What the heck is winnt\csc\?

NTDEV
1

I have noticed that windows 2000 won’t power down my boot drive even when
I’m not using it for a while. I used the filemon utility from
www.sysinternals.com to track down running programs that can’t keep their
mitts off the disk, but there is one left that I can’t figure out or get
rid of: the system process opens a file, sets it to be compressed, and
then winlogon.exe reads and closes it. The file is
c:\winnt\CSC\00000001. Does anyone know what the heck this file ( and the
other files in the csc directory for that matter ) are, and why the system
keeps touching them?

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Drivers may not let a device be powered down if
IRP_MN_DEVICE_USAGE_NOTIFICATION has been sent to indicate the device
is used for a hibernation or crash dump file. Or so I’ve read. Got
one of those on your boot drive?

Dave Cox
Hewlett-Packard Co.
SSO/OVBU/SRM (Santa Barbara)
https://ecardfile.com/id/Dave+Cox

-----Original Message-----
From: Phillip Susi [mailto:xxxxx@iag.net]
Sent: Monday, July 09, 2001 4:25 PM
To: NT Developers Interest List
Subject: [ntdev] What the heck is winnt\csc?

I have noticed that windows 2000 won’t power down my boot
drive even when
I’m not using it for a while. I used the filemon utility from
www.sysinternals.com to track down running programs that
can’t keep their
mitts off the disk, but there is one left that I can’t figure
out or get
rid of: the system process opens a file, sets it to be
compressed, and
then winlogon.exe reads and closes it. The file is
c:\winnt\CSC\00000001. Does anyone know what the heck this
file ( and the
other files in the csc directory for that matter ) are, and
why the system
keeps touching them?

You are currently subscribed to ntdev as: david_cox2@hp.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Nope, but as I said before, winlogon.exe keeps touching this file in
winnt\csc. It doesn’t even write to it, just keeps setting the compression
flag, which I guess causes an update to the last access time stamp, so the
system writes to the directory and the mft record for the file ( and of
course the log file ). Also, on my laptop, the hard drive will power down
when I hit the key to turn off the back light and hard drive, even though
it has a hibernation file on it, however it usually comes back on within a
min or so I guess because something touches the drive. I’ve not tried to
look into it with filemon on that machine.

At 06:00 PM 7/9/2001 -0700, you wrote:

Drivers may not let a device be powered down if
IRP_MN_DEVICE_USAGE_NOTIFICATION has been sent to indicate the device
is used for a hibernation or crash dump file. Or so I’ve read. Got
one of those on your boot drive?

Dave Cox
Hewlett-Packard Co.
SSO/OVBU/SRM (Santa Barbara)
https://ecardfile.com/id/Dave+Cox

> -----Original Message-----
> From: Phillip Susi [mailto:xxxxx@iag.net]
> Sent: Monday, July 09, 2001 4:25 PM
> To: NT Developers Interest List
> Subject: [ntdev] What the heck is winnt\csc?
>
>
> I have noticed that windows 2000 won’t power down my boot
> drive even when
> I’m not using it for a while. I used the filemon utility from
> www.sysinternals.com to track down running programs that
> can’t keep their
> mitts off the disk, but there is one left that I can’t figure
> out or get
> rid of: the system process opens a file, sets it to be
> compressed, and
> then winlogon.exe reads and closes it. The file is
> c:\winnt\CSC\00000001. Does anyone know what the heck this
> file ( and the
> other files in the csc directory for that matter ) are, and
> why the system
> keeps touching them?

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

> then winlogon.exe reads and closes it. The file is

c:\winnt\CSC\00000001. Does anyone know what the heck this file ( and the
other files in the csc directory for that matter ) are, and why the system
keeps touching them?

Client Side Caching.
A feature of MRXSMB which allows to access files from the unavailable
fileserver by caching files on the client’s drive.

Max

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

Anything having to do with WinLogon always gets my attention… so I did a
little digging and noticed that my NT PDC doesn’t have the aforementioned
%systemroot%/CSC directory, yet my Workstation does. A google search turned
up this reference:

http://www.elementkjournals.com/w2k/0101/w2k0111.htm

From which I quote: “The Offline Files folder is actually a series of
folders in the %SystemRoot%\CSC folder.”

From that I’d guess that you might need to disable “Offline Files” and give
it another try.

Now that I think about it, I had all kinds of trouble with Office 2000 on my
IBM Thinkpad when I tried to enter hibernation and Word had a document on
the network open. The solution was to install SP1 of office, (not Win2k???)
and all should be better.

CSC seems to stand for Client Side Cache in most of the other references
that Google turned up.

ERX

PS:
I dumped a couple of these files from my workstation with a little utility I
wrote and they mean absolutely nothing to me. Do they mean anything to
anyone else?

/00000002
Decimal…
1 000 000 032 000 000 000 000 000 064 000 000 000 005 000 001 000
2 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
3 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
4 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
5

Hex…
1 00 00 20 00 00 00 00 00 40 00 00 00 05 00 01 00
2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
5

ASCII…
1 @ ? ?
2
3
4
5

/00000001
Decimal…
1 000 000 204 000 000 000 000 000 064 000 000 000 005 000 001 000
2 000 000 000 000 076 115 202 012 000 000 000 000 000 000 000 000
3 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
4 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
5

Hex…
1 00 00 cc 00 00 00 00 00 40 00 00 00 05 00 01 00
2 00 00 00 00 4c 73 ca 0c 00 00 00 00 00 00 00 00
3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
5

ASCII…
1 | @ ? ?
2 L s - ?
3
4
5

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Phillip Susi
Sent: Monday, July 09, 2001 7:25 PM
To: NT Developers Interest List
Subject: [ntdev] What the heck is winnt\csc?

I have noticed that windows 2000 won’t power down my boot
drive even when
I’m not using it for a while. I used the filemon utility from
www.sysinternals.com to track down running programs that can’t
keep their
mitts off the disk, but there is one left that I can’t figure
out or get
rid of: the system process opens a file, sets it to be
compressed, and
then winlogon.exe reads and closes it. The file is
c:\winnt\CSC\00000001. Does anyone know what the heck this
file ( and the
other files in the csc directory for that matter ) are, and
why the system
keeps touching them?

You are currently subscribed to ntdev as: xxxxx@spinnakernet.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com