What is taking up all my disk space?

Question

I have a server (Windows Server 2008 R2 SP1), which is reporting only 2 GB free space on C drive. But when I run WinDirStat or Treesize over the disk, both of them say that only 21 G is being used out of 40 GB.

I have run the Disk Cleanup tool to remove windows update backup files from winsxs folder.

I tried running "vssadmin List Shadows" on a command line, and I got the following result:

No items found that satisfy the query.

I have made sure that System files are not hidden as well as protected OS files.

If I am only using 21 GB out of 40 GB, I should have roughly 19 GB free space. Where is the other 17 GB? What can I do to find what is using it up?

Windows says I have 2.13 GB free space

And that I am using 37 GB

But Treesize says I am only using 21 GB

can you tel me your chkdsk result ? i have almost same trouble: http://serverfault.com/questions/671582/windows-2008-40-gb-inaccessible-space-used-by-system-where check the "used by system" section — Froggiz, Feb 26 '15 at 17:10
I didn't use chkdsk. I used SpaceSniffer to find out what was using up all the disk space - it was log files in the C:\Windows\system32 folder. — MrGordonz, Feb 27 '15 at 21:34

score 2 · Answer 1 · answered Oct 03 '14 at 17:16

2

I found the cause of the problem - I used a tool called SpaceSniffer. Turns out there was about 19 GB of log files in the C:\Windows\system32 folder. I have no idea why they didn't show up in Treesize or WinDirStat, but regardless of why, I found the culprit. I have now deleted those files and voilà - 22 GB free space!

answered Oct 03 '14 at 17:16

MrGordonz

51
1
2
5

3

Were you running those tools elevated ("Run as Administrator")? Not running tools like that elevated is typically the reason why they don't show complete data. – Evan Anderson Oct 06 '14 at 18:43
That may be it - I don't think I did run those tool elevated. – MrGordonz Oct 07 '14 at 21:48

score 0 · Answer 2 · answered Oct 03 '14 at 09:35

It might be trashes from users, or System Restore information, or something similar. WinDirStat or TreeSize wont be able to access those directories, at least if you don't run them with elevated privileges. And even then, you can't enter System Volume Information (that contains among others the restore points) because even not the administrator account is able to see it. On older versions of Windows there was a trick (using AT /INTERACTIVE) to run a program as the local system account so it gets access even to those protected locations, but I don't know a way to run an interactive program with such privileges on Windows 2008. One possibility would be to mount the partition (in read-only, just to be sure) from a Linux live CD, as the Linux NTFS drivers ignore all access control, and using the du command to check what takes space.

Another reason for what you observe could be that something is storing data on NTFS alternate data streams (see for example http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx), I don't know whether TreeSize or WinDirStat are able to report data stored this way.

I am the only person who logs on to this server so it can't be deleted items for other users. Also, I changed the permissions for the folder "System Volume Information" so I could see what was in it - only 6 MB of files. — MrGordonz, Oct 03 '14 at 16:54

What is taking up all my disk space?

2 Answers2