0

A client of ours has 4 standalone Hyper-V servers. We were looking for a way to better allocate file system resources to these servers. The process will likely take a couple of moves of Hyper-V guests in order to accomplish. I set out to document disk space usage among the servers. While looking at one of the Hyper-V servers, I noted that it had a drive that looked like it was "too full". On closer look, I found the following:

Drive Properties

The drive holds the Hyper-V files and the C: drive of a file server. The actual shared files are not in this folder.

The drive is connected via iSCSI to a QNAP LUN. Nothing else is on the LUN, and no other devices can connect to that LUN.

When I looked at the contents of the drive, it looked like only 150 GB or so should be in use. I also checked the Recycle Bin for all users on the machine. Basically empty. Certainly nothing that should add up to nearly 2 TB:

Used Space

I tried WinDirStat. It showed that only about 125 GB was in use, the same as the used space check.

WinDirStat showing disk usage

After some digging on the Internet, I tried choosing "Show Unknown" in the WinDirStat options, it showed a large "" file. Unlike other files shown in WinDirStat, the context menu is all grey:

WinDirStat showing large unknown file

So I dug some more. I ran TreeWiz. It showed the file name, date, and location in the directory. It also did not show a context menu for that file:

TreeWiz showing file WITH file name.

The file name indicated a vhdx from a file server that we had attempted to recover a couple of years ago. That file server VM never ran on this host, we just attempted to recover files here.

That said, we know what the file is, what the filename is, where it is, and how it got there.

Now I need to delete it.

I tried using the command prompt as administrator to delete it.

V:\>del .\file_user_data_restore.vhdx
Could Not Find V:\file_user_data_restore.vhdx

I tried using powershell as administrator.

PS V:\> remove-item .\file_user_data_restore.vhdx
remove-item : Cannot find path 'V:\file_user_data_restore.vhdx' because it does not exist.

The file does not show up on any built-in Windows tool that I can find. Any thoughts on how I can remove it, short of formatting the drive.

Who knew NTFS was so fragile.

Ken Simon
  • 1
  • 2
  • Does chkdsk show any errors? – Robert Nov 24 '20 at 21:26
  • @Robert Unfortunately I don't have a maintenance window to run chkdsk for at least 3 weeks. Break-fix only. If I have not resolved the issue before that, I will try chkdsk. – Ken Simon Nov 24 '20 at 22:32
  • I've had this experience with files created through WSL. They could only be deleted through WSL. Maybe you could try that? – Jaap Joris Vens Nov 25 '20 at 15:35
  • @Robert. Not sure where you got the idea that the system and user data were on the same drive. I attempted to be pretty clear in my initial post that this was on the V: drive, which was an iSCSI mount. Not the system partition. Exists on a completely separate machine. – Ken Simon Nov 25 '20 at 16:33
  • @KenSimon Sorry I mixed up different posts. But what about the read-only run of `chkdsk`? – Robert Nov 25 '20 at 18:35
  • @Robert Read only chkdsk worked fine. Found no errors. One more thing that happens to me that happens to no one else. – Ken Simon Nov 25 '20 at 20:07

1 Answers1

0

Thanks, all.

  1. chkdsk was unable to find error
  2. No Windows tool was able to find ANYTHING about the file, except that it was taking up space.
  3. No command line tool, either built in or sysinternals was able to see or manipulate the file.

I will be live migrating VMs followed by formatting the partition and starting over.

I am left with an even deeper distrust in NTFS.

Ken Simon
  • 1
  • 2