Missing 2 gig of drive space

[Fraser]

Hey All,

First off, I'm far from a newbie to this game... ;-)

I've got an XP system (fully patched) that is running on a 6 gig system
drive. The PC is very bare-bones, used for playing music and surfing the net
only, mainly used by house guests. Installed software is MS Office XP,
Norton SystemWorks/Anti-Virus. The system completely ran out of disk space
the other day, and I can't seem to reclaim most of it. Here are the totals
of the space allocation, as retrieved via the properties page for each
folder:

Documents and Settings 15 meg
Program Files 857 meg
Windows 1400 meg
Page File 600 meg
Hibernation none

Total 2800 meg


However, My Computer reports the drive with only 758 meg free. That means
over two gig has disappeared!! I don't think that's all NTFS overhead!! ;-)

I've already cleared out Temporary Internet Files/Content.IE5 in Safe Mode.
That's what got me the 758 meg back, a process that took over 24 hours of
continual deletion using "del"! The normal method to clear out the net cache
through the GUI didn't delete these at all.

Going to C:\ and select-all/properties reports 2.78 gig of space in use by
the user-visible files.

Can anyone suggest where to look for the remainder of the space? I've used
the neat free SpaceMonger tool that gives a GUI representation of the drive,
showing the relative space used by each folder. It can't find the missing
space either.

One thing to note about this PC is that it runs 24/7, and only gets rebooted
when absolutely required.

TIA,

Fraser.

 

[Kent_dieGo]

System Restore points are given a fixed amount of space. Right click My
Computer>Properties>System Restore.

Enable viewing of hidden and system files and delete all the old $uninsatll
stuff in \Windows directory.

-Kent

 

[Fraser]

System Restore points are given a fixed amount of space. Right click My
Computer>Properties>System Restore.

Done. Retrieved 300 meg by going from 12% to 6%. Still at least 1.5 gig
missing though. I'm not sure if the 300 meg is retrieved from the "lost"
space or just normal visable files though. No change to the totals in My
Computer, but this is prior to a reboot, so the change might not be complete
yet.

Enable viewing of hidden and system files

I did say I wasn't a newbie!! ;-)

and delete all the old $uninsatll stuff in \Windows directory.

That would only free up 60 meg, and none of it the "lost" space. As I
already had hidden and sys files viewable, the space used here was included
in my calculations. I'd rather not delete any package management files, that
is generally a first step on the road to dispair.

I'm not too fussed about cleaning all the cruft out of the machine, I just
want to get my 1.5 gig of HD space back without having to rebuild the
system. It was last imaged about a year ago, even Win 95/98 could go over a
year without requiring a full re-install!


Cheers!

Fraser.

 

[Jason Wisher]

Can anyone suggest where to look for the remainder of the space? I've used

the neat free SpaceMonger tool that gives a GUI representation of the drive,
showing the relative space used by each folder. It can't find the missing
space either.

Here's a tool that can quickly help you to answer this question (it's
called BulletProof FolderSizes):

http://www.foldersizes.com/

 

[Jason Wisher]

Done. Retrieved 300 meg by going from 12% to 6%. Still at least 1.5 gig

missing though. I'm not sure if the 300 meg is retrieved from the "lost"
space or just normal visable files though. No change to the totals in My
Computer, but this is prior to a reboot, so the change might not be complete
yet.

Hunt down the missing space with FolderSizes - http://www.foldersizes.com/

 

[Sarge]

Or, are there any other NTFS drive analysis tools that work on the volume
directly? Unfortunately, it's the primary drive, so they would need to be
bootable, or work within the Windows environment.

Run:

chkdsk c: /f

from a command prompt and see what it comes up with. Check Event
Viewer/Application log, source "Winlogon" for the result.

You'll have to reboot. ;-(

 

[Fraser]

Hunt down the missing space with FolderSizes - http://www.foldersizes.com/

Didn't work I'm afraid. The SpaceMonger tool does a similar thing, but
neither seem to be able to see the data that is taking up all the space.
They report the same information you would get through a folders Properties
dialog in Explorer.

Does anyone know any other locations of "Hidden Files" or so-called "Super
Hidden-Files" other than the Content.IE one? I'm fairly sure it's these sort
of files that are clogging up the drive. Probably due to the huge uptime
it's had, running 24/7 for over a year... ;-)

Or, are there any other NTFS drive analysis tools that work on the volume
directly? Unfortunately, it's the primary drive, so they would need to be
bootable, or work within the Windows environment.

Cheers,

Fraser.

 

[Fraser]

chkdsk c: /f

from a command prompt and see what it comes up with. Check Event
Viewer/Application log, source "Winlogon" for the result.

Cool. Was aware of chkdsk, didn't know it logged to the Event system though.
It made a few changes to the disk, but no major reclaim of space (a few
megabytes) unfortunately. I've attached the output to the end of this post
for reference.

If I were too hook this primary drive up to another computer as a slave,
would the hidden files be visable? Or are they also hidden below the NTFS
system (rather than the OS)?


Cheers,

Fraser.


Start cut & paste:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 14/12/2003
Time: 19:17:50
User: N/A
Computer: MUSIC-PC
Description:
Checking file system on C:
The type of the file system is NTFS.


A disk check has been scheduled.
Windows will now check the disk.
Cleaning up instance tags for file 0x3626.
Cleaning up minor inconsistencies on the drive.
Cleaning up 126 unused index entries from index $SII of file 0x9.
Cleaning up 126 unused index entries from index $SDH of file 0x9.
Cleaning up 126 unused security descriptors.
Windows has made corrections to the file system.

6289888 KB total disk space.
2880456 KB in 15579 files.
4652 KB in 1255 indexes.
0 KB in bad sectors.
2630476 KB in use by the system.
33504 KB occupied by the log file.
774304 KB available on disk.

4096 bytes in each allocation unit.
1572472 total allocation units on disk.
193576 allocation units available on disk.

Internal Info:
50 9c 27 00 cc 41 00 00 d1 4e 00 00 00 00 00 00 P.'..A...N......
8b 00 00 00 00 00 00 00 c7 01 00 00 00 00 00 00 ................
20 d8 5a 83 00 00 00 00 90 90 36 9b 00 00 00 00 .Z.......6.....
30 9f 3d 87 00 00 00 00 00 00 00 00 00 00 00 00 0.=.............
00 00 00 00 00 00 00 00 50 6a 0f c2 01 00 00 00 ........Pj......
de 34 12 00 00 00 00 00 db 3c 00 00 00 00 00 00 .4.......<......
00 20 cf af 00 00 00 00 e7 04 00 00 00 00 00 00 . ..............

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Ivo Ramaekers]

Did you disabled systemrecovery ?!?
If not that's proberbly the space you are looking for.
If you disable system recovery on all disk it can save up to 5 GB.
Depending on the number of drives and their sizes.
To disable systemrecovery do the following:
(i'm using a dutch version of windows XP so sorry if the name doesn't
exactly match
Right Click this computer -> properties -> ?SystemRecovery?
And then uncheck the box that says somethink like: "disable
systemrecovery on all stations"

Wait a while and your missing disk space should be retrieved.
Tell me if it worked plz.

Greetz
Ivo Ramaekers

 

[Fraser]

Did you disable systemrecovery ?!?

I've got it set at around 350 meg, previously it was using about 750 meg. I
had found a previous post to usenet through Google that suggested the same
thing when I first started looking into this problem.

I just find it pretty strange that two whole gig of space has just
vanished!! Here's the current stats:

From "My Computer"
Total: 5.99 GB
Free: 753 MB


From selecting all files in C:\ (ctrl-a) and opening properties (alt-enter):
Size: 2.78 GB
Size on disk: 2.72 GB
(hidden and sys files set to viewable, inc. pagefile etc)

Rough math:

5.99 - 2.78 = 3.21 GB (that should be free)
3.21 - 0.753 = 2.46 GB (minus what is really free)

(with a little margin of error because of 1024/1000 meg/gig conversions etc)


So, almost 2.5 gig taken up by hidden OS files. Sorry to sound like an
AOL'er, but wtf is going on?!? ;-) I can understand maybe a gig, but this
is insane!!

Fraser.

 

[Sarge]

Cool. Was aware of chkdsk, didn't know it logged to the Event system
though. It made a few changes to the disk, but no major reclaim of
space (a few megabytes) unfortunately. I've attached the output to the
end of this post for reference.

If I were too hook this primary drive up to another computer as a
slave, would the hidden files be visable? Or are they also hidden
below the NTFS system (rather than the OS)?

You should be able to see everything on the disk in that case, but you can
try something easier first. While logged in as a member of the
Administrators Group right-click your C:\System Volume Information folder
(those are your system restore files.) Take Properties-Security and add
your username, then check the Allow box for Full Control. If you don't have
a Security tab see:

http://windows.about.com/library/tips/bltip542.htm

Or if you prefer to do it the old-fashioned way open a command prompt and
enter:

cacls "C:\System Volume Information" /E /G username:F

where <username> is, well, your username. ;-)

This will give you access to the contents of that folder. Take a look and
see exactly how much room those files are taking up. I'm betting that's
where you'll find your missing gigs. If not, I have another theory but it's
a long shot.

Your chkdsk log was fine btw.

 

[Richard]

I got the same problems as you before. In my case, for those FAT32 and FAT
partitions, I could switch to Win98 (I configured a multi-boot environment)
and reclaim these missing spaces by doing a disk cleanup there. For the
NTFS region, I experienced the same problems several times, in my recent
case, about 4G of space missing after I deleted a large video file, I tried
all ways suggested here in the newsgroup, but same result as yours. As I
had installed the Norton Protected Recycled Bin, so this morning, I tried to
call up the Norton Protected Recycled Bin, click its Properties and perform
an Empty Protected Files in the Norton Protection tab, Bingo! All my space
back.

Hope this my help in your case.

Richard

 

[Fraser]

As I
had installed the Norton Protected Recycled Bin, so this morning, I tried to
call up the Norton Protected Recycled Bin, click its Properties and perform
an Empty Protected Files in the Norton Protection tab, Bingo! All my space
back.

I had a similar problem on another machine a couple of months ago. Lost
nearly 20 gig one week! The app was caching DVD-ROM image files!! ;-)

Unfortunately, it didn't help much here, already tried it on this box.


Cheers for the suggestion!!

Fraser.

 

[Fraser]

You should be able to see everything on the disk in that case, but you can
try something easier first.

Will try this tomorrow, don't have access to the box right now. Sounds
promising though, will report back results when I try it.


Cheers,

Fraser.

 

[Fraser]

cacls "C:\System Volume Information" /E /G username:F

where <username> is, well, your username. ;-)

This will give you access to the contents of that folder. Take a look and
see exactly how much room those files are taking up. I'm betting that's
where you'll find your missing gigs. If not, I have another theory but it's
a long shot.

Nice trick, especially the link to the security tab. I just assumed XP never
had it (I never use NT domain systems), and the lack of it had annoyed me in
the past. <bookmarked>

Unfortunately though, the missing space wasn't there. There was only one
restore point, consuming 30 meg of space. This was from an app I updated a
day or so ago, I recognised the exe's. So, it was valid to be there; I
assume XP must delete restore points after a period of time? I can't
remember manually emptying them (if that's even possible without this
trick), so the only explanation for the lack of others is that it's been a
while since anything was changed on it. Or, contradicting myself, it may
have purged them when the drive space almost hit 0% last week...

I was hoping to find a couple of files that had become orphaned from the
system, and were just floating around with no references to them in the
SysRestore system, and I'm guessing that's what you were hoping for.

Are there any other places where this trick will allow you to see into new
areas? I suspect that we are on the right track, just looking in the wrong
place...

Cheers,

Fraser.

 

[Sarge]

Unfortunately though, the missing space wasn't there. There was only
one restore point, consuming 30 meg of space.

I guess I lose the bet. :-(

Are there any other places where this trick will allow you to see into
new areas? I suspect that we are on the right track, just looking in
the wrong place...

Unfortunately none that I know of. Out of curiosity what does Disk
Management (Start - Run - compmgmt.msc then select Storage - Disk
Management from the left pane) say about the free space available on the C
drive?

The long shot I mentioned in the previous post had to do with alternate
data streams. It's possible (unlikely I'd think, but possible) that you
have a file or folder with a large ADS attached. The problem with this
theory is that you say "My Computer" reports a low amount of available
space on the drive, and I don't think alternate data streams are counted in
the "My Computer" calculation. In any event it might be an interesting
exercise to determine the size of any ADS on that drive. Take a look here
for a brief explanation:

http://www.heysoft.de/Frames/f_faq_ads_en.htm

Then download and run LADS:

http://www.heysoft.de/Frames/f_sw_la_en.htm

 

[Fraser]

Unfortunately none that I know of. Out of curiosity what does Disk
Management (Start - Run - compmgmt.msc then select Storage - Disk
Management from the left pane) say about the free space available on the C
drive?

It reports the same as the properties dialog on the drive, i.e. ~730 meg
free.

The long shot I mentioned in the previous post had to do with alternate
data streams. It's possible (unlikely I'd think, but possible) that you
have a file or folder with a large ADS attached. The problem with this
theory is that you say "My Computer" reports a low amount of available
space on the drive, and I don't think alternate data streams are counted in
the "My Computer" calculation. In any event it might be an interesting
exercise to determine the size of any ADS on that drive. Take a look here
for a brief explanation:

http://www.heysoft.de/Frames/f_faq_ads_en.htm

Then download and run LADS:

http://www.heysoft.de/Frames/f_sw_la_en.htm

Interesting, never heard of that sort of thing in NTFS. Everyday's a school
day!

I've ran the tool against C: (recursively), unfortunately it reported that
there were "0 bytes in 3 ADS listed". All three were just thumbs.db files.
Tried deleting them out of desperation, but no joy. Several other files came
back as in use and unable to check during the LADS scan; just the usual
suspects, the pagefile, ntuser.dat etc. The list of these is attached at the
end. I suppose it's quite possible that any one of these could have a hidden
stream.

Guess it's time to hook the drive up as a slave somewhere. Would the ADS
files still exist and be accessible when running as a slave? Won't be able
to do that until next week though. If I figure it out, I'll post back for
the record. May even raise a bug against it... ;-)

Finally, since making the attribute change you suggested in your previous
mail, I noticed that I now have full access to the drive...for example, in
Temporary Internet Files, the Content.IE5 folder is now visible without
doing anything special. I rechecked the My Computer and the C: properties;
the discrepancy is still there, so it's not super-hidden files as far as I
can tell (because they are now viewable).

Cheers,

Fraser.

C:\Documents and Settings\All Users\Application
Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application
Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\LocalService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\LocalService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
C:\Documents and Settings\LocalService\NTUSER.DAT
C:\Documents and Settings\LocalService\ntuser.dat.LOG
C:\Documents and Settings\Music\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\Music\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
C:\Documents and Settings\Music\NTUSER.DAT
C:\Documents and Settings\Music\NTUSER.DAT.LOG: The process can not access
the file because it is being used by another process
C:\Documents and Settings\NetworkService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\NetworkService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG
C:\Documents and Settings\NetworkService\NTUSER.DAT
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
C:\pagefile.sys
C:\WINDOWS\system32\config\default
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\SAM
C:\WINDOWS\system32\config\SAM.LOG
C:\WINDOWS\system32\config\SECURITY
C:\WINDOWS\system32\config\SECURITY.LOG
C:\WINDOWS\system32\config\software
C:\WINDOWS\system32\config\software.LOG
C:\WINDOWS\system32\config\system
C:\WINDOWS\system32\config\system.LOG
C:\WINDOWS\Temp\Perflib_Perfdata_710.dat



The following summary might be incorrect because there was at least one
error!



0 bytes in 3 ADS listed

 

[Sarge]

I've ran the tool against C: (recursively), unfortunately it reported
that there were "0 bytes in 3 ADS listed". All three were just
thumbs.db files. Tried deleting them out of desperation, but no joy.
Several other files came back as in use and unable to check during the
LADS scan; just the usual suspects, the pagefile, ntuser.dat etc. The
list of these is attached at the end. I suppose it's quite possible
that any one of these could have a hidden stream.

Well, it was worth a shot anyway.

Guess it's time to hook the drive up as a slave somewhere. Would the
ADS files still exist and be accessible when running as a slave?

They should -- they do on my machine. The alternate streams
remain intact as long as they reside on an NTFS-formatted partition. I
doubt any of the system files would be suspect but it wouldn't hurt to
take a look.

Won't be able to do that until next week though. If I figure it out,
I'll post back for the record.

Please do, I'd be interested in the outcome.

Finally, since making the attribute change you suggested in your
previous mail, I noticed that I now have full access to the
drive...for example, in Temporary Internet Files, the Content.IE5
folder is now visible without doing anything special.

Interesting. Windows Explorer wont show me the logged-in user's
Content.IE5 folder by default, I have to type in the path in order to see
it. Aint Windows grand? ;-)

 

[Fraser]

Please do, I'd be interested in the outcome.

Looking like I'll need to get this done after christmas now. Stupid of me to
actually plan on getting anything constructive done this week!

Have a happy holidays everyone!!

Fraser.