Sunday, June 10, 2012

Successfully Deleting a Locked Up or In Use Windows 7 File or Folder

How to force Delete a file or folder on Windows 7:

If you don't have Premium or Ultimate, ignore the advice online about using gpedit.msc, which Microsoft has decided to reserve for those "superior" versions (despite being necessary to overcoming terrible bugs like exporer.exe commonly locking-up files and folders!!!).

Note that if this folder was for a program, you may have to get rid of dlls running in explorer or some other part of the system, which will be covered in the information below. Before proceeding, you should use the Add/Remove utilities in the Control Panel to remove as much of the program as possible first: elsewise you can cause some issues you don't want. If you already have and (like or something like me, trying to get rid of program config files) still can't get rid of something, proceed. But note this isn't a guide just for program folders and files: read on and use all that's applicable to you: the following is a cumulative step-by-step guide written for moderately computer literate people.

When instructions include paths with variables, variables are surrounded by brackets which ARE NOT to be entered with the apropriate name of a file or folder. Instruction items that are entered into the computer are surrounded by quotes ("...") which are not to be entered into the computer as you do this, only their contents.

Download the MS sysinternals suite here, http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx (or Google "Microsoft sysinternals"). It comes in a .zip file and most utilities don't need to be installed to run, just clicked on doubly to run (and given permission). Extract ("unzip") to a folder, and then in that folder select procexp.exe or procexp.exe: choose to allow the program to run as admin at the prompt.

Go to the Windows/"Start" button and enter "cmd" in the "Search programs and files" box, but don't hit "enter". When "Cmd" appears in the search results, right-click and select "Run as administrator". Choose to confirm at the confirmation dialogue.

Change the directory to the one in which the file or folder you wish to delete resides. To do this you type "cd [directory path]", e.g. if it's a program folder in "Program files", you need either "C:\Program Files" or "C:\Program Files (x86)" after "cd", which gives "cd C:\Program Files (x86)" for the latter one.

del INSTRUCTIONS:

Now you try the following (and if this does not work, keep reading). type "del [folder name or filename.extension]", e.g. "del Notepad++" for that folder on my system, or "del Notepad.exe" if deleting notepad.exe in the directory to which you "Cd'd" above.

You may get "access denied". In my case I was getting the message "Notepad++\[some name].dll Access Denied", but you could get something besides ".dll" (.[dll/exe/other]). I knew a certain system feature was in use (explorer.exe) that I would have to terminate, but given I want this to be a general guide, here is where process explorer (which you opened earlier) comes into play for you.

1. Alt+tab to the process explorer window (because potentially you may not be able to use the startbar icons to move through programs for long).
2. Select "Find" (near the top bar) and choose "Find Handle or DLL" in the menu that appears.
3. In the box that appears, type the "[some name].[what you get, in my case ".dll"]" (or .exe instead of .dll or whatever) and hit "search" or press Enter.
4. In the main window you will see a process highlighted, which may or may not have the name of what you were searching for: if it does not, it's the parent process. Right click it and select "Kill Process" (if it's explorer.exe you now have to make sure not to open explorer, re-open any folders, etc.)
5. With this killed, re-try the "del" instructions above. If you were trying to delete a folder that contained an active dll, cd into the directory with the .dll and specifically use the del command on that itself, then cd back to parent (i.e. the directory with the folder rather than the subdirectory thereof which you are in) and then use the del command on the folder name.

If you are still denied access, take control of the directory and/or file:
1. in the cmd prompt type "cd C:\Windows\system32" to put yourself in the default directory.
2. type "takedown /[directory path to/file or folder]" (replace "directory path" with something like C:\Program Files (x86)" or one to that of your documents folder or whatever, and "file or folder" with the filename, or the folder you're aiming at to delete); if you're aiming at a directory, you need to end with /r, e.g. in my case the whole was "takedown /f C:\Program Files (x86)\Notepad++ /r" (because I was trying to delete "notepad ++") and then pressing Enter, AND ALSO "C:\Program Files (x86)\Notepad++\[some name I can't remember].dll" and then pressing Enter, because I wanted to delete this dll. Press Enter after each one.
3. Give yourself rights to the file or directory (or both) by typing "cacls [file or directory--remember you may need to give a directory path for the file, or ensure you've cd'd to its location to just enter the file or folder name without the path] /G [username]:F". If you were denied access it will actually give your full username. e.g. mine was something like "anon-cognizat\anon" (though I'm not going to be telling you the real one!), so I would have to enter "cacls Notepad++ /G anon-cognizat\anon:F" and when cd'd into the subdirectory containing the dll the same but with "cacls [some name I can't...].dll /G anon-cognizat\anon:F".

Repeat the del instructions above. They should now work.

Now to confirm it's gone. If explorer.exe was terminated you will need to:
1. Press "Ctrl+Alt+Del" and choose "Start Task Manager".
2. In Task Manager select "File" (top bar) and choose "Run New Process".
3. enter explorer.exe and hit Enter.
4. Navigate with explorer to the directory containing the file or folder.
5. Check. If it's still there, right-click and select "Delete" (I had to do this despite having successfully deleted the .dll in the subdirectory and supposedly the file using del through Cmd prompt).

--

In addition, you may have files in the Temp and Appdata directories you may wish to purge (and any secret folders meant, perhaps, for law enforcement or whatever, but if you need to be paranoid about that sort of thing...I recommend not using computers, but Windows especially, without some kind of comp sci degree in forensic recovery and trace hiding!!!) when this is for post program uninstallation. To find them, select Windows-Icon/Start Button, type "%Temp%" in the "Search Programs and Files" box and hit "Enter". The folder will appear, and select all, right-click, and choose "delete". (I recommend skipping locked-up and "you need permission to delete" files in here unless you are the sort that really doesn't need this kind of guide in the first place!!!) Then choose the Win/Start button again and enter %AppData% and select "Enter". Here find a file or folder with the same as the program you deleted (Note: in my case the %AppData% takes me to [...]\AppData\Roaming, and it's in there that the program folder was located) and select "Delete".

--
Bibliography (Some information above was found at the following helpful resources/posts):
http://www.cypherhackz.net/archives/2007/01/16/how-to-delete-in-use-file-in-windows/
http://superuser.com/questions/60700/how-do-i-get-permissions-to-delete-files-on-windows-7 which also have other information that could be of use if, by some miracle, the above doesn't work for you! Ultimately you might have to do Safe Mode or else use "BartPE" (Google it) so you don't have to boot into Windows.












No comments: