Q. I'm trying to shrink an NTFS volume, but the shrink value possible is far less than my free space. What's wrong?

A. When you shrink a volume, the system searches for the last file on the volume that can't be moved. The space after this file is the amount by which you can shrink a volume. There are some actions you can take to increase the amount you can shrink, but first you need to know which file is causing the problem. Open Event Viewer and check the application log for defrag events. One event will confirm that a shrink analysis was performed and identify the last file that can't be moved. The event will look similar to this:

Log Name: Application
 Source: Microsoft-Windows-Defrag
 Date: 4/13/2010 1:55:49 PM
 Event ID: 259
 Task Category: None
 Level: Information
 Keywords: Classic
 User: N/A
 Computer: SAVDALWKS01.savilltech.net
 Description:
 A volume shrink analysis was initiated on volume (C:). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.

 Diagnostic details:
 - The last unmovable file appears to be: System Volume Information\{a1524e09-463c-11df-94cc-d8d3859a9860\}\{3808876b-c176-4e48-b7ae-04046e6cc752\}::$DATA
 - The last cluster of the file is: 0x10d8203
 - Shrink potential target (LCN address): 0xafc7b2
 - The NTFS file flags are: ---AD
 - Shrink phase:  To find more details about this file please use the "fsutil volume querycluster \?Volume\{57f23d49-4104-11df-ac3d-806e6f6e6963\} 0x10d8203" command.

To get more information, run the command that it recommends and you can see the actual file.

C:Windowssystem32>fsutil volume querycluster \?Volume\{57f23d49-4104-11df-ac3d-806e6f6e6963\} 0x10d8203
 Cluster 0x00000000010d8203 used by ---AD System Volume Information\{a1524e09-463c-11df-94cc-d8d3859a9860\}\{3808876b-c176-4e48-b7ae-04046e6cc752\}::$DATA

Here's another example, from after I turned off System Restore (which was the file above):

C:Windowssystem32>fsutil volume querycluster \?Volume\{57f23d49-4104-11df-ac3d-806e6f6e6963\} 0xfadcbb
 Cluster 0x0000000000fadcbb used by ----D ProgramDataMicrosoftSearchDataApplicationsWindowsWindows.edb::$DATA

Now the problem is the Windows Search components index database. I turn off and disable Windows Search service and see

C:Windowssystem32>fsutil volume querycluster \?Volume\{57f23d49-4104-11df-ac3d-806e6f6e6963\} 0xf88150
 Cluster 0x0000000000f88150 used by ----D UsersjosaviAppDataLocalMicrosoftWindowsTemporary Internet FilesContent.IE5index.dat::$DATA

Now it's the Internet Explorer temporary files cache.

Once we know the file that's causing the problem, you can try to address it. Common files that cause problems are:

You may find third-party disk defrag programs have better luck moving "unmovable" files than the built-in defrag.