure it is the files? Encrypted files have 2 parts, the file itself and a file with encryption data, with the same name as the file but with "$EFS:$LOGGED_UTILITY_STREAM" appended to the name. These special files are normally invisible, but you can see them in your "MyDefrag.log" file. MyDefrag can defragment and optimize the files, but not the files with encryption data, they are unmovable.

In the MyDefrag log there is nothing regarding these folders, they seems to be already defragmented. But these folders are not consolidated and they are all distributed in the first half of my drive, and I see them like many tiny red dots after a defragmentation pass. And in the log there isn't nothing with "$EFS:$LOGGED_UTILITY_STREAM" either.
For the encrypted data, I personally didn't encrypted anything on my computer. I never touch this kind of things

[ScorpionGTfx]

This is a portion of MyDefrag map enlarged at 16x of my disk. The long lines are normal files, instead the tiny little (almost invisible) dots are the Microsoft Crypto folders. They aren't red because I didn't start the defragmentation pass.

[BloodySword]

You said the files are in "C:\Documents and settings\All Users\Application Data\Microsoft\Crypto\RSA\Machinekeys\XXXXX". In Windows 7, isn't it C:\Users\Default? Since Vista, Documents and settings is a hardlink to c:\users for bad programmed programms and compatibelity reasons.

[ScorpionGTfx]

Yep, you're right, the first part of the folder is "C:\Users\Default" and _not_ "C:\Documents and settings\All Users\". I was searching on the web for the meaning of this folder, and I copied and pasted the wrong one here in the forum (I was thinking it was the same). Sorry for that

[BloodySword]

Okay, I was wondering what is correct now, because i use Vista and not Windows 7 at this time. It will change November, when I get Win 7 Professional for free .

[jeroen]

But these folders are not consolidated and they are all distributed in the first half of my drive, and I see them like many tiny red dots after a defragmentation pass.

In that case they must be in use by another program. Try booting into safe mode (press F8 while booting) and running MyDefrag again. Please note that MyDefrag is very slow in safe mode because the Windows disk cache is off.

[ScorpionGTfx]

Ok, good idea, in the next days I'll try to defrag in Safe mode and see what happens ... thanks for the advice

[ScorpionGTfx]

Just tried, and these little red dots are still there. Here is a portion of MyDefrag map enlarged at 512x ...   

[jeroen]

Another reason could be that the userid you are running MyDefrag on does not have permissions to access these files. Please note that it is possible in Windows to have permissions that deny access to the administrator.

Perhaps the debug logfile will show you more information, see I have a problem! for instructions.

[ScorpionGTfx]

Code:

16:19:07         I want to move 1 clusters at LCN=386230 of item 'C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c2a487a026c77654a612013b837b7021_2403006b-a89b-44d7-b154-a7110b611993' (Inode=60306).
16:19:07           Moving 'C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c2a487a026c77654a612013b837b7021_2403006b-a89b-44d7-b154-a7110b611993' (Inode=60306)
16:19:07             Could not open: [5] Accesso negato.
16:19:07             Changing the item into 'not movable'.
16:19:07             Calculating the end of the zone.
16:19:07               ZoneBegin = 0
16:19:07               Number of clusters in selected items = 478601
16:19:07               Iteration 1: 39 unmovable clusters between 0 and 478601, ZoneEnd = 478640
16:19:07               Iteration 2: 39 unmovable clusters between 0 and 478640, ZoneEnd = 478640
16:19:07               New ZoneEnd = 478640

I think you're right: Access denied. In my system I've only 1 user, me, without password. Is there a way to gain the permission to access these files? Or perhaps a way to "compat" these files like the pagefile's trick? Also, some of you have Windows 7 Ultimate x64? If yes, are you experiencing this problem of the Crypto folder?

[jeroen]

Is there a way to gain the permission to access these files?

See the properties of the files. There should be an advanced button where you can grab ownership. But I advice against it, I am sure Microsoft had a good reason to protect these files. Just forget it and ignore these files, they don't take up much space.

[ScorpionGTfx]

Okay, I'll follow your advice ... but I've an additional question about this: if one day I find myself with not too much space, can this be an additional problem to defragment my files? Or since these are unmovable blocks MyDefrag will pass on, thanks to the Wrap-around fragmentation concept?