[German]I'm posting a problem here in the blog that a reader reported by email. The Windows user regularly receives files with the file name extension .checkpoint and (presumably) a UUID code as the file name in the Windows System32 folder. This is a Windows 10 22H2 system and the files can also be deleted. Is there an explanation, what these files are meaning?
Advertising
Rolf's email reached me last week (July 11, 2023), so I haven't had a chance to process it yet. Rolf wrote:
Data garbage from Microsoft
Hello Mr. Born,
Today I (as a regular Borncity reader) have a small but annoying problem:
Every few days I delete hundreds of small files from a subfolder of Windows/System32, all of which have names along the lines of.
{863B11B7-24A2-49DF-8B57-B25FE5628392}.checkpoint
On some days there are over 30 of them, always at (almost) the same time.
I have attached two screenshots here.
Do you have any idea what could be behind this and how to fix it? Obviously a Microsoft service is going crazy.
(System is Windows 10 22H2)
I discovered this by chance. Should I now regularly check my PC for such garbage dumps?
The characters in front of the file name extension look like a UUID code to me, but the value changes. The following screenshot shows the folder window in question (click on it to enlarge it).
I did a quick search on my Windows 10 system – no such files are found there. My search on the internet didn't really produce any useful hits either. I then had the reader send me such .checkpoint files. They are simple text files – below is an excerpt from the content.
{"CreateOptions":{"UserSID":"S-1-5-18",
"FulfillmentPluginId":"WU","FulfillmentData": "{\"ProductId\":\"9WZDNCRFHWKN\",
\"WuBundleId\":\"c5845bef-3097-4707-84b0-c462f96be157\",
\"WuCategoryId\":\"9f03273f-fe0b-4ed8-9bc8-c2f256375490\",
\"PackageFamilyName\":\"Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\",
\"SkuId\":\"0010\",\"Content\":null,\"PackageFeatures\":null}",
"WorkPropertiesJSON":"{\"UserIdentityInfo\":\"\",
\"CallerApplicationId\":\"ScanForUpdates\",\"IsInteractive\":false,
\"AllowForcedAppRestart\":false,\"AutomaticallyDownloadAndInstallUpdateIfFound\":false}"},
"WorkState":{"CorrelationVector":"0fRylxy9L0izIU4p.1.0",
"CheckpointDataBlob":"ewAiAEkAbgBzAHQAYQBsAGwAVAB5AHAAZQAiADoAIgBVAHAAZABhAHQAZQAiACwAIgBBAHUAdABvAG0AYQB0AGkAYwBhAGwAbAB5AEQAbwB3AG4AbABvAGEAZABBAG4AZABJAG4AcwB0AGEAbABsAFUAcABkAGEAdABlAEkAZgBGAG8AdQBuAGQAIgA6AGYAYQBsAHMAZQAsACIAQQBsAGwAbwB3AEMAYQBjAGgAZQBkAFIAZQBzAHUAbAB0ACIAOgBmAGEAbABzAGUALAAiAEYAdQBsAGYAaQBsAGwAbQBlAG4AdABEAGEAdABhACIAOgBbAF0AfQA="},"QueueState":{"Id":"{0ACE1861-9621-4F52-9177-AE3BD89A2D8F}",
"QueueState":0,"SystemAttemptCount":0,"UserAttemptCount":0,
"LastModifiedTimestamp":"2023-07-10T21:07:31+02:00",
"CreationTimestamp":"2023-07-10T21:07:31+02:00","ErrorCode":0,"ExtendedErrorCode":0},
"ProgressState":{"ProgressStage":0,"TotalPercentComplete":0,"TotalUnitsForStage":0,
"CompletedUnitsForStage":0},"MutableProperties":{"LaunchAfterInstall":false,
"PinToDesktopAfterInstall":false,"PinToStartAfterInstall":false,
"PinToTaskbarAfterInstall":false,"InProgressNotificationMode":0,
"CompletedNotificationMode":0},
"PackageFamilyName":"Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe"}The entries are readable in plain text and I once highlighted a string that points to the Windows Sound Recorder as the author. However, I have seen other files with names such as People etc. in them. The .checkpoint file then stores various information in plain text as well as a blob (binary large object) as a string.
Advertising
All in all, this is very obscure, as the files are stored in the Windows system32 subfolder and not in the user profile. On the other hand, based on the file content, I would rule out an infection with malware or a third-party package as the cause. Do any of you have these files on your system or even an explanation for these files?
Addendum 2025: It is possible that the files are left from an experiment by Microsoft in preparation for the Checkpoint Cumulative Updates (see Windows 11 23H2 is now generally available – new "Checkpoint" updates announced).
Advertising
