Hundreds of thousands of ContentFile.BLOB files devouring disk space

Hi Marcia,

"C:\System Volume Information\FileProtector\FileStorage" is used by the product and it shouldn't be touched and deleted manually. A big amount of data collected in this folder can be caused for example by some suspicious untrusted process running on your PC. Please collect system information to let us investigate your problem. 

You can find information about how to collect system information here: https://kb.acronis.com/content/58820

Best Regards,

Anatoly Stupak.

Marcia, please do raise a Support Case for this problem with ATIH 2017 New Generation and Active Protection.

I can recommend using the TreeSize Free utility for checking where all your drive space is being used, it is a whole lot easier than looking at the Properties pages.  Just done this on my own system and the same folder for me is only 22MB, so please do have this investigated as advised by Anatoly.

Hi, Anatoly and Steve,

Anatoly, I am running the system information report, it has been running for at least an hour so far. Steve, I had previously downloaded TreeSize as a zip file and when I tried to open it, I found WinZip had mysteriously vanished from my computer, so after messing around with that for some time (trying to reinstall, trying to recover registration) I tried your link. Lo and behold, it's an .exe file, so now I'm installing that.

I will open a Support Ticket if the system info report ever finishes running. Is THAT supposed to take so long?

Thanks,
Marcia

Marcia, I wouldn't expect an Acronis System Report to take an excessive time to create unless the data in C:\ProgramData\Acronis\ is very large in size.  Hopefully with TreeSize Free you will be able to check this very quickly.

Steve--

What can I tell you? TreeSize is running like a slug, too.

Marcia

Marcia, I would take the pill and turn off Acronis Active Protection via the System Tray icon options and see if that kills the slug here!  I am assuming that you have other security software / applications installed, i.e. firewall, antivirus... for protection and not relying solely on AAP?

Marcia,

Once you have disabled Active Protection as Steve suggested above, open Windows Task Manager and look at processes on your PC for Acronis Active Protection and make sure it is not actively running.  Once you can confirm that then run the System Report again via the Feedback option in the True Image app and include a description of your problem along with reference to this thread.

Marcia, if there is any issue with system report creation, please just put these three items into a .zip archive and open a ticket http://www.acronis.com/support/contact-us.html :

1) folder C:\ProgramData\Acronis. Please note that the folder C:\ProgramData is hidden and you may need to enable displaying hidden elements in the Control Panel - Appearance and Personalization - Folder Options - View - Show hidden files, folders and drives. You can compress this folder in a .zip or any other archive format

2) Application and System Windows event logs. Open Windows Start menu, type eventvwr.msc, press Enter. Expand Windows Logs section, right-click Application and System and choose "Save all events as..."

3) Windows System Information file. Open Windows Start menu, type msinfo32 and press Enter. Select File - Save..

Standard system report collects much more logs and reports, but the above 3 items would be enough to start the investigation. If any specific log more will be required, we will let you know.

Alternatively, if you do not wish to open a support ticket for any reason, please just send these three things to us through "Send feedback" form from the Help tab of the program.

Regards,

Slava

Hello again,

My computer suffered a psychotic break about a week after Slava's last message, I've had 2 major depressive episodes, and even now that things are mostly fixed I DON'T really have time to deal with this, I'm in the middle of a massive project with a 9/13 deadline - but my C drive is all but full even though I have moved, deleted and uninstalled a ton of stuff.

The worst offender is still those damned Content.BLOB files from early in the year that refuse to be uninstalled or moved. I went into the program itself and turned off the File Protection and anti_ransomware_service is still running, do I have to reboot? I can't even use "end task" in Task Manager, it restarts automatically. I can't spend a ton of time on this. Is there anybody who could TeamView into my PC and take a look and run whatever reports you need?

Marcia

Marcia, it would be best if Acronis were the ones to use TeamViewer to look at your PC for this problem as they own the code involved and have all the information that may be needed but which isn't published in the user domain.

With regard to Acronis Active Protection, please ensure that you turn it off first via the status bar icon option (or from within the Acronis GUI) and then follow up and stop / disable the Acronis Active Protection Service - go into the Windows Task Manager, then the Services tab, then open the main Services control panel from the link given at the bottom of the task manager page.

Once you done the above, then check your System Protection settings and turn this off for your OS drive if it is showing as being on.  Right-click on 'This PC' then on Properties then System Protection.

Out of curiosity after reading this thread, I took a look at my system. Under the C:\System Volume Information\FileProtector\FileStorage folder there are only two subfolders. One of them was created today and contains very little. The other folder contains 1568 folders, 661 files (.BLOB) and totals 760MB. All of this was created and modified on 7/24/2017 between 8:01 am and 12:26 PM. It's not been touched since.

I'm thinking I should attempt to delete the older folder. What would be the best method?

UPDATE: Checking the event logs, on 7/24/2017 at 12:25, there were 101 TI_proxy DCOM errors:
The server {1EF75F33-893B-4E8F-9655-C3D602BA4897} did not register with DCOM within the required timeout.

This was followed by a Service Control Manager error:
The Acronis Active Protection (TM) Service service did not shut down properly after receiving a preshutdown control.

FYI, this was 2018 Beta, but still of note on this thread.

Just checked on my computer and I am only seeing just over 10MB in my File Protector store where this dates back to early July and nothing since!

Steve, look at the dates created and last modified for the folders under FileStorage. I see you have four of them, but only one has data and it was created on July 4th. I assume the system has been booted since then. It is interesting that there are three that are completely empty.

It appears that when the Active Protection service shuts down properly it will delete the folder. I was able to successfully remove my old 700MB+ folder, but it took a lot of work to find out how. Now I find there is just one folder that gets created when the service starts and removed on shutdown.

Are you running the Active Protection Service?

Bruno, this computer is running ATIH 2018 Beta with AAP active and is shutdown every day, so if these folders are meant to be 'cleaned' when AAP shuts down, then it looks like this is left over from the earlier Beta builds.

I would guess that one sure way to remove these types of folders would be to boot from my WinPE Rescue Media made with the MVP Tool and use the built-in file explorer to safely remove them outside of Windows 10.

Ok, update needed. I booted from my MVP WinPE Rescue Media and despite selecting to delete the FileStorage folder contents - the file manager seemed to ignore the delete request..!

I booted instead from a USB live Linux distribution (Puppy Slacko) then was able to first identify the correct Windows 10 partition and then easily remove the FileStorage sub-folders.

Finally, restarted into Windows 10 and confirmed FileStorage was now 0 size with just a single new folder created with todays date.

I'd wondered if the WinRE (or WinPE) boot media would work. Seems like it does just what Windows 10 does.

I used a different method that I found after spending far too much time on this. It involves an administrative command window to call takeown (to take ownership), icacls (to give myself full permission) and rmdir to finally remove it.

Thanks for the info about how to disable the service, Steve. It worked!

As far as the TeamView issue - that's my bad, I was thinking this was a customer service forum, rather than a community forum.

Marcia

Marcia, thanks for the feedback/update.  Glad that disabling the service has been successful.

Marcia, have you been able to get rid of all the files?

Slava, the .zip file of C:\ProgramData\Acronis is 3.21 GB in size. Can your support ticket system handle that?

Marcia

God, I wish. No, I was only able to disable the service so no more of FileProtector files are created. Although the ones created after I followed the initial reinstall instructions in this thread are normal.

Here's a screen shot of what I'm dealing with. This is several levels down inside C:\System Volume Information - I kept the path across the top. It's nuts!

Gathering the reports Slava asked for has taken 90 minutes (the first zip file took over an hour to finish compressing) and is 3.21 GB. I'm feeling really defeated and wondering what a backup software program is even doing trying to be a malware protection program, too. I wish I'd never turned the damn option on.

Marcia, two questions:

1. Do you have administrator privileges?

2. How many folders are there under FileStorage? Just the ones at that level.

Hi, Bruno. I should have administrator privileges, but just to be sure, after I write this I will sign out, then sign in as Administrator and try to delete the files. Second, there are 25 total files in FileStorage. I believe 12 of them were created after I reinstalled the software; those are small and some are even empty. I didn't check them all, but I think (this was before a heavy nap) the largest was 35MB.

Well, what happened after I logged in as Administrator was certainly, uh, interesting. Administrator did not have permission to open the folder "System Volume Information." When I added the permission, I got a big error message that quickly disappeared, but then permission WAS added. Got to the point where I could try to delete a file, and this time there was a popup "discovering files," which I thought was promising, so I clicked the "More Info" link and found that the delete process found zero bytes of files. At that point I gave up, logged off, and logged back in under my own name.

Found a disaster. All the basic fonts were wrong, and of course, I had no idea what they had been before. Font sizes also were wrong and no matter what I did, I couldn't get them right. So I did a system restore - I had one just a few hours old. That took THREE HOURS. I didn't want to spend any more time on it last night. This morning I logged in and the fonts and their sizes were still all screwed up. So I bit the bullet and logged Admin back in. There the fonts were perfect. Logged out and went back to MY login. Almost all perfect. Firefox still has some fonts that aren't right - tab titles and bookmarks bar - but I can live with that.

Meanwhile, Windows is no longer reading one of my external drives (used for backup) although it does beep when I turn it off and on... I'll open a ticket one of these days but right now I have to get back to real work.

Thanks for your input, guys.

Marcia

Marcia, I'm sure this must be frustrating. As I mentioned in a post above, I was able to delete the stuff out of the FileStorage folder with a few commands. It requires opening a Command Prompt window with administrator privileges, but not required to log in as the Administrator. When you did that, you were running under a different account. That may have contributed to the trouble. And by changing ownership of the whole System Volume Information folder, you may have inadvertently caused something to mess up. Hopefully you will have everything back as it should be soon.

Just to contribute, since this is the first thread I found about this issue, but no one listed the way to delete those files:

Disable the Acronis services.

Then, from an admin command line run the below commands.

icacls "C:\System Volume Information\FileProtector\FileStorage"  /t /c /grant YOURUSERNAME:F

(This takes a LONG time to run if the folder is very large. It is giving you full privileges to the folder. You may have to run it on the main System Volume Information folder, to be able to drill down in the first place.)

rmdir "C:\System Volume Information\FileProtector\FileStorage" /s /q

Turn the services back on. You'll see the folder is instantly recreated, when the Acronis protection kicks back in.

Jason, welcome to these User Forums and thank you for sharing your method of dealing with these unwanted files.

Jason, I wish I'd seen this sooner, but at this point, I've given up with Acronis True Image altogether and asked for my money back (both my software subscription and my Cloud subscription JUST renewed). Everything Customer Support has told me to do has come up with MORE errors. I was already extremely unhappy with the restore process, which now requires ME to know when the last backup of a particular file took place.

And since Windows 7 and beyond do not allow for a clean command prompt (a true DOS prompt outside of Windows), I'm not even sure what's meant nowadays by an "admin command line." If you'll explain that, I'll still give your method a try, it's rather exciting! But as for ATI as a whole, they've ruined it and I just want my money back before I delete it and look for something a heck of a lot simpler and cleaner.

I just meant a command line window with Administrative rights. So Start Button -> type cmd -> right click on the result and run as Admin. Should open a black command prompt window with elevated rights on the machine. You can then run the commands I listed above.

Jason, I'm running this now, and thanks for telling me it would take a long time. I've had yet MORE problems with this software this week - all of a sudden a bunch of old material was restored (old shortcuts, some of them older versions of existing shortcuts, suddenly appeared on the desktop after a reboot), and some more recent material simply vanished. I am unable to backup to or recover from the Cloud, so I suspect everything there is corrupted. Older backups to my external hard drive cannot be opened. More recent backups do not contain the missing material.

Being someone who knows the value of backups and has been religious about backing up my computer - I mean, everything on my computer - it's horribly frustrating to be having all these problems. Thus, since I am about to move to a new PC (with Windows 10, which I'm dreading), I'm extremely uneasy about continuing to use Acronis as my backup.

One of my two external drives is no longer accessible at all - the computer recognizes it is there, but that's all - it can't be opened. It's possible that the drive has failed, but under these circumstances, it's hard not to suspect Acronis True Image involvement.

When I download anything automatically, it goes into the default Download folder (even though I have specified "always ask me where to save"), and then I am told the folder is not accessible. Yet if I cut and paste the downloaded file to another location, I am able to use it. Apparently my entire C drive is corrupted, and it's not worth the time and effort to wipe it and do a clean installation of Windows 7, since I have a nice new PC sitting here unused. At this point I am just hoping I can transfer my software, documents, and critical User Data to the new PC safely.

Yes, there is a reason why I have not started using the new PC. I am still working on a critical remote project and don't want to risk screwing it up.

I will post again when this process finishes running and (the gods and devils be willing) I am able to delete those bloody FileProtector files.

I'd like anybody who is reading this to give me advice as to whether at this point I should delete ALL my old backup files (including those in the Cloud, presuming I can even do that myself) and all my old backup settings within ATI 2018 and start fresh.

Marcia wrote: "all of a sudden a bunch of old material was restored (old shortcuts, some of them older versions of existing shortcuts, suddenly appeared on the desktop after a reboot), and some more recent material simply vanished."

When you say the above, what actions in terms of using Acronis were you doing? 
If things have been restored then were you doing some form of recovery?

I would not recommend deleting any of your older backups until you can confirm that they have been corrupted or damaged in some way.  

How are you trying to open the backups on your backup drive?  If that drive has not been connected to your system then there is no reason for the backups on the drive to have gone bad unless the drive itself is failing?

Do you have a working copy of the Acronis bootable Rescue media (on CD/DVD or USB stick) that you can try booting from and looking at your backups in that way, completely eliminating any issues that may be present in your Windows OS and/or the Acronis application or shell integration?

When you speak about transferring your Software, Documents and critical User Data to the new PC you have, again, how are you attempting to do this?  Acronis cannot be used to migrate installed software to a different computer system!

Marcia, I'm going to make a suggestion to go a different way... hire a competent IT guy who can bring your system to a stable state. Meanwhile, don't delete the backups you have.

When in a hole, don't dig deeper.

Hi Steve,

When you say the above, what actions in terms of using Acronis were you doing? 
If things have been restored then were you doing some form of recovery?

I don't remember for sure. I just remember rebooting. I think I had been trying to access backup files, without success.

I would not recommend deleting any of your older backups until you can confirm that they have been corrupted or damaged in some way.

Okay.

Do you have a working copy of the Acronis bootable Rescue media (on CD/DVD or USB stick) that you can try booting from and looking at your backups in that way, completely eliminating any issues that may be present in your Windows OS and/or the Acronis application or shell integration?

No, but I downloaded the most recent version from the Acronis support site a couple of days ago, and I can move it to a CD. It is not on the C drive (my drive has a lot of partitions, it's on the J drive.)

When you speak about transferring your Software, Documents and critical User Data to the new PC you have, again, how are you attempting to do this?  Acronis cannot be used to migrate installed software to a different computer system!

No - I intend to purchase a new external drive, copy the software install files, documents, etc., to that, and then copy them onto the new computer. Where I can have accounts that allow it, I will download fresh installation files. (I wouldn't have trusted Acronis to do it anyway.)

Thanks,
Marcia

Hi, Bruno,

Marcia wrote: I don't remember for sure. I just remember rebooting. I think I had been trying to access backup files, without success.

If these problems arose after just rebooting the computer and you have not been restoring data using ATI, then there is something more unusual going on here, potentially a failing disk drive giving rise to corrupted files etc, or potentially malware at work.

If you have another working computer, then create the Acronis Rescue Media CD on that PC then test if you can boot from the CD on the problem computer.  If you can, then look at your ATI backups on your backup drive and see if these can be explored by doing a dummy run of a recovery, i.e. exploring the backup content as if you were going to recover some files or folders.

If the backup files look OK to the Rescue Media boot CD application, then a further decision will be needed:  what will be lost if you restore your latest good full backup to this computer?  Are there any files (documents, pictures etc) that you need to save/copy from the computer before doing a recovery?

Another suggestion here, if there is a possibility of malware being involved, then I would recommend using the bootable AVG Rescue Disc to do a full offline malware scan - this can be created on either DVD or using a 2GB USB stick.  You should have a connection to the internet when you boot from the AVG Rescue Disc in order for it to download the latest antivirus definitions to use.  This will work with any cabled network connection (Ethernet) and also with common wireless connections, but you will need to enter the wireless credentials for the connection to your access point or router.

Hi, Steve--

I'm currently running Jason's command line function. It has been running for 38 hours now. When I went to bed it still had nothing in it but the command. When I got up at 1:30 pm it showed 7 files processed. It still shows 7 files processed. This is going to take a VERY VERY long time.

So just for background - last May 13th this PC had a psychotic episode. When it was done I could no longer access some user data - could not recover my Thunderbird profile and all my saved email, game data lost, etc. There were lesser problems in between, then this last time my OLD game data showed up and I can't find the data from the period between May 13th and a few days ago. Not to mention that older copies of desktop shortcuts suddenly appeared. Two Startup folders. Two for Web Design Tools, Graphics Software, bleeping computer, Sound and Media - yet one game shortcut was missing. I was able to restore it, but all the stored history was gone. The whole thing is just *weird* and I should probably just be concentrating on getting the essential projects done on this PC so I can switch to the new one ASAP.

Did I mention that I can't access any of my existing backups using Acronis?

Marcia

Just to let you and all the kind people who've joined this thread that your first command, "icacls," just finished a bit ago. That means it took 5 full days. Now I am running the "rmdir" command. That one I understand - remove directory. Gosh I miss DOS sometimes.

Is this likely to take 5 days, too?

Marcia

Marcia, cannot advise on how long Jason's commands will take as have never needed to use them.  I found it a whole lot simpler to boot from a small Linux OS USB stick and remove all these types of files in a matter of seconds.

Hi Steve,

I was hoping Jason would reply - maybe he still will. As for you wizards with your magical Linux wands and secret WinPE scrolls signed, no doubt, by Satan himself, your humble self-taught Windows user bows and scrapes before your sacred feet with a thousand thanks, and goes to put her battered old body with its sore throat, earache, bad back and artificial knee on the Sofa of Healing in the Room of Living and let the mystical "rmdir" command continue its stealthy mysterious workings while browsing the Tube of You.

Marcia

Linux is the faster way, no doubt, but I didn't want to take my production server down to delete files that can be done while it's running. As to how long it ran, it only took me about 8 hours for the initial command, and the delete took maybe 30 minutes.

I would imagine from the length of time it took your command to run, you have FAR more files than I did. I would recommend keeping an eye on this folder in the future, it seems like the currently in use folder gets orphaned every time the server has to reboot, and doesn't gracefully shut down the Acronis protection service. So, after 3-4 reboots, it ends up taking up most of your disk space. 

If Acronis protection shuts down gracefully, it automatically deletes the folder that's in use.

Marcia, assuming that you are not also running a production server environment (as Jason is) then creating a simple Linux boot USB stick for this type of problem doesn't need you to be enrolled in the Harry Potter school of magic!

See webpage: LinuxLive USB Creator for a free, guided utility for doing exactly this which is intended for beginners or experts alike.  See the User Guide for this utility program.

YAY! YIPPEE! <does a happy dance and then flies in circles breathing dragon fire on the ghosts of removed files, folders and directories> THEY ARE GONE!!

Glad to hear it! 

100% disc usage caused by Acronis Active Protection.

I am running a network with 2 laptops and a nasbox. Laptops are (1) Dell Inspiron 5559 with Intel i7 6500U CPU running Windows 10.0.16299 and (2) Dell Inspiron 7520 i7-3632QM CPU also with Windows 10.0.16299. NASbox is QNAP running QTS TS-231 Version 4.3.4.0435 (2017/12/30).

Both laptops have Adobe CS3 installed (I know it’s old but it runs perfectly well). I recently updated Acronis on both laptops to Acronis ver 2018 Build 10640. Since then, every time Photoshop is started on the Dell 5559 disk usage shoots to 100% and stays there for about 5 minutes (and nothing else can run!). The Dell 7520 is working normally.

Using resource monitor I found it was caused by many many "ContentFile.BLOB" (in folder C:\System Volume Information\FileProtector\FileStorage\...) files writing to the disk with I/O priority “normal”.

I disabled “Acronis Active Protection” and the problem went away although there were still some "ContentFile.BLOB" files, their I/O prioroity dropped to “background”.

I’ve re-installed CS3 on the 5559 and compared settings I could think of on both laptops for Windows, Acronis and Photoshop.

Any ideas on cause of proplem?

Dennis, welcome to these User Forums.

Please see KB 60193: Acronis True Image 2018: Active Protection blocks legitimate applications and try whitelisting your Adobe CS3 main executables for AAP to see how that helps with this issue.

Beyond that, I would recommend opening a Support Case direct with Acronis to allow them to see and investigate the problem you are reporting.

Thankyou Steve, Whitelisting photoshop.exe appears to have fixed the problem. I won't ask how or why!! Acronis didn't report any blocked processes. thanks again Dennis

Dennis, thanks for the feedback, glad the white-listing helped here.

Hi Steve,

Do you know new solutions for this problem?

I attach excel file with the total of "ContentFile.BLOB" occupying my disk.

I ask if there is any problem in deleting all the "ContentFile.BLOB" files, after deactivating the "Protection".

Thanks,
Pedro Pico

Pedro, sorry but I haven't seen any mention of this problem in at least 3 years and had to remind myself of what the issue was about!

What version of Acronis software are you using here?

When you look at the Protection panel, does it show that any processes are being 'Managed' - if so, this may be the source of the .BLOB files and whitelisting the managed processes should help stop the issue.