Showing results for 
Search instead for 
Did you mean: 

800 Series - Hidden IOS Images blocking flash:/

Dear Community,

I have a strange behavoir on many of our Cisco 800 series routers. Images are stored inside flash, but I cannot see them and even formating does not remove them. But it is still booting from flash. You can see the files inside rommon only. 

Secure-Boot not set (see output). 

Do you know how to delete these hidden images? From rommon not possible i think and flash is not removeable. 


Router#show version
Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.1(4)M5, RELEASE SOFTWARE (fc1)
Technical Support:
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 04-Sep-12 21:52 by prod_rel_team

ROM: System Bootstrap, Version 15.1(4r)M, RELEASE SOFTWARE (fc1)

Router uptime is 4 minutes
System image file is "flash:c800-universalk9-mz.SPA.151-4.M5.bin"

Cisco C886VA-W-E-K9 (revision 1.0) with 354304K/38912K bytes of memory.
1 DSL controller
1 Ethernet interface
4 FastEthernet interfaces
1 Gigabit Ethernet interface
1 ISDN Basic Rate interface
1 ATM interface
1 terminal line
1 Virtual Private Network (VPN) Module
1 cisco Embedded AP (s)
DRAM configuration is 32 bits wide
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash (Read/Write)

Configuration register is 0x2102

Router#show secure bootset
%IOS image and configuration resilience is not active

Router#dir flash:
Directory of flash:/

No files in directory

200986624 bytes total (82407424 bytes free)

Show file systems

Mark Malone
VIP Mentor


does it show anything if you just run dir for falsh 1 and 0 too  , bit strange that show file system output with the 2 flash names I checked my 800 series and they all look exactly the same as below

File Systems:

       Size(b)       Free(b)      Type  Flags  Prefixes
             -             -    opaque     rw   archive:
             -             -    opaque     rw   system:
             -             -    opaque     rw   tmpsys:
             -             -    opaque     rw   null:
             -             -   network     rw   tftp:
        262136        228286     nvram     rw   nvram:
*    128286720      42356736      disk     rw   flash:#
             -             -    opaque     wo   syslog:
             -             -    opaque     ro   xmodem:
             -             -    opaque     ro   ymodem:
             -             -   network     rw   rcp:
             -             -   network     rw   http:
             -             -   network     rw   ftp:
             -             -   network     rw   scp:
             -             -    opaque     ro   tar:
             -             -   network     rw   https:
             -             -    opaque     ro   cns:

is there any boot parameters configured run | I boot

you could try this too if you know the name of the files

delete /force /recursive flash:c880data-universalk9-mz.154-3.M7.bin

Thanks for your reply!

- No boot parameters configured

- I know the name of the blocking files from rommon, but it shows "file not found" when trying to delete from "enable mode". deleting from rommon not possible (no command for that). 

- flash:1: is Wireless Access Point directory. No problem here.

- flash:0: is normal flash directory. Same as "dir flash:"

So still no solution here.


you should be able to delete in rommon with delete flash:.......

it sounds as if flash is corrupted , is the router under support you could ask TAC to replace it , I have had issues with flash on 800 series before going , got them replaced just by showing TAC flash was no longer readable

or if it has USB you could setup the files to boot from there instead so you have something accessible to go from


ROM Monitor Commands

Enter ? or help at the ROM monitor prompt to display a list of available commands and options, as follows:

rommon 1 > ?

alias					set and display aliases command

boot					boot up an external process

break					set/show/clear the breakpoint

confreg					configuration register utility

cont					continue executing a downloaded image

context					display the context of a loaded image

cookie					display contents of cookie PROM in hex

copy					Copy a file-copy [-b <buffer_size>] <src_file> <dst_file>

delete					Delete file(s)-delete <filenames ...>

dir					List files in directories-dir <directory>

dis					display instruction stream

dnld					serial download a program module

format					Format a filesystem-format <filessystem>

frame					print out a selected stack frame

fsck					Check filesystem consistency-fsck <filesystem>

help					monitor builtin command help

history					monitor command history

meminfo					main memory information

mkdir					Create dir(s)-mkdir <dirnames ...>

more					Concatenate (type) file(s)-cat <filenames ...>

rename					Rename a file-rename <old_name> <new_name>

repeat					repeat a monitor command

reset					system reset

rmdir					Remove a directory

set					display the monitor variables

stack					produce a stack trace

sync					write monitor environment to NVRAM

sysret					print out info from last system return

tftpdnld					tftp image download

unalias					unset an alias

unset					unset a monitor variable

xmodem					x/ymodem image download

Dear Mark,

unfortunately this is not the case on my router. The following commands are available from rommon:

alias               set and display aliases command

boot                boot up an external process

break               set/show/clear the breakpoint

confreg             configuration register utility

cont                continue executing a downloaded image

context             display the context of a loaded image

cookie              display contents of motherboard cookie PROM in hex

dev                 list the device table

dir                 list files in file system

frame               print out a selected stack frame

help                monitor builtin command help

history             monitor command history

iomemset            set IO memory percent

meminfo             main memory information

repeat              repeat a monitor command

reset               system reset

rommon-pref         Select ROMMON

set                 display the monitor variables

showmon             display currently selected ROM monitor

stack               produce a stack trace

sync                write monitor environment to NVRAM

sysret              print out info from last system return

tftpdnld            tftp image download

unalias             unset an alias

unset               unset a monitor variable

So still no explainaition why nearly all of our 300 routers dont show the IOS-image in IOS mode, deleting/formatting does not erase flash, and files are only visible from rommon. And no way to delete them from rommon.

at this stage I would open a TAC case under one of the devices with Cisco direct

If you "fsck flash:" (from IOS), does it change anything?  Does "dir /all" report anything different from just "dir"?

Dear Iulian,

thanks for your reply. We ran the commands with the following output, but no improvement:

Router#fsck flash:
Starting File System integrity check
NOTE: File System will be deinited and later rebuilt

Starting partition 0 Analysis
Boot Sector/Boot Parameter Block check ...[Passed]
DIB not present
DIB & Monlib check ...[Passed]
Partition Init check ...[Passed]
Directory entries check ...[Passed]
fsck of flash: complete

Router#dir /all flash:
Directory of flash:/

5 -rw- 660 Aug 3 2017 09:31:48 +02:00 vlan.dat

200986624 bytes total (82288640 bytes free)

Router#dir /all
Directory of flash:/

5 -rw- 660 Aug 3 2017 09:31:48 +02:00 vlan.dat

200986624 bytes total (82288640 bytes free)