Disk space being eaten up, not sure by what

[Bill Rubin]

I've got a situation where I have my C: drive getting full
(little of no free space) and I cannot figure out what file(s)
are taking it. I left my machine with 100mb+ free space on this
drive this morning when I hibernated. When I got home tonight,
with my son using the system, the C: drive was totally full. I
did a search by date for files modified in the last day, and I
do not see any large files out there. I've tried running the
File Monitor program from www.sysinternals.com and I can see
some strange files being written to like SNDCON.log in the
Symantec Shared folder, by ccEvtMgr) but when I look at that
file it's fairly small (67,780 bytes). I also see files
WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
written to in C:\WINDOWS\system32\config\systemprofile\Local
Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
I might add is NOT my normal directory for IE cache files -- but
those are also fairly small. I'd certainly love to know what
those are, too.

Is there anything I can do to figure out what is running and
eating up my disk space? I have not tried rebooting to see if
open files get closed and maybe figure something out that way.
I also ran the handles program from the aforementioned folks and
can see a bunch of open files but nothing looks obvious. Oh and
my swap space, is not on this drive, so it's not that the swap
file is growing.

Thanks..
Bill

 

[Malke]

I've got a situation where I have my C: drive getting full
(little of no free space) and I cannot figure out what file(s)
are taking it. I left my machine with 100mb+ free space on this
drive this morning when I hibernated. When I got home tonight,
with my son using the system, the C: drive was totally full. I
did a search by date for files modified in the last day, and I
do not see any large files out there. I've tried running the
File Monitor program from www.sysinternals.com and I can see
some strange files being written to like SNDCON.log in the
Symantec Shared folder, by ccEvtMgr) but when I look at that
file it's fairly small (67,780 bytes). I also see files
WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
written to in C:\WINDOWS\system32\config\systemprofile\Local
Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
I might add is NOT my normal directory for IE cache files -- but
those are also fairly small. I'd certainly love to know what
those are, too.

Is there anything I can do to figure out what is running and
eating up my disk space? I have not tried rebooting to see if
open files get closed and maybe figure something out that way.
I also ran the handles program from the aforementioned folks and
can see a bunch of open files but nothing looks obvious. Oh and
my swap space, is not on this drive, so it's not that the swap
file is growing.

Thanks..
Bill

First order of business: What does a scan with a current antivirus
program (meaning a version not earlier than 2002 and using updated
virus definitions) show?

Malke

 

[Bill Rubin]

I've got a situation where I have my C: drive getting full
(little of no free space) and I cannot figure out what file(s)
are taking it. I left my machine with 100mb+ free space on this
drive this morning when I hibernated. When I got home tonight,
with my son using the system, the C: drive was totally full. I
did a search by date for files modified in the last day, and I
do not see any large files out there. I've tried running the
File Monitor program from www.sysinternals.com and I can see
some strange files being written to like SNDCON.log in the
Symantec Shared folder, by ccEvtMgr) but when I look at that
file it's fairly small (67,780 bytes). I also see files
WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
written to in C:\WINDOWS\system32\config\systemprofile\Local
Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
I might add is NOT my normal directory for IE cache files -- but
those are also fairly small. I'd certainly love to know what
those are, too.

Is there anything I can do to figure out what is running and
eating up my disk space? I have not tried rebooting to see if
open files get closed and maybe figure something out that way.
I also ran the handles program from the aforementioned folks and
can see a bunch of open files but nothing looks obvious. Oh and
my swap space, is not on this drive, so it's not that the swap
file is growing.

Thanks..
Bill

First order of business: What does a scan with a current antivirus
program (meaning a version not earlier than 2002 and using updated
virus definitions) show?

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

Sorry, I should have included this info, virus scan runs clean
as does Spysweeper for spyware.

When I look in Task Manager. svchost.exe (121 million) and
services.exe (11 million) have the most I/O writes, followed by
lsass.exe (almost 5 million).

I would expect to have the File Monitor program show me what's
being written.. although the disk space did not seem to be going
down when I was running it. I cleared some space a little while
ago, and it's eaten up again now. Naturally, I wasn't logging
anything during that time. Is there some other program that
would be good for logging file writes?

Bill

 

[Bill Rubin]

I've got a situation where I have my C: drive getting full
(little of no free space) and I cannot figure out what file(s)
are taking it. I left my machine with 100mb+ free space on this
drive this morning when I hibernated. When I got home tonight,
with my son using the system, the C: drive was totally full. I
did a search by date for files modified in the last day, and I
do not see any large files out there. I've tried running the
File Monitor program from www.sysinternals.com and I can see
some strange files being written to like SNDCON.log in the
Symantec Shared folder, by ccEvtMgr) but when I look at that
file it's fairly small (67,780 bytes). I also see files
WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
written to in C:\WINDOWS\system32\config\systemprofile\Local
Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
I might add is NOT my normal directory for IE cache files -- but
those are also fairly small. I'd certainly love to know what
those are, too.

Is there anything I can do to figure out what is running and
eating up my disk space? I have not tried rebooting to see if
open files get closed and maybe figure something out that way.
I also ran the handles program from the aforementioned folks and
can see a bunch of open files but nothing looks obvious. Oh and
my swap space, is not on this drive, so it's not that the swap
file is growing.

Thanks..
Bill

First order of business: What does a scan with a current antivirus
program (meaning a version not earlier than 2002 and using updated
virus definitions) show?

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

Sorry, I should have included this info, virus scan runs clean
as does Spysweeper for spyware.

When I look in Task Manager. svchost.exe (121 million) and
services.exe (11 million) have the most I/O writes, followed by
lsass.exe (almost 5 million).

I would expect to have the File Monitor program show me what's
being written.. although the disk space did not seem to be going
down when I was running it. I cleared some space a little while
ago, and it's eaten up again now. Naturally, I wasn't logging
anything during that time. Is there some other program that
would be good for logging file writes?

Bill

PS I rebooted and I now have close to 4gb of space free and free
space does not seem to be dropping. I did a Scandisk at boot
(had set it prior to booting) and it did not find any errors.
Strange..

Bill

 

[Kelly]

Hi Bill,

drive this morning when I hibernated.

Ever thought to check this file?

It reserves disk space equal to your RAM. If you have a hidden file on the
root directory of your C-drive called hiberfil.sys, hibernation is enabled.

To remove that file, go to Display Properties, Screensaver, Power, Hibernate
tab, and uncheck the Enable hibernation box.

I've got a situation where I have my C: drive getting full
(little of no free space) and I cannot figure out what file(s)
are taking it. I left my machine with 100mb+ free space on this
drive this morning when I hibernated. When I got home tonight,
with my son using the system, the C: drive was totally full. I
did a search by date for files modified in the last day, and I
do not see any large files out there. I've tried running the
File Monitor program from www.sysinternals.com and I can see
some strange files being written to like SNDCON.log in the
Symantec Shared folder, by ccEvtMgr) but when I look at that
file it's fairly small (67,780 bytes). I also see files
WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
written to in C:\WINDOWS\system32\config\systemprofile\Local
Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
I might add is NOT my normal directory for IE cache files -- but
those are also fairly small. I'd certainly love to know what
those are, too.

Is there anything I can do to figure out what is running and
eating up my disk space? I have not tried rebooting to see if
open files get closed and maybe figure something out that way.
I also ran the handles program from the aforementioned folks and
can see a bunch of open files but nothing looks obvious. Oh and
my swap space, is not on this drive, so it's not that the swap
file is growing.

Thanks..
Bill

First order of business: What does a scan with a current antivirus
program (meaning a version not earlier than 2002 and using updated
virus definitions) show?

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

Sorry, I should have included this info, virus scan runs clean
as does Spysweeper for spyware.

When I look in Task Manager. svchost.exe (121 million) and
services.exe (11 million) have the most I/O writes, followed by
lsass.exe (almost 5 million).

I would expect to have the File Monitor program show me what's
being written.. although the disk space did not seem to be going
down when I was running it. I cleared some space a little while
ago, and it's eaten up again now. Naturally, I wasn't logging
anything during that time. Is there some other program that
would be good for logging file writes?

Bill

 

[Bill Rubin]

The hibernation file is 500mb (more or less). It's there when I
have plenty of disk space free, and it's the same size when I
don't.

Bill

Hi Bill,

drive this morning when I hibernated.

Ever thought to check this file?

It reserves disk space equal to your RAM. If you have a hidden file on the
root directory of your C-drive called hiberfil.sys, hibernation is enabled.

To remove that file, go to Display Properties, Screensaver, Power, Hibernate
tab, and uncheck the Enable hibernation box.

Bill Rubin wrote:

I've got a situation where I have my C: drive getting full
(little of no free space) and I cannot figure out what file(s)
are taking it. I left my machine with 100mb+ free space on this
drive this morning when I hibernated. When I got home tonight,
with my son using the system, the C: drive was totally full. I
did a search by date for files modified in the last day, and I
do not see any large files out there. I've tried running the
File Monitor program from www.sysinternals.com and I can see
some strange files being written to like SNDCON.log in the
Symantec Shared folder, by ccEvtMgr) but when I look at that
file it's fairly small (67,780 bytes). I also see files
WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
written to in C:\WINDOWS\system32\config\systemprofile\Local
Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
I might add is NOT my normal directory for IE cache files -- but
those are also fairly small. I'd certainly love to know what
those are, too.

Is there anything I can do to figure out what is running and
eating up my disk space? I have not tried rebooting to see if
open files get closed and maybe figure something out that way.
I also ran the handles program from the aforementioned folks and
can see a bunch of open files but nothing looks obvious. Oh and
my swap space, is not on this drive, so it's not that the swap
file is growing.

Thanks..
Bill

First order of business: What does a scan with a current antivirus
program (meaning a version not earlier than 2002 and using updated
virus definitions) show?

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

Sorry, I should have included this info, virus scan runs clean
as does Spysweeper for spyware.

When I look in Task Manager. svchost.exe (121 million) and
services.exe (11 million) have the most I/O writes, followed by
lsass.exe (almost 5 million).

I would expect to have the File Monitor program show me what's
being written.. although the disk space did not seem to be going
down when I was running it. I cleared some space a little while
ago, and it's eaten up again now. Naturally, I wasn't logging
anything during that time. Is there some other program that
would be good for logging file writes?

Bill

 

[Kelly]

Hi Bill,

A previous post from Alex: Checkpoints and Suggestions

Folder Options - View set to show Hidden files, and *not* Hide
Protected mode ones and try again. The hidden protected files could
easily add up to a couple of GB. If this shows the disk filling then
some things to do:

Go to Control Panel - System - Advanced - Performance Settings -
Advanced - Virtual Memory and click Settings. Highlight the other
drive and put a system managed page file on it; click Set, then
highlight C and put a custom one there, initial size only 2, Max 50,
click Set (the one on C will probably never come into existence,, but
the system tends to sulk if it is not allowed).

Decide if you want to Hibernate - if not, Control Panel - Power Options
and in Hibernate uncheck the enable; that will save a file the size of
RAM

In System - System restore highlight the drive and take settings; reduce
the space allowed, which is probably 1000 MB, to say 400

In Control Panel - Internet Options; central Temporary Internet files
area you can click Settings and move the folder to the other drive.

And you may have more than you think in My Documents - open a window on
C:\Documents and Settings\you\
to show it; open a window on your other disk, and *right* drag it over,
taking *Move* here.

More reading and information here: http://tinyurl.com/yuw8c

The hibernation file is 500mb (more or less). It's there when I
have plenty of disk space free, and it's the same size when I
don't.

Bill

Hi Bill,

drive this morning when I hibernated.

Ever thought to check this file?

It reserves disk space equal to your RAM. If you have a hidden file on
the
root directory of your C-drive called hiberfil.sys, hibernation is
enabled.

To remove that file, go to Display Properties, Screensaver, Power,
Hibernate
tab, and uncheck the Enable hibernation box.

Malke wrote:

Bill Rubin wrote:

I've got a situation where I have my C: drive getting full
(little of no free space) and I cannot figure out what file(s)
are taking it. I left my machine with 100mb+ free space on this
drive this morning when I hibernated. When I got home tonight,
with my son using the system, the C: drive was totally full. I
did a search by date for files modified in the last day, and I
do not see any large files out there. I've tried running the
File Monitor program from www.sysinternals.com and I can see
some strange files being written to like SNDCON.log in the
Symantec Shared folder, by ccEvtMgr) but when I look at that
file it's fairly small (67,780 bytes). I also see files
WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
written to in C:\WINDOWS\system32\config\systemprofile\Local
Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
I might add is NOT my normal directory for IE cache files -- but
those are also fairly small. I'd certainly love to know what
those are, too.

Is there anything I can do to figure out what is running and
eating up my disk space? I have not tried rebooting to see if
open files get closed and maybe figure something out that way.
I also ran the handles program from the aforementioned folks and
can see a bunch of open files but nothing looks obvious. Oh and
my swap space, is not on this drive, so it's not that the swap
file is growing.

Thanks..
Bill

First order of business: What does a scan with a current antivirus
program (meaning a version not earlier than 2002 and using updated
virus definitions) show?

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

Sorry, I should have included this info, virus scan runs clean
as does Spysweeper for spyware.

When I look in Task Manager. svchost.exe (121 million) and
services.exe (11 million) have the most I/O writes, followed by
lsass.exe (almost 5 million).

I would expect to have the File Monitor program show me what's
being written.. although the disk space did not seem to be going
down when I was running it. I cleared some space a little while
ago, and it's eaten up again now. Naturally, I wasn't logging
anything during that time. Is there some other program that
would be good for logging file writes?

Bill

 

[Tumbleweed]

Install treesize(free) it will do a space analysis of any given drive or
folder showing you where its all being used.

 

[Bill Rubin]

I already installed something like that (but thanks for pointing me at a
free one -- I have a Shareware program that will stop working in a
couple of weeks). But the situation seems to be that there are open
files whose space is not being reflected by the actual file size. I
rebooted and got back 3+gb of space. Either that or Windows is getting
confused about free space.

Bill