TL;DR
- Try to shrink the partition in the Windows Disk Management snap-in. Proceed to the step 2, if the shrink fails.
- Find the event with ID 259 in the Windows Event Log and see it's details.
- For even more details, optionally, run the fsutil command with the appropriate parameters given on step 2.
- Given the details from the steps 2 and 3, determine what component, program or feature is locking your partition.
- Temporarily disable or uninstall it.
- Go to the step 1.
Possible culprits: Virtual Memory, System Restore and/or Windows Search Index (System Volume Information folder), Hibernation, Internet Explorer temporary files.
Detailed version:
In the low-level tasks, like working with an HDD system partition, I prefer to use native tools as much as possible, and switch to third-party tools only as a last resort, if none of native tools worked. So, directed by harrymc, I gave Windows Disk Management another try.
I first turned Virtual Memory and System Restore off, removed System Volume Information folders, and after that Disk Management utility allowed me to shrink the C: partition as much as I needed. After that I turned the features back on.
The following instructions may help you to identify what application or component is preventing your partition to shrink. First you need to find the latest event with ID 259 in the Windows Event Log (see Event Viewer / Windows Logs / Application). The event is generated when the system analyses a partition, and if you have already tried to shrink a partition via right-clicking on it in the disk management snap-in, then the event should be there. Another way to make the system analyze a partition is to run the Windows built-in defragmentation utility. The event tells you the last unmovable file or just the number of the last cluster of such a file. It also tells you the complete command to run from the command line to get more details about the last unmovable file. (Alternatively, you can probably also try to calculate the cluster number as min allowed partition size divided by cluster size, and then run the fsutil command with the appropriate parameters).
The filename will give you a hint to guess, what program or feature is locking your partition. And then you can turn it off or uninstall, and see if it helped. In my case turning off Virtual Memory and System Restore was enough. Sometimes it is also necessary to turn off hibernation, etc. And sometimes partition defragmentation may also help. Also, as stated in the WindowsITPro article, Windows Search Index files and Internet Explorer temporary files can also be "unmovable". Sometimes just disabling the System Restore and Windows Search Index will automatically remove unmovable files from the System Volume Information folder, and sometimes you may need to remove the folder manually after that.
P.S.: Thanks everyone for answers. Probably third-party tools would also work in my case, and probably they are easier to use, but as I have already told, for such kind of tasks I prefer to use native tools as much as possible. Also, personal thanks to harrymc for the important hint.
Do it offline (not off the internet, out of Windows), because only Windows respects stuck files.
Either in DOS, or probably much easier to do it in Ubuntu, in a program called GParted. I believe a live DVD/USB would be most useful for you. Gparted will be able to shrink, or remake the partition.
Best Answer
This is not a mystery file.
It's documented in loads of books and WWW sites about NTFS. This is one of several files —
$MFT,$MFTMirr,$Volume,$Bitmap,$Boot, and so forth — that are integral parts of the NTFS on-disc structures. They have these names by convention, but the names don't appear in any directories seen by application-mode Win32 code — and thus end users. They have fixed, well-known, node numbers in the Master File Table.$LogFileis MFT entry #3, and it is used for NTFS transaction logging.::$DATAdenotes a data stream of the transaction log file. (This denotes the default data stream of a file, in fact.) You cannot shrink your volume because the place where that stream is stored is currently at the end of the volume. You need to relocate the contents of$LogFileto nearer the beginning of the volume, a task which some (not all) disc defragmentation tools are capable of.You don't get to delete
$LogFile, or indeed any of the other metadata files. That will prevent the correct operation of NTFS.Further reading