NTFS: files can be moved but not deleted

[pdario]

Hello, I hope this is the right forum where to ask, but I have a very weird behaviour on one of my NTFS drive.

Simply put, I have a couple of file that I can move and rename, but I can't delete them!
Windows reports error as if they were used by other processes, but this is not che case (other wise I would not be able to move and rename).

I took ownership of the file, I gave full control to Everyone, nothing changed.

I did a boot-time CHKDSK, nothing found.

Please help me understand what is happening here!

Thank you!

[LarrySabo]

What happens when you boot a Linux live CD and use that to delete the files?

[pdario]

That's a thing I thought to do, but it is a 2-in-1 tablet, so I have first to understand how to boot from an USB Key...

Any other test I could to without changing boot drive?

[jerovsek]

pdario,

you can check with this software http://lockhunter.com/download.htm
or search on filehippo.com for file unlock tool

sometimes device restart fix the problem

[pdario]

pdario,

you can check with this software http://lockhunter.com/download.htm
or search on filehippo.com for file unlock tool

sometimes device restart fix the problem

Thank you, but I can add that I searched with Sysinternal Process Explorer and it does not show any process owning the files; does this tool do the same?

I also restarted SEVERAL times!

[pdario]

I doubt it is a Virus: the tablet is basically new, I just installed Windows updates and a couple of well known apps.

Plus it uses an emmc drive, will MHDD work on it?

[LarrySabo]

You haven't said what using a Linux live CD does yet but are still looking for answers?

[pdario]

Yes, first I'm trying to understand what happens within Windows, second I need to understand how to boot from an USB Key...

[fzabkar]

Perhaps you could examine "good" and "bad" files in a disc editor, eg DMDE.

http://dmde.com/

Open the NTFS volume.
Expand the Root.
Locate your file(s).
d-click the file(s)
The files should be listed in the top RH pane.
r-click file and select Open MFT File (Hex Editor)
The bottom RH pane should now show $STANDARD_INFORMATION, $FILE_NAME, $DATA.
d-click $STANDARD_INFORMATION
offset 020: should show you the "DOS File Permissions"
Compare these permission settings against "good" files

Reference:
http://www.cse.scu.edu/~tschwarz/coen252_07Fall/Lectures/NTFS.html

[pdario]

Well, the tablet is knew, I hope it is not an hardware fault.

The last message seems interesting, even though a little tricky: I have to study it.

Meanwhile I moved the whole directory containing the two files out of the way (I put it in the user temp dir).