What are these files and folders?

Discussion in 'Computer Information' started by Jeff Strickland, Jan 30, 2014.

  1. df84b7afba5b2c94f3194b06d0a5265b

    I have several dozen of these kinds of files and folders, mostly folders I
    think. I don't really care that they are files or folders, I only want to
    know what they are, and if I can delete them. I see these all of the time
    when I am working on different computers, and I would feel better if I knew
    what they were. Each of them is not very big, but there are dozens, several
    dozen, of them and together they take time to be processed, and if they do
    nothing then there is no point in processing them.

    I want to sort on File Type, and these always float to the top, so I can
    simply grab huge chunks of folders that are named this way and delete them.

    In a related issue, when I use REGEDIT, I see literally hundreds of the same
    kinds of registry keys that are mostly empty.

    All of the characters are hexdecimal digits, 0-9 plus A-F, so they are
    generated by the file system somehow.
    Jeff Strickland, Jan 30, 2014
    1. Advertisements

  2. Jeff Strickland

    Paul Guest

    I don't think there is much hope of tracing down where
    folders like that come from.

    I have folders with numeric names like that, of varying
    length. I don't have any 32 digits long. I have some shorter
    ones though.

    Service Packs, .NET updates, and other things, have a bad habit
    of randomly picking some disk drive, and plopping one of those
    at the top level. So we could hope that perhaps they
    would limit their "litter box" activity to just that area.

    Once in a great while, one of those folders will turn out to
    be important. You go to Add/Remove and attempt to uninstall
    something, and it will put up a dialog complaining that
    <random_hex_string> folder is missing. So in some cases,
    there is content there.

    You would have to ask the brain dead programmers, what
    they were thinking.


    The other kinds of strings, are called GUID. They're
    used in the Registry for indirection. By doubly
    dereferencing, it allows something to be changed,
    without the pointer to it needing to be changed.

    bob --> GUID
    carol --> GUID
    GUID --> some_other_thing <--- changing the definition here,
    changes all other references to
    this GUID. Double dereference so
    you don't have to chase down all
    the instances. You can change "bob"
    and "carol" at the same time.


    Those have a peculiar format. They're used, mainly
    because the odds are low of them colliding with one
    another. Some, when issued, are systematically generated
    (i.e. they're defined in groups). Lots more of them are
    purely randomly generated, for the property of not
    colliding with one another. This is the example in
    the Wikipedia article, of the text encoding.


    That article also says, there is a binary encoding for
    those. It happens to be 128 bits or 16 bytes. In hex,
    it takes two characters to define a byte. So a hex
    string containing 128 bits of information just happens
    to be 32 digits long. Exactly the length
    of your folder example string above. So in
    fact, if that was a GUID at work, you could
    attempt conversion to the other representation,
    then search the registry for it.

    Using this tool, and the GUID converter at the bottom


    this: df84b7afba5b2c94f3194b06d0a5265b

    becomes this: {afb784df-5bba-942c-f319-4b06d0a5265b}

    And you could look in the Registry for it. If you don't
    find either representation in the Registry, my guess
    is the folder was purely generated as a
    "kitty litter box" when they should have been
    using %temp%.

    Paul, Jan 30, 2014
    1. Advertisements

  3. Jeff Strickland

    Paul Guest

    I've run into cases, where a user attempts to use Add/Remove or
    Programs and Features, to remove a program. And a dialog pops
    up, asking for <random_number_path> folder, with the .msi file
    in it. There are certainly some folder contents, that are
    more dangerous to delete than others. If there was a single
    ..log file in the thing, I'd have little concern about deleting it.

    I don't even know, how you'd go about writing a script
    to find and delete stuff like that. If there wasn't a pointer
    in the Registry to it, there might be few other hints it is "detritus".

    Since the folder names don't even have the same length,
    we can't even use length as a trigger. While yours happens
    to be 32 characters long, and could be a GUID in binary
    form, I can easily find two other folder lengths on my
    disk here. So even length of the folder name, isn't
    enough to raise your suspicions. It would suggest
    there's more than one mechanism generating these.

    Paul, Feb 1, 2014
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.