Windows 7 Ultimate SP1 x64

I often find that files that I have closed after editing remain locked
as if they were still in use. This even happens when I close the folder
containing such a file.

One example was a file that I encrypted. It was in a folder that I
wanted to move. After I finished encrypting it and the encryption
application terminated, I was able to erase the original file using
Eraser from <http://eraser.heidi.ie/>. For about 10 minutes, however, I
could not move its folder. I kept getting an error popup saying that it
was still in use.

Another example involves Nirsoft software from
<http://www.nirsoft.net/>. Generally that software is downloaded in the
form of a Zip file. I move the Zip file to an empty folder, unzip it,
and then move the results to a disc partition where I have most of my
applications. The unzipped results often consist of three files with
extensions .exe, .chm, and .txt. I move them by cutting them from the
folder where they were unzipped and pasting them into a folder on the
target partition. When I do that, a copy of the .exe file remains for
several minutes in the folder where it was unzipped. It cannot be
deleted. After several minutes, it suddenly disappears.

What is causing this? Can I do something to fix it?

--
David E. Ross
"A Message to Those Who Are Not Vaccinated"
See my <http://www.rossde.com/index.html#vaccine>.

On 7/4/2022 10:35 PM, David E. Ross wrote:
> Windows 7 Ultimate SP1 x64
>
> I often find that files that I have closed after editing remain locked
> as if they were still in use. This even happens when I close the folder
> containing such a file.
>
> One example was a file that I encrypted. It was in a folder that I
> wanted to move. After I finished encrypting it and the encryption
> application terminated, I was able to erase the original file using
> Eraser from <http://eraser.heidi.ie/>. For about 10 minutes, however, I
> could not move its folder. I kept getting an error popup saying that it
> was still in use.
>
> Another example involves Nirsoft software from
> <http://www.nirsoft.net/>. Generally that software is downloaded in the
> form of a Zip file. I move the Zip file to an empty folder, unzip it,
> and then move the results to a disc partition where I have most of my
> applications. The unzipped results often consist of three files with
> extensions .exe, .chm, and .txt. I move them by cutting them from the
> folder where they were unzipped and pasting them into a folder on the
> target partition. When I do that, a copy of the .exe file remains for
> several minutes in the folder where it was unzipped. It cannot be
> deleted. After several minutes, it suddenly disappears.
>
> What is causing this? Can I do something to fix it?
>

When an application terminates, the System Write Cache can still
have a small portion of the file in it. Whether that "blocks", I don't
really know. All I can tell you is, when you cancel or kill some
commands, the mess in the System Write Cache can take a while to
clear, and it can affect performance of the CPU for a while.

For Eraser to erase a file, is going to take a while.

Some of the things Eraser does, could be setting off your AV software.

Paul

"David E. Ross" <nobody@notme.invalid> wrote:

> Windows 7 Ultimate SP1 x64
>
> I often find that files that I have closed after editing remain locked
> as if they were still in use. This even happens when I close the folder
> containing such a file.
>
> One example was a file that I encrypted. It was in a folder that I
> wanted to move. After I finished encrypting it and the encryption
> application terminated, I was able to erase the original file using
> Eraser from <http://eraser.heidi.ie/>. For about 10 minutes, however, I
> could not move its folder. I kept getting an error popup saying that it
> was still in use.
>
> Another example involves Nirsoft software from
> <http://www.nirsoft.net/>. Generally that software is downloaded in the
> form of a Zip file. I move the Zip file to an empty folder, unzip it,
> and then move the results to a disc partition where I have most of my
> applications. The unzipped results often consist of three files with
> extensions .exe, .chm, and .txt. I move them by cutting them from the
> folder where they were unzipped and pasting them into a folder on the
> target partition. When I do that, a copy of the .exe file remains for
> several minutes in the folder where it was unzipped. It cannot be
> deleted. After several minutes, it suddenly disappears.
>
> What is causing this? Can I do something to fix it?

Same happens when you temporarily disable whatever anti-virus/maleware
software you are using?

You can use SysInternal's handle.exe to see what process has a handle on
the file that is taking so long to get released to complete the move.

Note that moving a file inside the same partition actually effects a
move within the file system in that partition. The file system pointers
get changed to reflect the new location for a file. A file move or copy
across partitions requires a copy operation. The entire file gets read
to make a copy. A move across partitions is a copy followed by delete.
I haven't checked to see how big are Nirsoft packages, but I haven't use
one yet that is so big that a copy across partition of its files would
take a very long time. With a move across partitions, the parent folder
cannot be deleted until the copy operating completes followed by the
delete operation.

Are you using any disk compression, like right-clicking on a folder,
selecting Properties, click Advanced, and selecting to compress it? Are
either of the source or target folders getting synchronized using some
cloud sync service (e.g., OneDrive, Google Drive, etc)? The file may
get locked during a sync on the file, and upstream bandwidth is usually
far slower than downstream bandwidth (most users get async bandwidth
where downstream is fast, so the Internet is fast to you, but upstream
speed is much slower).

There is no instantenous full delete operation where you delete a file
and then erase its sectors. Deleting a file does not reallocate its
sectors to another new file until the file system deems it needs to use
those unallocated sectors. The old data is still in those old sectors.
So, you use Eraser to wipe the content of the unallocated sectors, but
it is going to take time to write to those sectors, especially if you go
nuts on the erasure scheme. Gutman hasn't been needed since the use of
RLL drives which phased out way over 20 years ago. Typically all you
need to do is write zeros, write ones, and then a random write (although
that last step is just to make it look like the sectors never got wiped,
but do you really care?). Eraser will continue running in the
background when you tell it to erase a file (delete followed by lots of
writes repeated for every pass you specify in Eraser). I'm assuming
"Eraser" means Heidi's Eraser tool. A single pass of pseudorandom data
written into the unallocated sectors is more than sufficient, and
recovery of data from your HDDs or SDDs will highly likely fail by any
lab with a magnetoscope.

https://eraser.heidi.ie/appendix-a-erasure-methods/

The more passes you add, the longer it will take to perform each pass
with more writes; however, the added security of more passes is more of
perception than reality. That something could happen doesn't mean it
does. Unless you are plotting against the gov't to cause disasters, a
single pseudorandom pass is sufficient to protect your data. You
mention you are encrypting your data yet that also means temporary space
is used to buffer the input file, so those sectors will have
non-encrypted content of what you wanted encrypted. The paging file
will contain pages of your data files after it they get decrypted to
make they usable. Files under 4K in size don't go into the paging file,
but go into the MFT in the file system. No point in wasting the space
for a file pointer is the record can hold the file rather than waste
either file system space or page file space.

Erasing files (deleting and then overwriting their unallocated sectors,
one or more times) will take time. I doubt Eraser hangs the user
watching the progress, but instead completes the task in the background
during which you can do further actions on the file, including anything
on the folder in which the file was contained.

No idea why you think you need to erase files that you obtained from a
public source. Anyone can download the Nirsoft products. There's no
reason to wipe the sectors for content they'll retain (until they get
reallocated and reused). Anything you can download, so can someone
else, and there's no need to secure it from others. Secure erase is
used on data you generate, or secret programs you are developing but
have not yet marketed. You might want to secure your data, not programs
that someone else wrote and anyone can obtain.

For the source file from where you are copying/moving files, what type
of folder is it? Right-click on the folder, select Properties, and look
under the Customize tab. Make sure it is a General folder, not for
Photos or Videos. Those custom folder types have overhead. Also, the
view you use in File Explorer will affect how fast it can look at the
files. If you use thumbnail view, File Explorer will try to interrogate
the files trying to generate the thumbnails. If you added a column that
has to interrogate the files, like Length (nothing to do with Size, but
the play length of music or video), then the files have to be opened to
look inside them.

Do you see a slow-moving green overlay in the address bar of File
Explorer when opening the folder, or when performing operations on the
files inside the folder?

On Mon, 4 Jul 2022 19:35:34 -0700, David E. Ross wrote:
>
> Windows 7 Ultimate SP1 x64
>
> I often find that files that I have closed after editing remain locked
> as if they were still in use. This even happens when I close the folder
> containing such a file.

It's important to distinguish between what is actually going on in
the file system and what Windows lets you see. That's not always
easy.

For instance, you mention closing a folder. As far as I know, that
doesn't actually release the folder, because it was never locked in
the first place. The "folder" you see on your screen is just a view
of the underlying file that contains pointers to other files. If you
delete the folder in some other window, the window showing that
folder will either close, or change to show the parent folder of the
deleted folder. (At least that's my experience.)

Since a "folder" on your screen is just a view, it definitely would
not lock any files that are in the folder. And conversely, if a file
in that folder is locked by some program, that will prevent deleting
the folder and closing the folder view window won't change that.
> One example was a file that I encrypted. It was in a folder that I
> wanted to move. After I finished encrypting it and the encryption
> application terminated, I was able to erase the original file using
> Eraser from <http://eraser.heidi.ie/>. For about 10 minutes, however, I
> could not move its folder. I kept getting an error popup saying that it
> was still in use.

Others have already given good suggestions about this.
> Another example involves Nirsoft software from
> <http://www.nirsoft.net/>. Generally that software is downloaded in the
> form of a Zip file. I move the Zip file to an empty folder, unzip it,
> and then move the results to a disc partition where I have most of my
> applications. The unzipped results often consist of three files with
> extensions .exe, .chm, and .txt. I move them by cutting them from the
> folder where they were unzipped and pasting them into a folder on the
> target partition. When I do that, a copy of the .exe file remains for
> several minutes in the folder where it was unzipped. It cannot be
> deleted. After several minutes, it suddenly disappears.

Probably it can't be deleted because it's already gone. Windows
showing folder contents don't always update immediately when some
other program changes the folder contents. I wonder what you would
see if, instead of trying to delete the .exce/.chm/.txt files, you
force a folder view refresh by clicking into an empty spot in the
folder window and pressing the F5 key. I'd lay a small bet that those
"zombie" files immediately disappear.

--
Stan Brown, Tehachapi, California, USA https://BrownMath.com/
Shikata ga nai...

On 7/4/2022 10:10 PM, VanguardLH wrote:
> "David E. Ross" <nobody@notme.invalid> wrote:
>
>> Windows 7 Ultimate SP1 x64
>>
>> I often find that files that I have closed after editing remain locked
>> as if they were still in use. This even happens when I close the folder
>> containing such a file.
>>
>> One example was a file that I encrypted. It was in a folder that I
>> wanted to move. After I finished encrypting it and the encryption
>> application terminated, I was able to erase the original file using
>> Eraser from <http://eraser.heidi.ie/>. For about 10 minutes, however, I
>> could not move its folder. I kept getting an error popup saying that it
>> was still in use.
>>
>> Another example involves Nirsoft software from
>> <http://www.nirsoft.net/>. Generally that software is downloaded in the
>> form of a Zip file. I move the Zip file to an empty folder, unzip it,
>> and then move the results to a disc partition where I have most of my
>> applications. The unzipped results often consist of three files with
>> extensions .exe, .chm, and .txt. I move them by cutting them from the
>> folder where they were unzipped and pasting them into a folder on the
>> target partition. When I do that, a copy of the .exe file remains for
>> several minutes in the folder where it was unzipped. It cannot be
>> deleted. After several minutes, it suddenly disappears.
>>
>> What is causing this? Can I do something to fix it?
>
> Same happens when you temporarily disable whatever anti-virus/maleware
> software you are using?
>
> You can use SysInternal's handle.exe to see what process has a handle on
> the file that is taking so long to get released to complete the move.
>
> Note that moving a file inside the same partition actually effects a
> move within the file system in that partition. The file system pointers
> get changed to reflect the new location for a file. A file move or copy
> across partitions requires a copy operation. The entire file gets read
> to make a copy. A move across partitions is a copy followed by delete.
> I haven't checked to see how big are Nirsoft packages, but I haven't use
> one yet that is so big that a copy across partition of its files would
> take a very long time. With a move across partitions, the parent folder
> cannot be deleted until the copy operating completes followed by the
> delete operation.

> Are you using any disk compression, like right-clicking on a folder,
> selecting Properties, click Advanced, and selecting to compress it? Are
> either of the source or target folders getting synchronized using some
> cloud sync service (e.g., OneDrive, Google Drive, etc)? The file may
> get locked during a sync on the file, and upstream bandwidth is usually
> far slower than downstream bandwidth (most users get async bandwidth
> where downstream is fast, so the Internet is fast to you, but upstream
> speed is much slower).

No compression. No cloud.

> There is no instantenous full delete operation where you delete a file
> and then erase its sectors. Deleting a file does not reallocate its
> sectors to another new file until the file system deems it needs to use
> those unallocated sectors. The old data is still in those old sectors.
> So, you use Eraser to wipe the content of the unallocated sectors, but
> it is going to take time to write to those sectors, especially if you go
> nuts on the erasure scheme. Gutman hasn't been needed since the use of
> RLL drives which phased out way over 20 years ago. Typically all you
> need to do is write zeros, write ones, and then a random write (although
> that last step is just to make it look like the sectors never got wiped,
> but do you really care?). Eraser will continue running in the
> background when you tell it to erase a file (delete followed by lots of
> writes repeated for every pass you specify in Eraser). I'm assuming
> "Eraser" means Heidi's Eraser tool. A single pass of pseudorandom data
> written into the unallocated sectors is more than sufficient, and
> recovery of data from your HDDs or SDDs will highly likely fail by any
> lab with a magnetoscope.
>
> https://eraser.heidi.ie/appendix-a-erasure-methods/

Eraser had completed and terminated. It no longer appeared in the Task
Manager.

> The more passes you add, the longer it will take to perform each pass
> with more writes; however, the added security of more passes is more of
> perception than reality. That something could happen doesn't mean it
> does. Unless you are plotting against the gov't to cause disasters, a
> single pseudorandom pass is sufficient to protect your data. You
> mention you are encrypting your data yet that also means temporary space
> is used to buffer the input file, so those sectors will have
> non-encrypted content of what you wanted encrypted. The paging file
> will contain pages of your data files after it they get decrypted to
> make they usable. Files under 4K in size don't go into the paging file,
> but go into the MFT in the file system. No point in wasting the space
> for a file pointer is the record can hold the file rather than waste
> either file system space or page file space.
>
> Erasing files (deleting and then overwriting their unallocated sectors,
> one or more times) will take time. I doubt Eraser hangs the user
> watching the progress, but instead completes the task in the background
> during which you can do further actions on the file, including anything
> on the folder in which the file was contained.
>
> No idea why you think you need to erase files that you obtained from a
> public source. Anyone can download the Nirsoft products. There's no
> reason to wipe the sectors for content they'll retain (until they get
> reallocated and reused). Anything you can download, so can someone
> else, and there's no need to secure it from others. Secure erase is
> used on data you generate, or secret programs you are developing but
> have not yet marketed. You might want to secure your data, not programs
> that someone else wrote and anyone can obtain.

The folder I wanted to move contains encrypted copies of files that
contain my various passwords. I had just changed one, saved its file,
encrypted that file, and then erased the unencrypted file. I noticed
that the folder was not in the location where I want it and tried to
move it. Only after waiting about 10 minutes was I able to move. it.

> For the source file from where you are copying/moving files, what type
> of folder is it? Right-click on the folder, select Properties, and look
> under the Customize tab. Make sure it is a General folder, not for
> Photos or Videos. Those custom folder types have overhead. Also, the
> view you use in File Explorer will affect how fast it can look at the
> files. If you use thumbnail view, File Explorer will try to interrogate
> the files trying to generate the thumbnails. If you added a column that
> has to interrogate the files, like Length (nothing to do with Size, but
> the play length of music or video), then the files have to be opened to
> look inside them.
>
> Do you see a slow-moving green overlay in the address bar of File
> Explorer when opening the folder, or when performing operations on the
> files inside the folder?

No green bar.

--
David E. Ross
"A Message to Those Who Are Not Vaccinated"
See my <http://www.rossde.com/index.html#vaccine>.

"David E. Ross" <nobody@notme.invalid> wrote:

> Eraser had completed and terminated. It no longer appeared in the Task
> Manager.

As I recall, Eraser was going to add a service instead of relying on
running a background process it started using Task Scheduler. Besides
the frontend GUI disappearing from the list of processes in Task
Manager, did you check the service was also not running (no process for
it, and state in services.msc was listed as Stopped)?

Check if Eraser did get around to using a service to do its background
jobs. I have not use Eraser in many years, remember discussions about
it using a service instead of Task Scheduler, but didn't keep up with
the product to know if they ever implemented a service.

As suggested, did you configure Eraser to do 1-pass, or many passes?

On 7/5/2022 5:23 PM, David E. Ross wrote:

>
> The folder I wanted to move contains encrypted copies of files that
> contain my various passwords. I had just changed one, saved its file,
> encrypted that file, and then erased the unencrypted file. I noticed
> that the folder was not in the location where I want it and tried to
> move it. Only after waiting about 10 minutes was I able to move. it.

There is a separate program Handle from Sysinternals,
as well as the Handle function being incorporated into
Process Explorer.

https://helpcenter.gsx.com/hc/en-us/articles/115015880627-How-to-Identify-which-Windows-Process-is-Locking-a-File-or-Folder

Since it's listing Windows 8 at the moment, you might
need a slightly older version.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

In 2017, this version worked with Vista.

https://web.archive.org/web/20171203031459/https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

At some point towards the end of 2021, it jumped to Win8 minimum.
This version might still be Vista/Win7 compatible.

https://web.archive.org/web/20210609020438/https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Paul

On 7/6/2022 12:23 AM, VanguardLH wrote:
> "David E. Ross" <nobody@notme.invalid> wrote:
>
>> Eraser had completed and terminated. It no longer appeared in the Task
>> Manager.
>
> As I recall, Eraser was going to add a service instead of relying on
> running a background process it started using Task Scheduler. Besides
> the frontend GUI disappearing from the list of processes in Task
> Manager, did you check the service was also not running (no process for
> it, and state in services.msc was listed as Stopped)?
>
> Check if Eraser did get around to using a service to do its background
> jobs. I have not use Eraser in many years, remember discussions about
> it using a service instead of Task Scheduler, but didn't keep up with
> the product to know if they ever implemented a service.
>
> As suggested, did you configure Eraser to do 1-pass, or many passes?
>

I used Eraser in the foreground, using a three-pass method.

--
David E. Ross
"A Message to Those Who Are Not Vaccinated"
See my <http://www.rossde.com/index.html#vaccine>.