System Volume Information Folder: What It Is & How to Access

The System Volume Information folder is a hidden, protected system folder on every Windows drive that stores restore points, Volume Shadow Copy data, disk indexing databases, and other system services’ internal files. You normally cannot open it through File Explorer, and trying to do so gives an “Access is denied” error. This article explains what the folder actually does, why Windows hides it, and the safe, legitimate ways to view or manage its contents.

What the Folder Is For

The System Volume Information (SVI) folder exists on the root of every NTFS-formatted drive, including external drives and USB sticks. It is not a virus or a sign of malware — it is a core part of Windows. Its main jobs are:

• System Restore points: snapshots of system files, registry settings, and installed programs that let you roll back Windows to an earlier state.
• Volume Shadow Copies: older versions of files that the “Previous Versions” tab in File Explorer shows. These are created by the Volume Shadow Copy service (VSS).
• Indexing and search databases: the Windows Search service stores its index here so that file searches are fast.
• Disk quotas and change journals: NTFS uses the folder to store quota settings and the USN journal, which tracks changes to files for backup and search tools.
• Other system services: tools like Microsoft Backup, Windows Defender, and some third-party backup software use this folder for their own metadata.

Because the folder is protected, Windows deliberately denies even administrators full access by default. This is a security measure: if a user or malware could freely edit these files, they could corrupt restore points or hide malicious changes to the system.

Why You Can’t Open It Normally

When you double-click the folder in File Explorer (after enabling “Show hidden files”), you get an error: “C:\System Volume Information is not accessible. Access is denied.” This happens because the folder’s security descriptor grants only the SYSTEM account full control. Even an administrator account is treated as a normal user for this folder unless you explicitly take ownership and add permissions.

Windows also hides it by default. To even see it, you must go to View > Options > Change folder and search options > View tab, then uncheck “Hide protected operating system files” and select “Show hidden files and folders.” After that, the folder appears on the drive root, but opening it still fails until you change its permissions.

How to Access It Safely (Step-by-Step)

There are two legitimate methods to access the folder. Both require you to be logged in as an administrator. Do not use these steps on a drive that belongs to another Windows installation (for example, a drive pulled from another PC) unless you are sure you have the right to modify it.

Method 1: Take Ownership via Properties (GUI)

1. Open File Explorer and navigate to the drive root (e.g., C:\).
2. If you don’t see the folder, enable hidden files as described above.
3. Right-click System Volume Information and select Properties.
4. Go to the Security tab and click Advanced.
5. Next to “Owner,” click Change.
6. Type your username (or “Administrators”) and click Check Names, then OK.
7. Check “Replace owner on subcontainers and objects” and click OK.
8. Back in the Security tab, click Edit, then Add your user, and grant Full control (or just “Read” if you only want to look).
9. Click OK on all dialogs. You can now open the folder.

Method 2: Command Line (Faster)

1. Open Command Prompt or PowerShell as Administrator (right-click Start > “Terminal (Admin)”).
2. Run the following command to take ownership (replace C: with your drive letter):
   takeown /f "C:\System Volume Information" /r /d y
3. Then grant your account full control:
   icacls "C:\System Volume Information" /grant "%USERNAME%":F /t
4. Close the window. The folder is now accessible from File Explorer.

After you finish, it is strongly recommended to revert the permissions back to the default (SYSTEM only) to keep Windows protected. You can do this by running icacls "C:\System Volume Information" /reset /t from an admin prompt.

What to Do If You Still Get “Access Denied”

Even after following the steps above, you may still see “Access is denied” when trying to open the folder. Common reasons and fixes:

• You are not actually an administrator. Check by typing net user %username% in Command Prompt — if the account is not in the Administrators group, you cannot change permissions. Use a real admin account.
• The drive is not NTFS. If the drive is FAT32 or exFAT, the folder may not exist at all, or permissions behave differently. Check with fsutil fsinfo ntfsinfo C:.
• Windows is still using the folder. Some files inside are locked by services. Close all programs and try again. If the folder is on the system drive, you may need to boot into Safe Mode.
• You took ownership but did not replace the owner on subfolders. Run the takeown command again with /r to apply to all child objects.
• Third-party security software is blocking access. Temporarily disable real-time protection, then retry.

Common Misconceptions and Safety Notes

Many users think the folder is malware because it appears suddenly or takes up a lot of space. It is not malware — but malware can hide inside it, so if you see unusual files with random names, scan them with Windows Defender or a reputable antivirus before deleting anything.

Deleting the entire folder is not recommended. If you delete it, Windows will recreate it, but you will lose all restore points and previous versions of files. To free up space, use the built-in tools instead:

• Open Disk Cleanup (type “cleanmgr” in Start), select the drive, then Clean up system files. Choose “Previous Windows installations” or “System Restore and Shadow Copies” to remove old backups.
• Use System Protection (Control Panel > System > System Protection) to adjust the disk space allocated to restore points, or click Delete to remove all restore points for that drive.
• Use Storage Sense (Settings > System > Storage) to clean up temporary files, but note it does not directly manage SVI.

How to View or Restore Previous Versions Without Opening the Folder

You don’t need to access the folder to use its contents. To restore an older version of a file:

1. Right-click the file or folder in File Explorer.
2. Select Properties and go to the Previous Versions tab.
3. Choose a version from the list and click Restore (or Copy… to save it elsewhere).

To create a restore point manually: go to Control Panel > System > System Protection, select the drive, click Create, and follow the prompts. This is the safest way to interact with the folder without ever changing its permissions.

Frequently Asked Questions

Can I delete the System Volume Information folder?

You can, but you shouldn’t. Windows will recreate it immediately, and you will lose all restore points and previous versions of files. If you need space, use Disk Cleanup or System Protection settings to shrink its size instead of deleting it.

Why is the folder so large?

The size depends on how much space you have allocated for System Restore (usually 1% to 5% of the drive) and how many shadow copies exist. Large files that change frequently, like databases or virtual machines, can cause the folder to grow quickly. You can limit its size in System Protection settings.

Is it safe to grant my user account full control?

It is safe temporarily, but leaving it open reduces Windows’ protection. If you give full control, malware could tamper with restore points. After you finish, reset the permissions to the default (SYSTEM only) using the icacls /reset command.

Why does the folder appear on my external drive?

Windows creates SVI on any NTFS drive that has System Protection enabled or that you have used with File History or backup tools. To remove it from an external drive, turn off System Protection for that drive in System Protection settings, then delete the folder — it will not be recreated unless you re-enable protection.

Does the folder contain my personal files?

No. It contains system metadata and snapshots, not your actual documents. Your personal files remain in their normal locations. The “Previous Versions” feature reads from SVI, but the original files are not stored there.

What if I see a file named “MountPointManagerRemoteDatabase” inside?

That is a normal system file used by the Volume Shadow Copy service. Do not delete it. Other files like “{3808876b-c176-4e48-b7ae-04046e6cc752}” are also standard system components. Only worry if you see executable files (.exe) or scripts there — those are unusual and should be scanned.

Related

• EUFA3 Epic Games Error: Fixes That Work
• Run Chrome Dev & Beta with Docker Selenium
• Android as Second Display: Setup Guide