What's eating my drive space when normal files + hidden + system doesn't equal total drive space used

Question

This is very strange. All directory sizes are normal, and all other folders are within 20GB of what they should be. The discrepancy is that I can’t locate the files that are consuming 150GB of space in the bottom screenshot.

Below, I issued properties against many sub directories. The second screenshot is the size of the drive. Compare the space used and you’ll see a discrepancy of about 150GB on the single drive.

Does anyone know where this could be coming from? I am viewing all hidden and system files in explorer.exe

Properties of all files

Properties of drive

Update

C:\Users\>vssadmin List Shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Contents of shadow copy set ID: {4407d687-5021-4a57-a8bf-a94dd03428ce}
   Contained 1 shadow copies at creation time: 3/22/2012 7:09:43 PM
      Shadow Copy ID: {bf5b69c9-76cf-4218-b1ef-4c264ab3c468}
         Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
         Originating Machine: TXEXPF01.exchangeHost.com
         Service Machine: TXEXPF01.exchangeHost.com
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Exposed locally,
 Auto recovered

Contents of shadow copy set ID: {e2d1cc68-4afd-41ec-9e52-ef9e3f390e71}
   Contained 1 shadow copies at creation time: 4/28/2012 10:43:42 AM
      Shadow Copy ID: {3864609a-7f14-4b22-9cff-b3e74b7b568e}
         Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6
         Originating Machine: TXEXPF01.exchangeHost.com
         Service Machine: TXEXPF01.exchangeHost.com
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Exposed locally,
 Auto recovered

Contents of shadow copy set ID: {da92436b-bd7f-4e61-ab19-db3f8adbf47a}
   Contained 1 shadow copies at creation time: 5/23/2012 7:22:24 PM
      Shadow Copy ID: {f66b0c06-a0db-4765-b3d7-55634eb1a131}
         Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy9
         Originating Machine: TXEXPF01.exchangeHost.com
         Service Machine: TXEXPF01.exchangeHost.com
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Exposed locally,
 Auto recovered

Contents of shadow copy set ID: {2ea830c0-bf45-4c8f-9dbd-9a0060f70602}
   Contained 1 shadow copies at creation time: 7/5/2012 6:07:36 PM
      Shadow Copy ID: {1735116d-9166-4ce0-9dcb-ec57c61516ce}
         Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15
         Originating Machine: TXEXPF01.exchangeHost.com
         Service Machine: TXEXPF01.exchangeHost.com
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Exposed locally,
 Auto recovered

Contents of shadow copy set ID: {bcda7c37-ba89-426d-bf62-f7459e4051ea}
   Contained 1 shadow copies at creation time: 8/14/2012 8:56:02 PM
      Shadow Copy ID: {79ee42fc-7561-4eff-95d7-1750f18269f7}
         Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44
         Originating Machine: TXEXPF01.exchangeHost.com
         Service Machine: TXEXPF01.exchangeHost.com
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Exposed locally,
 Auto recovered


C:\Users\>vssadmin List Shadows > ShadowsSave.txt

Update 2:

Result of deleting the VSS images results in leftover images

C:\Users\ >vssadmin  delete shadows  /all
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Snapshots were found, but they were outside of your allowed context.  Try
 removing them with the
backup application which created them.


C:\Users\ >vssadmin  list shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Contents of shadow copy set ID: {2ea830c0-bf45-4c8f-9dbd-9a0060f70602}
   Contained 1 shadow copies at creation time: 7/5/2012 6:07:36 PM
      Shadow Copy ID: {1735116d-9166-4ce0-9dcb-ec57c61516ce}
         Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15
         Originating Machine: TXEXPF01.exchangeHost.com
         Service Machine: TXEXPF01.exchangeHost.com
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Exposed locally,
 Auto recovered

Contents of shadow copy set ID: {bcda7c37-ba89-426d-bf62-f7459e4051ea}
   Contained 1 shadow copies at creation time: 8/14/2012 8:56:02 PM
      Shadow Copy ID: {79ee42fc-7561-4eff-95d7-1750f18269f7}
         Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44
         Originating Machine: TXEXPF01.exchangeHost.com
         Service Machine: TXEXPF01.exchangeHost.com
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential, Exposed locally,
 Auto recovered


C:\Users\>vssadmin  delete shadows  /all
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Error: Snapshots were found, but they were outside of your allowed context.  Try
 removing them with the
backup application which created them.


C:\Users\ >

VSS snapshots? Try stopping and starting the "Microsoft Software Shadow Copy Provider" and the "Volume Shadow Copy" services. — joeqwerty, Aug 21 '12 at 16:35
@joeqwerty Tree Size says it's System Volume Information is eating the space. I restarted the services, but to no effect. The services you mention were stopped when I tried to restart them. — makerofthings7, Aug 21 '12 at 16:39
From a command prompt you can try vssadmin List Shadows to list the shadow copies and then vssadmin Delete Shadows to delete the listed shadow copies. — joeqwerty, Aug 21 '12 at 16:46

joeqwerty · Answer 1 · 2012-08-21T17:49:34.933

5

It's probably VSS snapshots. Try stopping and starting the "Volume Shadow Copy" service.

If that doesn't work then from a command prompt you can run:

vssadmin List Shadows

to list the shadow copies and then run:

vssadmin Delete Shadows

to delete the listed shadow copies.

The GUIDs in the System Volume Information folder are the list of VSS snapshots. You can list them and delete them with the vssadmin tool.

The System Volume Information folder is used by VSS when performing any backups using VSS aware backup applications, like Windows Server Backup or BackupExec

edited Aug 21 '12 at 17:49

answered Aug 21 '12 at 17:25

joeqwerty

108,377
6
80
171

We're using Backbone. Is this a bug? Should I collect additional information before deleting the files? – makerofthings7 Aug 21 '12 at 18:12
No, it's not a bug. The key is in the following: "Attributes: Persistent, No auto release, Differential, Exposed locally, Auto recovered". The Persistent attribute means that the shadow copy persists across reboots and the No auto release means that the shadow copy is not deleted when the shadow copy requestor (backup program that's calling VSS) ends. Try deleting them with vssadmin or manually. – joeqwerty Aug 21 '12 at 18:29
I feel uneasy about deleting VSS files manually since I don't have a deep enough understanding to know that this is safe to do. Do you have references for me to learn from? PS- I updated my answer with shadows I can't delete using the tool – makerofthings7 Aug 21 '12 at 18:35
They're safe to delete if you don't have any currently running backups or applications creating and using those snapshots. I just found this, which might help: http://angrytechnician.wordpress.com/2011/02/23/vssadmin-is-dead-long-live-diskshadow/. – joeqwerty Aug 21 '12 at 18:37

HopelessN00b · Answer 2 · 2012-08-21T17:33:12.913

2

It's files or folders you don't have permissions to view. (Or need to "take permissions" with a UAC prompt to view.) They'll show up as being 0 size, no matter how big they really are.

Like joeqwerty suggested, VSS snapshots are one source, so are the contents of System Volume Information (by default), other users' profile locations (blocked by default when UAC is enabled), and some other "miscellaneous" locations, by default... as well as anything that your user's been denied access to read by another administrative account or service.

Quickest way to track it down is to run WinDirStat and get a view of where your drive usage is actually coming from. (It uses calls to the command line utilities for viewing disk usage, so it doesn't have the same problems as the Explorer shell. Just remember to run it elevated.)

Since we've determined it's the VSS snapshots, you can free up the space by 1) manually deleting the GUIDs you see in System Volume Information, or 2) Changing the amount of disk space available to VSS. (I prefer #2, since it keeps the problem from coming back, unlike just deleting a bunch of VSS snapshots.)

Administrative Tools -> Computer Management -> Shared Folders (right click) -> All Tasks -> Configure Shadow Copies... -> Select Volume -> Settings.

Change the limit to something "proper." While you're in there, you can also delete individual shadow copies from the GUI.

VSS dialogue

edited Aug 21 '12 at 17:33

answered Aug 21 '12 at 16:41

HopelessN00b

53,385
32
133
208

I downloaded and installed winDirStat and it reports zero size for SysVol. I ran the app elevated (right click run as admin) – makerofthings7 Aug 21 '12 at 16:47
TreeSize Professional exposed System Volume information. I see a bunch of GUIDs there, but can't see anything else. Any specific guidance to reduce this would be appreciated. – makerofthings7 Aug 21 '12 at 16:49
@makerofthings7 Not a problem I've ever run into, but I'll take your word for it. If SVI is eating up all your space, on Server 2008, that would be shadow copies/previous versions (since it doesn't have System Restore). Tweak your settings downward to reduce drive usage if you need that space back. – HopelessN00b Aug 21 '12 at 16:55
Those GUIDs are the list of VSS snapshots. You can list them and delete them with the vssadmin tool as in my comment. Also, the System Volume Information folder is used by VSS when performing any backups using VSS aware backup applications, like Windows Server backup or BackupExec. – joeqwerty Aug 21 '12 at 17:23
There are zero shadow copies to delete... I'll update my question with the result of vssadmin's output – makerofthings7 Aug 21 '12 at 18:14

score 2 · Accepted Answer · answered Feb 02 '13 at 01:44

2

Although JowQuery's answer is correct in principal, the correct command to use in 2008 and newer is "diskshadow" followed by "delete shadows all"

answered Feb 02 '13 at 01:44

makerofthings7

8,821
28
115
196

Don't use this version if you have currently-in-progress backups running through a third-party, tool, though. `list shadows all` will show the active shadows and individual ones can be deleted with `delete shadows ID {id-goes-here}` – Andrew Maiman Mar 21 '14 at 20:29

What's eating my drive space when normal files + hidden + system doesn't equal total drive space used

3 Answers3

Linked