Fix 0x00000113: Extended Attributes Buffer Too Small

You hit this error, and it's annoying

You're copying a file or running some tool, and Windows spits out ERROR_EAS_DIDNT_FIT (0x00000113). The message says extended attributes didn't fit in the buffer. I'll show you the direct fix first, then explain what's actually happening under the hood.

The immediate fix: clear the extended attributes

Most of the time the problem is a single file with corrupted or bloated EAs. Here's how to kill them:

Open Command Prompt as Administrator (Win+X, then A or Terminal Admin).
Run:
```
fsutil usn deletejournal /d C:
```
— this deletes the USN journal which stores EA metadata. Don't worry, Windows rebuilds it automatically.
Then clear the EAs on the problematic file(s). Navigate to the folder containing the error, and run:
```
attrib -r *.* /s
compact /c /s *.*
```
The compact /c command forces the file system to recompress files and discard their old EA streams. This part is key — it's not actually about compression; it's about stripping the attributes.
If the error persists, use Microsoft's Streams utility (from Sysinternals) to delete all NTFS alternate data streams:
```
streams -d *.*
```
That kills every EA attached to files in the current folder.

After this, copy or run the file again. It should work.

Why this works — the EA buffer size problem

What's actually happening here is that NTFS stores file metadata in two places: the main file attributes (name, size, timestamps) and extended attributes (EAs) — arbitrary key-value pairs used by apps like Windows Search, some backup tools, or legacy DOS programs. Each EA entry is small, but they can accumulate.

When an app calls GetFileAttributesEx() with a buffer of a fixed size (usually 64KB for EAs), and the total EA data on that file exceeds that buffer, you get 0x00000113. The app is saying “I can't fit all this stuff into my allocated bucket.” The fix works because we're removing the EAs entirely, so the buffer is always big enough.

Note: This is not the same as “attribute list overflow” (0x0000010C). That's a different corruption in the MFT. Here, the error is purely about buffer size.

The reason step 3 works is that compact /c forces the file system to rewrite the file's data and attributes, which drops any orphaned or oversized EA streams. It's a side effect of the compression API, not the intended use — but it's reliable.

Less common variations

Not every case is a single bad file. Here are edge cases I've seen:

App-specific EA overflow: Some old Windows backup software (like NTBackup or some Veritas tools) writes huge EA blocks during restore. If the error occurs during a restore from backup, that's the cause. The fix: restore without EAs (most tools have a checkbox “restore without security or extended attributes”).
File system corruption: If chkdsk /f C: reports “cleaning up attribute records” after you run it, the EA metadata itself got corrupted. Run chkdsk, then try the fix above again. Sometimes the EAs are so fragmented they exceed the buffer size calculation.
Virtual machine disk images: On Hyper-V or VMWare, if you mount a VHDX with EAs from a different OS (Linux ext4-with-EA, for example), Windows can get confused. The EA format is nonstandard, and the buffer size check fails. Only fix: mount the image read-only and copy files out without EAs.

How to prevent this long-term

This error is rare, but you can avoid it with three habits:

Don't use apps that write custom EAs. Windows Search writes them, but they're small. Third-party file managers that add tags directly into NTFS EAs (like some old versions of Total Commander plugins) are the usual culprits. Uninstall them.
Keep your disk healthy. Run chkdsk /f quarterly. A clean MFT means fewer fragmented attribute lists.
When copying between drives, use Robocopy with the /COPY:DAT flag (not /COPY:DATS). That copies data, attributes, and timestamps — but NOT security or EAs. You lose ACLs, but you also dodge this error entirely.

If you're still seeing 0x00000113 after all that, check the Event Viewer for NTFS warnings with Event ID 137. That points to a failing disk sector — and then the fix is “replace the drive.”