Win7 Inside Out – WinSxS

Line Break

Author: Martin Zugec (31 Articles)

 

I promised some time ago that I will post 100 tips and tricks about Windows 7. Biggest problem I encountered was the fact that some tips were about how Windows7 works internally, while others could be described in 1 line (small tips). I decided that I will call these articles Win7 Inside Out. Part 1 is explaining some details about WinSxS, hope so you will find it interesting.

What is most common complain about Windows 7 or Windows Vista? Based on my investigation, it is mysterious WinSxS folder – most people complains that it is huge and instantly growing.

First, let me answer very simple question – is WinSxS really needed and is it clever solution, or just stupid workaround? My answer is very simple – YES, WinSxS is very clever solution and YES, we really need it in order to prevent DLL hell scenarios that we encountered in the past.

One small mistake Microsoft made while planning and designing SxS technology was that they didn’t think about popularity of upcoming netbooks (who could predict that?) and small but fast SSD drives. Currently, only real complain about WinSxS is the fact that you cannot change it’s location and it must reside on HDD where Windows is installed.

Why do we need WinSxS?

For non-programmers, it can be useful to describe functionality of libraries first. According to wikipedia, a library is a collection of subroutines or classes used to develop a software. To simplify it – if routine to copy one file consists of 50 lines of code, you don’t want to write it over and over again, but you rather create function called CopyFile and call this functions (so you use 1 line instead of 50). This is also very important from security perspective – if you discover bug in your routine, you need to fix it just once and it’s fixed for all programs that are using this routine.

In general, we recognize shared and private libraries – shared library needs to be on system just once, while private library needs to be added to every program that needs it. In past, to reduce size, we preferred mostly shared libraries, where multiple programs use single library:

image

Centralized approach

Well, that sounds like a brilliant idea – in theory. In real life, this just led to problem called DLL hell – to avoid damage to my brain, I won’t write details about it, I am sure you can find tons of complains on Google (915k results). So IT world turned other direction – from strictly centralized structure to decentralized structure:

image

Decentralized approach

On one hand, DLL hell issue was solved, or wasn’t it? Well, in fact we end up in situation that could be called DLL Hell 2 – it was hell to keep libraries up to date and from security perspective, it was disaster. Not talking about fact that applications were getting very huge in size – much bigger than our WinSxS folder. In my opinion however, it was still better than strictly centralized  structure.

There were many different workarounds and ideas – using .LOCAL files, manifests files, however WinSxS is truly solution worthy software giant like Microsoft.

So what is WinSxS about? It is central managed store for libraries in very clear structure.

 

Why is it so big?

First, let me tell you something – WinSxS is not that big at all. WinSxS is core of Windows operating system – and on my computer (Windows7), it’s 1.3 GB in size.

image

Hey, but doesn’t that dialog say that it is 5.76 GB? Answer is little bit more complicated – yes and no. WinSxS is using technology called hardlinks heavily – hardlink is according to Wikipedia

directory entry that associates a name with a file on a file system

You can have multiple hardlinks pointing to same place on file system – what it means is that you see multiple names (files), however they refer to same location.

Very common question is why then explorer doesn’t display real size? Answer is pretty simple – all hardlinks are equivalent (which is difference between hardlink and symbolic link), therefore you don’t have master (source) file and link (target) file. If you want to see details about your hardlinks, I can recommend you utility called Hardlink Scanner (both 32 bit and 64 bit) – there is no built-in tool in Windows to see hardlinks configuration.

image

Difference between hard links and symbolic links

As you can see in above picture – when we use symbolic links, we always have one “master” and one or multiple “slaves” (imagine that slave in .lnk file and master is .exe file), while with hardlinks all links are masters and changing any one of them will automatically change underlying data for all of them.

What it means when we talk about SxS is that most files in WinSxS folder are in fact stored somewhere else. Based on my experiments, almost 80% of files in WinSxS folder are just referencing to existing location (they are just hardlinks to other files). Talking about size of WinSxS folder, on my computer, 4.8 GB were simply linked files, while 1.3 GB were regular files. What is also very important to mention is that Windows is NOT only product that is using WinSxS – many other applications are also, so with bigger Windows folder, your Program Files size can be reduced. The real benefit of SxS technology is therefore pretty much hidden. Based on quick scan, I can see that there are 500 MB of hardlinks stored in my Program Files (30 GB in size).

Can I reduce it?

Well, that’s pretty hard question. Simple answer is no – mostly caused by the fact that removing files from WinSxS simply won’t give you more space (as long as there is any other hardlink pointing to that specific resource).

Uninstalling language packs

There is however very easy trick how you can reduce size of WinSxS folder – by removing language packs. If you have a look at structure of folders in WinSxS folder, you can see naming pattern there:
proc-arch_name_public-key-token_version_culture_hash

As you can see, part of folder name is culture. When you install Windows 7, you can see that multiple language packs are available as optional download:

image

Every one of them will add new resources to WinSxS folder – on average, it’s around 300 MB per language package. If you install all of them, it’s around 10 GB of data. So easiest way to reduce size of WinSxS is to simply uninstall additional language packs. Easiest way is to run lpksetup.exe – this will open dialog “Install or uninstall display languages”:

image

Be aware that it takes some time after uninstallation before WinSxS size is reduced!

My results:

EN + CZ:

Full size: 6.45 GB
Hard links: 4.98 GB
Normal files: 1.47 GB

EN only:

Full size: 6.18 GB
Hard links: 4.80 GB
Normal files: 1.37 GB

 

Deleting Windows Update cache

Second trick you can use is to delete Windows Update cache of manifest files. This file can be found in C:\Windows\WinSxS\ManifestCache folder – usually it’s not worth it, because it is smaller than 200 MB.

Uninstall some applications

As I explained before, some applications may use WinSxS. Usual recommendation is to uninstall some applications – but question is which ones? You can use Hardlink Scanner that was mentioned before to help you.

First find out which folders are biggest – you can use for example WinDirStat to find them.

Then you run Hardlink Scanner with /F switch against files in that directory. You will see something like this in output:

Scanning directories and files…..

Breakdown for "c:\Windows\winsxs\amd64_1394.inf.resources_31bf3856ad364e35_6.1.7
600.16385_en-us_beafdf583b909e3f\1394.inf_loc"
=========================================================
  Unique ID:     100000000687e
  Hardlink count:            2
  Naive file size:       7,176 bytes
  Unique file size:      3,588 bytes
  Kind of file:         normal
  Filenames:
    \Windows\System32\DriverStore\en-US\1394.inf_loc
\Windows\winsxs\amd64_1394.inf.resources_31bf3856ad364e35_6.1.7600.16385
_en-us_beafdf583b909e3f\1394.inf_loc

 

Important part is Filenames – there you can see that this file is both the one in WinSxS and C:\Windows\System32\DriverStore\en-US\1394.inf_loc. That gives you an idea where is this component being used.

 

…to be continued -  this was first part of our article. This part describes WinSxS in more user-friendly way. In next part, we will go deeper into SxS – how it works, if you can move it to other disk and how can you work with it.

11 thoughts on “Win7 Inside Out – WinSxS”

  1. Hi Mahendra,

    working on it, I was waiting if someone asks for second part :) In next part, I would like to focus on internals and also tools like SxSTrace etc, is there anything in particular you would like to learn?

    Martin

  2. It makes a little more sense now, but still it is a little big!
    When will we get part 2?

    How do I interpret Hardlink Scanner output?

  3. Hi Ulrich,

    unfortunately, part 2 was delayed – I am leaving for holiday for 1 month now and then I am starting my own company :(

    However don’t be afraid, it will be definitely done!

    Martin

  4. Hi, I like this article and appreciate the work you put into making the mysteries of Windows 7 less confusing for we who don’t know much about computers at all. However the Hardlink Scanner 64 bit link you provide has a virus. I downloaded it just now and Norton found the WS.Reputation.1 virus. Just thought you would want to know.

  5. This is the first real answer I’ve found to the Winsxs issue and thank you for breaking it down in a way that is easily understandable. I have this friend with a lap top and his Winsxs file is 16.5 gigs doesn’t help he only has 2 32.5 hard drives(why? I don’t know it’s really stupid) Thank you for part 1 and I can’t wait for part 2.

  6. Thank you very much for this. Took some digging to get to your post but was worth it. You are very good at explaining and shows your knowledge of windows.

Leave a Reply

Your email address will not be published. Required fields are marked *


*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>