What are these files and folders?

df84b7afba5b2c94f3194b06d0a5265b


I have several dozen of these kinds of files and folders, mostly folders I
think. I don't really care that they are files or folders, I only want to
know what they are, and if I can delete them. I see these all of the time
when I am working on different computers, and I would feel better if I knew
what they were. Each of them is not very big, but there are dozens, several
dozen, of them and together they take time to be processed, and if they do
nothing then there is no point in processing them.

I want to sort on File Type, and these always float to the top, so I can
simply grab huge chunks of folders that are named this way and delete them.

In a related issue, when I use REGEDIT, I see literally hundreds of the same
kinds of registry keys that are mostly empty.

All of the characters are hexdecimal digits, 0-9 plus A-F, so they are
generated by the file system somehow.

 

I don't think there is much hope of tracing down where
folders like that come from.

I have folders with numeric names like that, of varying
length. I don't have any 32 digits long. I have some shorter
ones though.

Service Packs, .NET updates, and other things, have a bad habit
of randomly picking some disk drive, and plopping one of those
at the top level. So we could hope that perhaps they
would limit their "litter box" activity to just that area.

Once in a great while, one of those folders will turn out to
be important. You go to Add/Remove and attempt to uninstall
something, and it will put up a dialog complaining that
<random_hex_string> folder is missing. So in some cases,
there is content there.

You would have to ask the brain dead programmers, what
they were thinking.

*******

The other kinds of strings, are called GUID. They're
used in the Registry for indirection. By doubly
dereferencing, it allows something to be changed,
without the pointer to it needing to be changed.

bob --> GUID
carol --> GUID
GUID --> some_other_thing <--- changing the definition here,
changes all other references to
this GUID. Double dereference so
you don't have to chase down all
the instances. You can change "bob"
and "carol" at the same time.

http://en.wikipedia.org/wiki/Globally_unique_identifier

Those have a peculiar format. They're used, mainly
because the odds are low of them colliding with one
another. Some, when issued, are systematically generated
(i.e. they're defined in groups). Lots more of them are
purely randomly generated, for the property of not
colliding with one another. This is the example in
the Wikipedia article, of the text encoding.

{21EC2020-3AEA-1069-A2DD-08002B30309D}

That article also says, there is a binary encoding for
those. It happens to be 128 bits or 16 bytes. In hex,
it takes two characters to define a byte. So a hex
string containing 128 bits of information just happens
to be 32 digits long. Exactly the length
of your folder example string above. So in
fact, if that was a GUID at work, you could
attempt conversion to the other representation,
then search the registry for it.

Using this tool, and the GUID converter at the bottom

http://www.windowstricks.in/p/online-tools.html#guid

this: df84b7afba5b2c94f3194b06d0a5265b

becomes this: {afb784df-5bba-942c-f319-4b06d0a5265b}

And you could look in the Registry for it. If you don't
find either representation in the Registry, my guess
is the folder was purely generated as a
"kitty litter box" when they should have been
using %temp%.

Paul

 

I've run into cases, where a user attempts to use Add/Remove or
Programs and Features, to remove a program. And a dialog pops
up, asking for <random_number_path> folder, with the .msi file
in it. There are certainly some folder contents, that are
more dangerous to delete than others. If there was a single
..log file in the thing, I'd have little concern about deleting it.

I don't even know, how you'd go about writing a script
to find and delete stuff like that. If there wasn't a pointer
in the Registry to it, there might be few other hints it is "detritus".

Since the folder names don't even have the same length,
we can't even use length as a trigger. While yours happens
to be 32 characters long, and could be a GUID in binary
form, I can easily find two other folder lengths on my
disk here. So even length of the folder name, isn't
enough to raise your suspicions. It would suggest
there's more than one mechanism generating these.

Paul