Untouched files are replaced again after defrag.

[Bart Welson]

Hello,

with the great help of Darlis, i have been able to create a script that puts all my huge, almost never touched files to the end of the partition using MoveToEndofDisk() , the script worked wonderfully, but now, a day later, i see that most of that stuff has somehow been placed back somewhere completely else, they are nowhere near the end of the disk again.
I started the scripted defrag half an hour ago, and it's still only at 20% of the MoveToEndofDisk() zone ..... Pffffff.....


I wonder what could be the problem, The windows defragger is switched of (afaik) in the Services window.

Configuration / Services / Disk Defragmenter -> DISABLED.

Please, what the hell is undoing the action of a MyDefrag run only 1 day after doing a long long defrag with the specially crafter script ?
P.S. I haven't touched *any* of these files in the mean time.

[Darlis]

By installing MyDefrag you have probably left the option to create scheduled tasks checked (the default). You should be able to find and remove these tasks in the Windows Task Scheduler.

[Bart Welson]

By installing MyDefrag you have probably left the option to create scheduled tasks checked (the default). You should be able to find and remove these tasks in the Windows Task Scheduler.

Hi Darlis,
No, i specifically unchecked these options upon install of MyDefrag.
Checking the Windows Task Manager, i found there was a task ScheduledDefrag which should run weekly, but according to its history tab, it had last ran on 26 march, so I don't think that is the problem, also, the DiskDefrag service is set to DISABLED.

I really have no idea, i now have specified in my AV (Panda Cloud AV) to exclude from scanning, all the folders that should stay at the end of the disk, and for security also excluded it from scanning *any* .mp4/.avi/.VOB/.flv

Lets see how it is in a couple of days.

Thanks again for the tips !

[Darlis]

Checking the Windows Task Manager, i found there was a task ScheduledDefrag which should run weekly, but according to its history tab, it had last ran on 26 march, so I don't think that is the problem, also, the DiskDefrag service is set to DISABLED.

That must be the scheduled task for the Windows Defragmenter. But since the service is disabled, it shouldn't move any files around.

Have you installed a tuning tool (TuneUp?) or similar that does defragmenting/optimizing? It can't be the anti virus program, it's not supposed to move files (unless it's infected), so excluding these files won't solve the problem.

[Bart Welson]

If I remember correctly, i only set the Disk Defragmenter service to disabled just a couple of days ago, it was set to Manual before,
it must have thought "Ah well, it'll only start when i want to", but unfortunatelly i had not thought about the Task Scheduler.
 i'll see if things calm down there at the end of the disk.

I'll check in a few days to be sure the problem is now gone.

[Bart Welson]

Only after a day, i have to see that most of the files are, again, replaced.
I'm out of idea's, perhaps the last possible "culprit" to comes to mind is that the top directory of these folders at the end of disk is set so be shared with the LAN (in order to be streamed on a PS3), configured in Media Player & the top folder is in the directories to be indexed by Windows. (When I assign specific folders in Media Player to be shared with the LAN, they are always automatically added as folders to be indexed.)

But why the hell should Windows Media Player (or the Indexing service) moves all those files back out of their original place.

[Darlis]

You may be able to find the program that's moving the files with Sysinternals ProcessMonitor:
Add a filter with the path to one of the files that should stay at the end of the disk. Make sure you've enabled the option to "Drop Filtered Events", otherwise you'll get a huge log file.
Then play the waiting game

You should see some activity on the file at some point and then you'll likely have the process that's moving the files back.

Tip: after setting up ProcessMonitor, open the file or let it move up by MyDefrag (if you haven't done this yet) and see what ProcessMonitor outputs, just to get used to the program.

[Bart Welson]

Ahhh! Another great idea, Darlis.
Thanks, i WILL find the bugger.
 

EDIT: BTW, if i don't happen to catch anything, is it somehow possible to have Process Monitor to log during startup also, i suspect it must be happening there, but lets first see if i can catch anything while i leave my system on.

[Darlis]

Yes, ProcessMonitor can log during boot time, but I doubt that it's happening at that point.

[Bart Welson]

Nope it's happening during runtime, it's the process svchost.exe that fiddles with the files.
I have no knowledge about these kinds of things, but rightclicking one of the log entries & properties, gives me these screens, but honestly i don't know what to make of that.



If must have something to do because the top folder C:\delen is shared on the LAN ?
Although nothing (nobody) on my lan has accessed any of these files....

[Darlis]

svchost could be anything. CreateFile just means that it accesses the file, not necessarily move it. Does the details column show any read or write operations?

[Bart Welson]

svchost could be anything. CreateFile just means that it accesses the file, not necessarily move it. Does the details column show any read or write operations?

not as far as i can see (or know) :

[Darlis]

The access is always to read data. Add the Operation column, too. Just let MyDefrag run a bit and see what ProcessMonitor outputs, so you'll know what to look at.

[Bart Welson]

The access is always to read data. Add the Operation column, too. Just let MyDefrag run a bit and see what ProcessMonitor outputs, so you'll know what to look at.

The operation column is always the same, 3 different accesses per file/folder :
- CreateFile (Desired Access:   Read Attributes, Synchronize)
- FileSystemControl (Control:   FSCTL_GET_RETRIEVAL_POINTERS)
- CloseFile

Anyway, i fiddled around with the layout.ini file a bit, removed it all, followed a tutorial which includes 4 reboots, and then in the cmd window, made it rebuild the layout.ini file.

The new layout.ini file is exactly the same as it was before i deleted it all. It's a whopping 877KB big file  (!!!!) and full of traces to these "never accessed" folders......

[Darlis]

The layout.ini file is build by information from the Prefetch files (.pf). I you haven't removed those, your files will likely be listed there (these files are not human readable, though). They're probably listed in the file for your media player with which you usually open these files, maybe even in explorer*.pf.