Loss of Hard disk space

[Guest]

All of a sudden my server is using 60Gb when it was using 5.5GB. I cannot
seem to find the files that have miraculously appeared to gobble up the
space. I have searched for large files as well as tried to go inside each
directory withhin the cmd window. Any suggestions?

 

[Michael Cecil]

All of a sudden my server is using 60Gb when it was using 5.5GB. I cannot
seem to find the files that have miraculously appeared to gobble up the
space. I have searched for large files as well as tried to go inside each
directory withhin the cmd window. Any suggestions?

http://www.win.tue.nl/sequoiaview/

 

[Leonard Severt [MSFT]]

All of a sudden my server is using 60Gb when it was using 5.5GB. I
cannot seem to find the files that have miraculously appeared to
gobble up the space. I have searched for large files as well as tried
to go inside each directory withhin the cmd window. Any suggestions?

I would suspect your server might have been hacked and someone is
storing files on the system. I have seen that before. That is assuming
you have high speed access to the Internet. Someone else pointed you to
software that you can use to search for large directories. You may find
that the files are in strange directoris or that they can't be deleted.
I would also look at running a chkdsk /f on the drive to make certain
there is not a file system problem. Let us know what you find and we can
give you additional steps.

Leonard Severt
Microsoft Enterprise Support

 

[Guest]

Hi Leonard:

I have assumed I have been hacked and have run chkdsk with no success. This
would tell me that I have some files I cannot see or view. I have made sure
that hidden files are shown. Any further suggestions?

JOhn

 

[Guest]

Hi Michael:

I will try that and let yo know.

Thanks

John

 

[Guest]

Hi Michael:

I tried SequuoiaView and it didnt help. There are no files nor folders
large enough to take up this space.

John

 

[Leonard Severt [MSFT]]

Hi Leonard:

I have assumed I have been hacked and have run chkdsk with no success.
This would tell me that I have some files I cannot see or view. I
have made sure that hidden files are shown. Any further suggestions?

JOhn

I would suspect your server might have been hacked and someone is
storing files on the system. I have seen that before. That is
assuming you have high speed access to the Internet. Someone else
pointed you to software that you can use to search for large
directories. You may find that the files are in strange directoris or
that they can't be deleted. I would also look at running a chkdsk /f
on the drive to make certain there is not a file system problem. Let
us know what you find and we can give you additional steps.

Leonard Severt
Microsoft Enterprise Support

You can try resetting permissions on the system.

http://support.microsoft.com/default.aspx?scid=kb;en-us;266118

If this does not work then you may have a root kit installed on the
system which can be very hard to detect. You can try booting in safe
mode to see if anything looks different. However most root kits will
also load in safe mode. The other thing you can try is getting a program
called Streams from www.sysinternals.com. It will show data streams in
NTFS which is how the data could also be stored.

Leonard Severt
Microsoft Enterprise Support