Disk space being eaten up, not sure by what

Discussion in 'Windows XP General' started by Bill Rubin, May 27, 2004.

  1. Bill Rubin

    Bill Rubin Guest

    I've got a situation where I have my C: drive getting full
    (little of no free space) and I cannot figure out what file(s)
    are taking it. I left my machine with 100mb+ free space on this
    drive this morning when I hibernated. When I got home tonight,
    with my son using the system, the C: drive was totally full. I
    did a search by date for files modified in the last day, and I
    do not see any large files out there. I've tried running the
    File Monitor program from www.sysinternals.com and I can see
    some strange files being written to like SNDCON.log in the
    Symantec Shared folder, by ccEvtMgr) but when I look at that
    file it's fairly small (67,780 bytes). I also see files
    WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    written to in C:\WINDOWS\system32\config\systemprofile\Local
    Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    I might add is NOT my normal directory for IE cache files -- but
    those are also fairly small. I'd certainly love to know what
    those are, too.

    Is there anything I can do to figure out what is running and
    eating up my disk space? I have not tried rebooting to see if
    open files get closed and maybe figure something out that way.
    I also ran the handles program from the aforementioned folks and
    can see a bunch of open files but nothing looks obvious. Oh and
    my swap space, is not on this drive, so it's not that the swap
    file is growing.

    Thanks..
    Bill
     
    Bill Rubin, May 27, 2004
    #1
    1. Advertisements

  2. Bill Rubin

    Malke Guest

    Bill Rubin wrote:

    > I've got a situation where I have my C: drive getting full
    > (little of no free space) and I cannot figure out what file(s)
    > are taking it. I left my machine with 100mb+ free space on this
    > drive this morning when I hibernated. When I got home tonight,
    > with my son using the system, the C: drive was totally full. I
    > did a search by date for files modified in the last day, and I
    > do not see any large files out there. I've tried running the
    > File Monitor program from www.sysinternals.com and I can see
    > some strange files being written to like SNDCON.log in the
    > Symantec Shared folder, by ccEvtMgr) but when I look at that
    > file it's fairly small (67,780 bytes). I also see files
    > WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    > written to in C:\WINDOWS\system32\config\systemprofile\Local
    > Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    > I might add is NOT my normal directory for IE cache files -- but
    > those are also fairly small. I'd certainly love to know what
    > those are, too.
    >
    > Is there anything I can do to figure out what is running and
    > eating up my disk space? I have not tried rebooting to see if
    > open files get closed and maybe figure something out that way.
    > I also ran the handles program from the aforementioned folks and
    > can see a bunch of open files but nothing looks obvious. Oh and
    > my swap space, is not on this drive, so it's not that the swap
    > file is growing.
    >
    > Thanks..
    > Bill


    First order of business: What does a scan with a current antivirus
    program (meaning a version not earlier than 2002 and using updated
    virus definitions) show?

    Malke
    --
    MS MVP - Windows Shell/User
    Elephant Boy Computers
    www.elephantboycomputers.com
    "Don't Panic!"
     
    Malke, May 27, 2004
    #2
    1. Advertisements

  3. Bill Rubin

    Bill Rubin Guest

    Malke wrote:
    >
    > Bill Rubin wrote:
    >
    > > I've got a situation where I have my C: drive getting full
    > > (little of no free space) and I cannot figure out what file(s)
    > > are taking it. I left my machine with 100mb+ free space on this
    > > drive this morning when I hibernated. When I got home tonight,
    > > with my son using the system, the C: drive was totally full. I
    > > did a search by date for files modified in the last day, and I
    > > do not see any large files out there. I've tried running the
    > > File Monitor program from www.sysinternals.com and I can see
    > > some strange files being written to like SNDCON.log in the
    > > Symantec Shared folder, by ccEvtMgr) but when I look at that
    > > file it's fairly small (67,780 bytes). I also see files
    > > WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    > > written to in C:\WINDOWS\system32\config\systemprofile\Local
    > > Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    > > I might add is NOT my normal directory for IE cache files -- but
    > > those are also fairly small. I'd certainly love to know what
    > > those are, too.
    > >
    > > Is there anything I can do to figure out what is running and
    > > eating up my disk space? I have not tried rebooting to see if
    > > open files get closed and maybe figure something out that way.
    > > I also ran the handles program from the aforementioned folks and
    > > can see a bunch of open files but nothing looks obvious. Oh and
    > > my swap space, is not on this drive, so it's not that the swap
    > > file is growing.
    > >
    > > Thanks..
    > > Bill

    >
    > First order of business: What does a scan with a current antivirus
    > program (meaning a version not earlier than 2002 and using updated
    > virus definitions) show?
    >
    > Malke
    > --
    > MS MVP - Windows Shell/User
    > Elephant Boy Computers
    > www.elephantboycomputers.com
    > "Don't Panic!"


    Sorry, I should have included this info, virus scan runs clean
    as does Spysweeper for spyware.

    When I look in Task Manager. svchost.exe (121 million) and
    services.exe (11 million) have the most I/O writes, followed by
    lsass.exe (almost 5 million).

    I would expect to have the File Monitor program show me what's
    being written.. although the disk space did not seem to be going
    down when I was running it. I cleared some space a little while
    ago, and it's eaten up again now. Naturally, I wasn't logging
    anything during that time. Is there some other program that
    would be good for logging file writes?

    Bill
     
    Bill Rubin, May 27, 2004
    #3
  4. Bill Rubin

    Bill Rubin Guest

    Bill Rubin wrote:
    >
    > Malke wrote:
    > >
    > > Bill Rubin wrote:
    > >
    > > > I've got a situation where I have my C: drive getting full
    > > > (little of no free space) and I cannot figure out what file(s)
    > > > are taking it. I left my machine with 100mb+ free space on this
    > > > drive this morning when I hibernated. When I got home tonight,
    > > > with my son using the system, the C: drive was totally full. I
    > > > did a search by date for files modified in the last day, and I
    > > > do not see any large files out there. I've tried running the
    > > > File Monitor program from www.sysinternals.com and I can see
    > > > some strange files being written to like SNDCON.log in the
    > > > Symantec Shared folder, by ccEvtMgr) but when I look at that
    > > > file it's fairly small (67,780 bytes). I also see files
    > > > WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    > > > written to in C:\WINDOWS\system32\config\systemprofile\Local
    > > > Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    > > > I might add is NOT my normal directory for IE cache files -- but
    > > > those are also fairly small. I'd certainly love to know what
    > > > those are, too.
    > > >
    > > > Is there anything I can do to figure out what is running and
    > > > eating up my disk space? I have not tried rebooting to see if
    > > > open files get closed and maybe figure something out that way.
    > > > I also ran the handles program from the aforementioned folks and
    > > > can see a bunch of open files but nothing looks obvious. Oh and
    > > > my swap space, is not on this drive, so it's not that the swap
    > > > file is growing.
    > > >
    > > > Thanks..
    > > > Bill

    > >
    > > First order of business: What does a scan with a current antivirus
    > > program (meaning a version not earlier than 2002 and using updated
    > > virus definitions) show?
    > >
    > > Malke
    > > --
    > > MS MVP - Windows Shell/User
    > > Elephant Boy Computers
    > > www.elephantboycomputers.com
    > > "Don't Panic!"

    >
    > Sorry, I should have included this info, virus scan runs clean
    > as does Spysweeper for spyware.
    >
    > When I look in Task Manager. svchost.exe (121 million) and
    > services.exe (11 million) have the most I/O writes, followed by
    > lsass.exe (almost 5 million).
    >
    > I would expect to have the File Monitor program show me what's
    > being written.. although the disk space did not seem to be going
    > down when I was running it. I cleared some space a little while
    > ago, and it's eaten up again now. Naturally, I wasn't logging
    > anything during that time. Is there some other program that
    > would be good for logging file writes?
    >
    > Bill


    PS I rebooted and I now have close to 4gb of space free and free
    space does not seem to be dropping. I did a Scandisk at boot
    (had set it prior to booting) and it did not find any errors.
    Strange..

    Bill
     
    Bill Rubin, May 27, 2004
    #4
  5. Bill Rubin

    Kelly Guest

    Hi Bill,

    > drive this morning when I hibernated.


    Ever thought to check this file?

    It reserves disk space equal to your RAM. If you have a hidden file on the
    root directory of your C-drive called hiberfil.sys, hibernation is enabled.

    To remove that file, go to Display Properties, Screensaver, Power, Hibernate
    tab, and uncheck the Enable hibernation box.
    --
    All the Best,
    Kelly

    Microsoft-MVP Windows® XP
    2004 Windows MVP "Winny" Award

    Troubleshooting Windows XP
    http://www.kellys-korner-xp.com

    Taskbar Repair Tool Plus!
    http://www.kellys-korner-xp.com/taskbarplus!.htm


    "Bill Rubin" <> wrote in message
    news:...
    >
    >
    > Malke wrote:
    >>
    >> Bill Rubin wrote:
    >>
    >> > I've got a situation where I have my C: drive getting full
    >> > (little of no free space) and I cannot figure out what file(s)
    >> > are taking it. I left my machine with 100mb+ free space on this
    >> > drive this morning when I hibernated. When I got home tonight,
    >> > with my son using the system, the C: drive was totally full. I
    >> > did a search by date for files modified in the last day, and I
    >> > do not see any large files out there. I've tried running the
    >> > File Monitor program from www.sysinternals.com and I can see
    >> > some strange files being written to like SNDCON.log in the
    >> > Symantec Shared folder, by ccEvtMgr) but when I look at that
    >> > file it's fairly small (67,780 bytes). I also see files
    >> > WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    >> > written to in C:\WINDOWS\system32\config\systemprofile\Local
    >> > Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    >> > I might add is NOT my normal directory for IE cache files -- but
    >> > those are also fairly small. I'd certainly love to know what
    >> > those are, too.
    >> >
    >> > Is there anything I can do to figure out what is running and
    >> > eating up my disk space? I have not tried rebooting to see if
    >> > open files get closed and maybe figure something out that way.
    >> > I also ran the handles program from the aforementioned folks and
    >> > can see a bunch of open files but nothing looks obvious. Oh and
    >> > my swap space, is not on this drive, so it's not that the swap
    >> > file is growing.
    >> >
    >> > Thanks..
    >> > Bill

    >>
    >> First order of business: What does a scan with a current antivirus
    >> program (meaning a version not earlier than 2002 and using updated
    >> virus definitions) show?
    >>
    >> Malke
    >> --
    >> MS MVP - Windows Shell/User
    >> Elephant Boy Computers
    >> www.elephantboycomputers.com
    >> "Don't Panic!"

    >
    > Sorry, I should have included this info, virus scan runs clean
    > as does Spysweeper for spyware.
    >
    > When I look in Task Manager. svchost.exe (121 million) and
    > services.exe (11 million) have the most I/O writes, followed by
    > lsass.exe (almost 5 million).
    >
    > I would expect to have the File Monitor program show me what's
    > being written.. although the disk space did not seem to be going
    > down when I was running it. I cleared some space a little while
    > ago, and it's eaten up again now. Naturally, I wasn't logging
    > anything during that time. Is there some other program that
    > would be good for logging file writes?
    >
    > Bill
     
    Kelly, May 27, 2004
    #5
  6. Bill Rubin

    Bill Rubin Guest

    The hibernation file is 500mb (more or less). It's there when I
    have plenty of disk space free, and it's the same size when I
    don't.

    Bill

    Kelly wrote:
    >
    > Hi Bill,
    >
    > > drive this morning when I hibernated.

    >
    > Ever thought to check this file?
    >
    > It reserves disk space equal to your RAM. If you have a hidden file on the
    > root directory of your C-drive called hiberfil.sys, hibernation is enabled.
    >
    > To remove that file, go to Display Properties, Screensaver, Power, Hibernate
    > tab, and uncheck the Enable hibernation box.
    > --
    > All the Best,
    > Kelly
    >
    > Microsoft-MVP Windows® XP
    > 2004 Windows MVP "Winny" Award
    >
    > Troubleshooting Windows XP
    > http://www.kellys-korner-xp.com
    >
    > Taskbar Repair Tool Plus!
    > http://www.kellys-korner-xp.com/taskbarplus!.htm
    >
    > "Bill Rubin" <> wrote in message
    > news:...
    > >
    > >
    > > Malke wrote:
    > >>
    > >> Bill Rubin wrote:
    > >>
    > >> > I've got a situation where I have my C: drive getting full
    > >> > (little of no free space) and I cannot figure out what file(s)
    > >> > are taking it. I left my machine with 100mb+ free space on this
    > >> > drive this morning when I hibernated. When I got home tonight,
    > >> > with my son using the system, the C: drive was totally full. I
    > >> > did a search by date for files modified in the last day, and I
    > >> > do not see any large files out there. I've tried running the
    > >> > File Monitor program from www.sysinternals.com and I can see
    > >> > some strange files being written to like SNDCON.log in the
    > >> > Symantec Shared folder, by ccEvtMgr) but when I look at that
    > >> > file it's fairly small (67,780 bytes). I also see files
    > >> > WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    > >> > written to in C:\WINDOWS\system32\config\systemprofile\Local
    > >> > Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    > >> > I might add is NOT my normal directory for IE cache files -- but
    > >> > those are also fairly small. I'd certainly love to know what
    > >> > those are, too.
    > >> >
    > >> > Is there anything I can do to figure out what is running and
    > >> > eating up my disk space? I have not tried rebooting to see if
    > >> > open files get closed and maybe figure something out that way.
    > >> > I also ran the handles program from the aforementioned folks and
    > >> > can see a bunch of open files but nothing looks obvious. Oh and
    > >> > my swap space, is not on this drive, so it's not that the swap
    > >> > file is growing.
    > >> >
    > >> > Thanks..
    > >> > Bill
    > >>
    > >> First order of business: What does a scan with a current antivirus
    > >> program (meaning a version not earlier than 2002 and using updated
    > >> virus definitions) show?
    > >>
    > >> Malke
    > >> --
    > >> MS MVP - Windows Shell/User
    > >> Elephant Boy Computers
    > >> www.elephantboycomputers.com
    > >> "Don't Panic!"

    > >
    > > Sorry, I should have included this info, virus scan runs clean
    > > as does Spysweeper for spyware.
    > >
    > > When I look in Task Manager. svchost.exe (121 million) and
    > > services.exe (11 million) have the most I/O writes, followed by
    > > lsass.exe (almost 5 million).
    > >
    > > I would expect to have the File Monitor program show me what's
    > > being written.. although the disk space did not seem to be going
    > > down when I was running it. I cleared some space a little while
    > > ago, and it's eaten up again now. Naturally, I wasn't logging
    > > anything during that time. Is there some other program that
    > > would be good for logging file writes?
    > >
    > > Bill
     
    Bill Rubin, May 27, 2004
    #6
  7. Bill Rubin

    Kelly Guest

    Hi Bill,

    A previous post from Alex: Checkpoints and Suggestions

    Folder Options - View set to show Hidden files, and *not* Hide
    Protected mode ones and try again. The hidden protected files could
    easily add up to a couple of GB. If this shows the disk filling then
    some things to do:

    Go to Control Panel - System - Advanced - Performance Settings -
    Advanced - Virtual Memory and click Settings. Highlight the other
    drive and put a system managed page file on it; click Set, then
    highlight C and put a custom one there, initial size only 2, Max 50,
    click Set (the one on C will probably never come into existence,, but
    the system tends to sulk if it is not allowed).

    Decide if you want to Hibernate - if not, Control Panel - Power Options
    and in Hibernate uncheck the enable; that will save a file the size of
    RAM

    In System - System restore highlight the drive and take settings; reduce
    the space allowed, which is probably 1000 MB, to say 400

    In Control Panel - Internet Options; central Temporary Internet files
    area you can click Settings and move the folder to the other drive.

    And you may have more than you think in My Documents - open a window on
    C:\Documents and Settings\you\
    to show it; open a window on your other disk, and *right* drag it over,
    taking *Move* here.

    More reading and information here: http://tinyurl.com/yuw8c

    --
    All the Best,
    Kelly

    Microsoft-MVP Windows® XP
    2004 Windows MVP "Winny" Award

    Troubleshooting Windows XP
    http://www.kellys-korner-xp.com

    Taskbar Repair Tool Plus!
    http://www.kellys-korner-xp.com/taskbarplus!.htm


    "Bill Rubin" <> wrote in message
    news:...
    > The hibernation file is 500mb (more or less). It's there when I
    > have plenty of disk space free, and it's the same size when I
    > don't.
    >
    > Bill
    >
    > Kelly wrote:
    >>
    >> Hi Bill,
    >>
    >> > drive this morning when I hibernated.

    >>
    >> Ever thought to check this file?
    >>
    >> It reserves disk space equal to your RAM. If you have a hidden file on
    >> the
    >> root directory of your C-drive called hiberfil.sys, hibernation is
    >> enabled.
    >>
    >> To remove that file, go to Display Properties, Screensaver, Power,
    >> Hibernate
    >> tab, and uncheck the Enable hibernation box.
    >> --
    >> All the Best,
    >> Kelly
    >>
    >> Microsoft-MVP Windows® XP
    >> 2004 Windows MVP "Winny" Award
    >>
    >> Troubleshooting Windows XP
    >> http://www.kellys-korner-xp.com
    >>
    >> Taskbar Repair Tool Plus!
    >> http://www.kellys-korner-xp.com/taskbarplus!.htm
    >>
    >> "Bill Rubin" <> wrote in message
    >> news:...
    >> >
    >> >
    >> > Malke wrote:
    >> >>
    >> >> Bill Rubin wrote:
    >> >>
    >> >> > I've got a situation where I have my C: drive getting full
    >> >> > (little of no free space) and I cannot figure out what file(s)
    >> >> > are taking it. I left my machine with 100mb+ free space on this
    >> >> > drive this morning when I hibernated. When I got home tonight,
    >> >> > with my son using the system, the C: drive was totally full. I
    >> >> > did a search by date for files modified in the last day, and I
    >> >> > do not see any large files out there. I've tried running the
    >> >> > File Monitor program from www.sysinternals.com and I can see
    >> >> > some strange files being written to like SNDCON.log in the
    >> >> > Symantec Shared folder, by ccEvtMgr) but when I look at that
    >> >> > file it's fairly small (67,780 bytes). I also see files
    >> >> > WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    >> >> > written to in C:\WINDOWS\system32\config\systemprofile\Local
    >> >> > Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    >> >> > I might add is NOT my normal directory for IE cache files -- but
    >> >> > those are also fairly small. I'd certainly love to know what
    >> >> > those are, too.
    >> >> >
    >> >> > Is there anything I can do to figure out what is running and
    >> >> > eating up my disk space? I have not tried rebooting to see if
    >> >> > open files get closed and maybe figure something out that way.
    >> >> > I also ran the handles program from the aforementioned folks and
    >> >> > can see a bunch of open files but nothing looks obvious. Oh and
    >> >> > my swap space, is not on this drive, so it's not that the swap
    >> >> > file is growing.
    >> >> >
    >> >> > Thanks..
    >> >> > Bill
    >> >>
    >> >> First order of business: What does a scan with a current antivirus
    >> >> program (meaning a version not earlier than 2002 and using updated
    >> >> virus definitions) show?
    >> >>
    >> >> Malke
    >> >> --
    >> >> MS MVP - Windows Shell/User
    >> >> Elephant Boy Computers
    >> >> www.elephantboycomputers.com
    >> >> "Don't Panic!"
    >> >
    >> > Sorry, I should have included this info, virus scan runs clean
    >> > as does Spysweeper for spyware.
    >> >
    >> > When I look in Task Manager. svchost.exe (121 million) and
    >> > services.exe (11 million) have the most I/O writes, followed by
    >> > lsass.exe (almost 5 million).
    >> >
    >> > I would expect to have the File Monitor program show me what's
    >> > being written.. although the disk space did not seem to be going
    >> > down when I was running it. I cleared some space a little while
    >> > ago, and it's eaten up again now. Naturally, I wasn't logging
    >> > anything during that time. Is there some other program that
    >> > would be good for logging file writes?
    >> >
    >> > Bill
     
    Kelly, May 27, 2004
    #7
  8. Bill Rubin

    Tumbleweed Guest

    Install treesize(free) it will do a space analysis of any given drive or
    folder showing you where its all being used.

    --
    Tumbleweed

    Remove my socks for email address
    "Bill Rubin" <> wrote in message
    news:...
    > I've got a situation where I have my C: drive getting full
    > (little of no free space) and I cannot figure out what file(s)
    > are taking it. I left my machine with 100mb+ free space on this
    > drive this morning when I hibernated. When I got home tonight,
    > with my son using the system, the C: drive was totally full. I
    > did a search by date for files modified in the last day, and I
    > do not see any large files out there. I've tried running the
    > File Monitor program from www.sysinternals.com and I can see
    > some strange files being written to like SNDCON.log in the
    > Symantec Shared folder, by ccEvtMgr) but when I look at that
    > file it's fairly small (67,780 bytes). I also see files
    > WANCommonInterfaceConfig[1].xml and WANIPConnection[1].xml being
    > written to in C:\WINDOWS\system32\config\systemprofile\Local
    > Settings\Temporary Internet Files\Content.IE5\ZL7D82L4 -- which
    > I might add is NOT my normal directory for IE cache files -- but
    > those are also fairly small. I'd certainly love to know what
    > those are, too.
    >
    > Is there anything I can do to figure out what is running and
    > eating up my disk space? I have not tried rebooting to see if
    > open files get closed and maybe figure something out that way.
    > I also ran the handles program from the aforementioned folks and
    > can see a bunch of open files but nothing looks obvious. Oh and
    > my swap space, is not on this drive, so it's not that the swap
    > file is growing.
    >
    > Thanks..
    > Bill
     
    Tumbleweed, May 27, 2004
    #8
  9. Bill Rubin

    Bill Rubin Guest

    I already installed something like that (but thanks for pointing me at a
    free one -- I have a Shareware program that will stop working in a
    couple of weeks). But the situation seems to be that there are open
    files whose space is not being reflected by the actual file size. I
    rebooted and got back 3+gb of space. Either that or Windows is getting
    confused about free space.

    Bill

    Tumbleweed wrote:
    > Install treesize(free) it will do a space analysis of any given drive or
    > folder showing you where its all being used.
    >
     
    Bill Rubin, May 27, 2004
    #9
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Guest
    Replies:
    1
    Views:
    3,975
    Lance Joiner
    May 14, 2004
  2. Guest

    Help! my harddrive space is being eaten up

    Guest, Sep 12, 2004, in forum: Windows XP Performance
    Replies:
    1
    Views:
    361
    Kaylene aka Taurarian
    Sep 12, 2004
  3. Guest

    Virtual memory being eaten

    Guest, Apr 20, 2004, in forum: Windows XP Networking
    Replies:
    0
    Views:
    169
    Guest
    Apr 20, 2004
  4. Guest

    My physical memory is being eaten up

    Guest, Jan 31, 2004, in forum: Windows XP General
    Replies:
    6
    Views:
    239
    Alex Nichol
    Jan 31, 2004
  5. Sherwin Reyes

    OS Partition free space keeps eaten up

    Sherwin Reyes, Sep 22, 2003, in forum: Microsoft Windows 2000 Setup
    Replies:
    1
    Views:
    221
    Dave Patrick
    Sep 22, 2003
Loading...

Share This Page