Allocation units

[mazorj]

In Vista 64 home premium SP1, in running chkdsk for C: at the end it states that there are 85,144,492 "total allocation units on disk" but the next line says there are 187,552 "allocation units available on disk". No disk errors were found.

1. What are allocation units and why are they there?

2. Does this mean I'm running out of allocation units? If 187,552 represents 0.22% of the 85,144,492, then are 99.78% of the total allocation units on the disk already in use and therefore not available for writing new files in the directories?

3. Will I hit some kind of brick wall here? If so, is there some way to free up allocation units before that happens?

 

[Ken Blake, MVP]

In Vista 64 home premium SP1, in running chkdsk for C: at the end
it states that there are 85,144,492 "total allocation units on disk"
but the next line says there are 187,552 "allocation units
available on disk". No disk errors were found.

1. What are allocation units and why are they there?

Space is allocated on the disk in units called "clusters" or
"allocation units." If your drive is NTFS, the default size of
allocation units is 4KB.

So if you have a file that's exactly 40KB in size. It uses 10
allocation units. If the file is 40KB plus one byte in size, it will
use 11 allocation units.

You apparently have a drive that's about 350GB in size. I got that
number by multiplying 85,144,492 by 4096. If you have 4K allocation
units the statements "you have 85,144,492 allocation units" and "you
have a 350GB drive" are equivalent.

2. Does this mean I'm running out of allocation units?

No, not really. It means you are running out of disk space.

If 187,552 represents 0.22% of the 85,144,492, then are
99.78% of the total allocation units on the disk already
in use and therefore not available for writing new files
in the directories?

You are running out of disk space.

3. Will I hit some kind of brick wall here?

You are running out of disk space.

If so, is there some way to free up allocation units before
that happens?

If you delete files you don't need, or make some of them smaller, you
will use less disk space and therefore fewer allocation units.

 

[mazorj]

Space is allocated on the disk in units called "clusters" or
"allocation units." If your drive is NTFS, the default size of
allocation units is 4KB.

Got it. Why didn't they just say "clusters"? Almost anyone from
pre-Vista days knows what those are.

....

You apparently have a drive that's about 350GB in size. I got that
number by multiplying 85,144,492 by 4096. If you have 4K allocation
units the statements "you have 85,144,492 allocation units" and "you
have a 350GB drive" are equivalent.

Close, the C: partition reports a usable size of 324 GB.

No, not really. It means you are running out of disk space.

Yes! I just checked the drive on the Computer window. It was down to
1.4 Gig free space. No way!

However, in a 6/12/09 post to the vista.general newsgroup ("Capturing
scrolled command line text") I asked about this. The only reply
addressed question #1 (capturing the boot scrolls) so I'll repeat the
rest here (minus #1) in hopes that someone can address the bigger
questions I posed:

"...after the June 10 MS downloads, on reboot I
saw something new to the effect that the OS could not resolve the
following drives - each of which was named with one of those long
gibberish filenames instead of drive letters. There were no error
messages for existing lettered drives... So,

"2. Does anyone know what's happening with these odd drive error
messages and whether I need to worry about it? [And could this be
a factor in the "disappearing" HD space on C:?]

"3. After the downloads and reboot (not immediately but a few hours
later), I started getting messages that my C: drive had zero available
bytes. Explorer also reported zero available bytes and so did
PowerDesk. Deleting files had no effect. Fortunately, the issue has
disappeared for now after a cold boot but what was that all about?
Anyone else get this after a recent batch of updates?"

This time (tonight) a cold boot did *not* clear up the drive space
issue. After some cleaning up, I'm still down to ~2.6 GB. Help!!!

TIA for any help on these two questions.

....

If you delete files you don't need, or make some of them smaller,
you will use less disk space and therefore fewer allocation units.

Prior to the onset of this problem, my HD was only about 1/3 full so
whatever is eating up disk space all of a sudden is doing it at a
prodigious rate - in days or even hours.

Shadow files may be eating up some space, but what could possibly eat
up 2/3 of a 324 GB HD in a few days??? (It took more than a year for
me to use up the first 1/3 of the HD space.) Even if it is shadow
files, I'm reluctant to use the routine that deletes all but the last
back-up/restore point because I may have to go further back than the
last one. Why doesn't Vista allow selective deletion of just some
of the previous restore points to free up space?

Is there anything I can look for on the C: drive to delete WRT big
back-up/restore files that may be the cause of filling my HD space?

Or is my only hope to do the restore point prior to the 6/10/09 MS
downloads and hope that cures it?

 

[Ken Blake, MVP]

Got it. Why didn't they just say "clusters"? Almost anyone from
pre-Vista days knows what those are.

I'm with you here. Unless the old name is really terrible, I'm almost
against changing the name of anything. Doing so results in confusion.

...

You apparently have a drive that's about 350GB in size. I got that
number by multiplying 85,144,492 by 4096. If you have 4K allocation
units the statements "you have 85,144,492 allocation units" and "you
have a 350GB drive" are equivalent.

Close, the C: partition reports a usable size of 324 GB.

No, not really. It means you are running out of disk space.

Yes! I just checked the drive on the Computer window. It was down to
1.4 Gig free space. No way!

However, in a 6/12/09 post to the vista.general newsgroup ("Capturing
scrolled command line text") I asked about this. The only reply
addressed question #1 (capturing the boot scrolls) so I'll repeat the
rest here (minus #1) in hopes that someone can address the bigger
questions I posed:

"...after the June 10 MS downloads, on reboot I
saw something new to the effect that the OS could not resolve the
following drives - each of which was named with one of those long
gibberish filenames instead of drive letters. There were no error
messages for existing lettered drives... So,

"2. Does anyone know what's happening with these odd drive error
messages and whether I need to worry about it? [And could this be
a factor in the "disappearing" HD space on C:?]

"3. After the downloads and reboot (not immediately but a few hours
later), I started getting messages that my C: drive had zero available
bytes. Explorer also reported zero available bytes and so did
PowerDesk. Deleting files had no effect. Fortunately, the issue has
disappeared for now after a cold boot but what was that all about?
Anyone else get this after a recent batch of updates?"

This time (tonight) a cold boot did *not* clear up the drive space
issue. After some cleaning up, I'm still down to ~2.6 GB. Help!!!

TIA for any help on these two questions.

...

If you delete files you don't need, or make some of them smaller,
you will use less disk space and therefore fewer allocation units.

Prior to the onset of this problem, my HD was only about 1/3 full so
whatever is eating up disk space all of a sudden is doing it at a
prodigious rate - in days or even hours.

Shadow files may be eating up some space, but what could possibly eat
up 2/3 of a 324 GB HD in a few days???

Spyware infection. What anti-spyware programs do you use? Are they
kept up to date?

(It took more than a year for
me to use up the first 1/3 of the HD space.) Even if it is shadow
files, I'm reluctant to use the routine that deletes all but the last
back-up/restore point because I may have to go further back than the
last one. Why doesn't Vista allow selective deletion of just some
of the previous restore points to free up space?

Because restore points are not complete. They build on their
predecessors. To use one, you also need previous ones.

Is there anything I can look for on the C: drive to delete WRT big
back-up/restore files that may be the cause of filling my HD space?

Or is my only hope to do the restore point prior to the 6/10/09 MS
downloads and hope that cures it?

A restore point will not solve this problem; it essentially does very
little besides restoring the registry to a previous state. Look into
spyware, and also examine your drive very carefully looking at the
space used by each folder to see where the problem is.

 

[Jeff Richards]

"Allocation units" is the term that has been used since the earliest
versions of CHKDSK for DOS 2. I think that's the only application that uses
the term - FORMAT uses clusters, and, like you say, everyone knows them as
clusters.

 

[mazorj]

Scrubbing readily accessible unneeded files (including several
thousand posts from the MSC newsgroups!) have kept me between 1.0 -
2.5 GB of free space but for the life of me I cannot find what quickly
ate up and continues to eat 200+ GB on the C: drive. I downloaded
Agent Ransack and use it to see what files are being modified but
couldn't spot any unusual recent disk writes.

However, in a 6/12/09 post to the vista.general newsgroup
("Capturing
scrolled command line text") I asked about this. The only reply
addressed question #1 (capturing the boot scrolls) so I'll repeat
the
rest here (minus #1) in hopes that someone can address the bigger
questions I posed:

"...after the June 10 MS downloads, on reboot I
saw something new to the effect that the OS could not resolve the
following drives - each of which was named with one of those long
gibberish filenames instead of drive letters. There were no error
messages for existing lettered drives... So,

"2. Does anyone know what's happening with these odd drive error
messages and whether I need to worry about it? [And could this be
a factor in the "disappearing" HD space on C:?]

I guess no one is able to address this question?

....
Already done.

Spyware infection. What anti-spyware programs do you use? Are they
kept up to date?

Have scanned with Norton (daily updates), SuperAntiSpyware, plus one
other whose name escapes me. Not a peep or a burp from any of them.

Because restore points are not complete. They build on their
predecessors. To use one, you also need previous ones.

Okay, but then why does Vista offer to delete all but the last restore
point?

 

[Ken Blake, MVP]

Have scanned with Norton (daily updates), SuperAntiSpyware, plus one
other whose name escapes me. Not a peep or a burp from any of them.

In my view, and that of many of us here, Norton is the *worst*
anti-virus program available. I wouldn't rely on what it tells you.

SuperAntiSpyware, on the other hand, is one of the best anti-spyware
programs available. However, I would recommend that you download and
run the free Malwarebytes program, which is the best anti-spyware
program available today.

 

[mazorj]

In my view, and that of many of us here, Norton is the *worst*
anti-virus program available. I wouldn't rely on what it tells you.

How current is that view? There was a time when Norton was indeed
mediocre after resting on their laurels but they seem to have gotten
their act together lately. No single program can catch everything
but, knock on wood, I'm not aware of any malware on my system since it
came with my HP desktop. And my e-mail and Web security practices
could be described as being at the Paranoia +1 setting so it's not
like I'm flirting with known security risk behaviors.

SuperAntiSpyware, on the other hand, is one of the best anti-spyware
programs available. However, I would recommend that you download and
run the free Malwarebytes program, which is the best anti-spyware
program available today.

I've been scanning with all 3 (Malwarebytes is the third one I
mentioned but couldn't remember the name of). If all 3 of these are
reporting no malware then either my system is clean, or I've been
zapped by malware so undetectable that probably only a complete system
re-install can cure it. Backing up data files is not a problem, but
I'd rather have my appendix removed with a butter knife and no
anesthesia than recreate everything on a machine with dozens of
software titles and years of tweaking. :-(

I'm barely hanging on today at 1.06 GB but it's hard to figure what's
going on. In the second or two that it takes to check the C: drive
properties, close it, hit Refresh and reopen it, I get very fast
fluctuations of +/- 200,000 bytes of free space. Occasionally the
number doesn't change for several readings but Task Manager doesn't
show any processes making those kinds of disk writes. Only the usual
programs show any CPU usage and nothing is above 3% and only for a few
seconds. All that may be incidental to my problem of what happened to
200 GB of free space but it's still weird.

CHKDSK reports the same disk size and the same paltry empty space
available as the Computer window icon for C: drive, so there's no
mis-match there.

I don't think anyone else is going to offer a solution so my next step
is doing a restore to just prior to the June 10 batch of downloads,
which is when this problem cropped up. Even if a restore point isn't
necessarily a logical choice of action, barring an undiscovered
miraculous solution, I've been reduced to either this, a complete
system restoration, or waiting for the end - be it with a bang or a
whimper.

 

[Ken Blake, MVP]

How current is that view? There was a time when Norton was indeed
mediocre after resting on their laurels but they seem to have gotten
their act together lately.

They are, in general, a lot worse than mediocre.

However, bear in mind that the latest version, AntiVirus 2009, has
gotten much better reports from several people, several of whom I
trust. However I have no personal experience with it, and I am not
willing to use it myself, nor even to yet recommend it to anyone else.

No single program can catch everything
but, knock on wood, I'm not aware of any malware on my system since it
came with my HP desktop. And my e-mail and Web security practices
could be described as being at the Paranoia +1 setting so it's not
like I'm flirting with known security risk behaviors.


I've been scanning with all 3 (Malwarebytes is the third one I
mentioned but couldn't remember the name of). If all 3 of these are
reporting no malware then either my system is clean, or I've been
zapped by malware so undetectable that probably only a complete system
re-install can cure it.

I don't know what your situation is, but it *is* possible that you are
infected with malware that none of the above can catch.

Backing up data files is not a problem, but
I'd rather have my appendix removed with a butter knife and no
anesthesia than recreate everything on a machine with dozens of
software titles and years of tweaking. :-(

I understand. It's a substantial effort, and one that I would
recommend only as a last resort.

 

[mazorj]

....

They are, in general, a lot worse than mediocre.

However, bear in mind that the latest version, AntiVirus 2009, has
gotten much better reports from several people, several of whom I
trust. However I have no personal experience with it, and I am not
willing to use it myself, nor even to yet recommend it to anyone
else.

I'm using NIS 2009. NIS 2008 came with the machine but I checked
reviews before renewing my subscription and updating it. Almost
everyone seems to agree that it's much improved over the old Norton
with its well-deserved poor reputation. It may not be everyone's #1
pick, but there's no reason to shun it as in the past. If it comes
bundled, it's certainly good enough as your starting point.

However, I'm a belt and suspenders type on security. No reason why
you cannot and should not have an arsenal of several security
sweepers. I had SpySweeper and ZoneAlarm running on my XP machine
back when Norton was sucking wind in the security apps market. (Just
don't run two firewalls at once.) And yes, theoretically I might
still have malware even though three separate, reputable sweepers
couldn't find anything, and theoretically there might be one obscure
program out there that could catch it; but with three sweepers in
action, I'm already verging into diminishing returns. If my 200 GB
"vanishing unused disk space" problem is due to malware rather than
some obscure process run amok, I'll never find it.

Anyway, thanks for the comments.

 

[Ken Blake, MVP]

I'm using NIS 2009. NIS 2008 came with the machine but I checked
reviews before renewing my subscription and updating it. Almost
everyone seems to agree that it's much improved over the old Norton
with its well-deserved poor reputation.

Yes, as I said, I've heard much the same thing from others I respect.

It may not be everyone's #1
pick, but there's no reason to shun it as in the past. If it comes
bundled, it's certainly good enough as your starting point.

It's not that I shun NIS 2009 or Norton AntiVirus 2009. It's that I
shun Symantec. They have been an extremely poor and unreliable company
in recent years, and until they convince me that are much better than
they used to be, I won't have anything to do with them or any of their
products. Norton AntiVirus 2009 *may* be a first step for them to
convince me of that, but it's not enough for me yet. I'm waiting to
see what the future brings.

However, I'm a belt and suspenders type on security. No reason why
you cannot and should not have an arsenal of several security
sweepers. I had SpySweeper and ZoneAlarm running on my XP machine
back when Norton was sucking wind in the security apps market. (Just
don't run two firewalls at once.) And yes, theoretically I might
still have malware even though three separate, reputable sweepers
couldn't find anything, and theoretically there might be one obscure
program out there that could catch it; but with three sweepers in
action, I'm already verging into diminishing returns. If my 200 GB
"vanishing unused disk space" problem is due to malware rather than
some obscure process run amok, I'll never find it.

Anyway, thanks for the comments.

You're welcome.

 

[mazorj]

Yes, as I said, I've heard much the same thing from others I
respect.

BTW, I wouldn't bother with Norton 360. Too much "suite bloat". NIS
is the one to get if you're focused on security.

It's not that I shun NIS 2009 or Norton AntiVirus 2009. It's that I
shun Symantec. They have been an extremely poor and unreliable
company
in recent years, and until they convince me that are much better
than
they used to be, I won't have anything to do with them or any of
their
products. Norton AntiVirus 2009 *may* be a first step for them to
convince me of that, but it's not enough for me yet. I'm waiting to
see what the future brings.

I date the downslide of Norton, which had very good DOS utilities, to
around the time of the Symantec takeover.

 

[mazorj]

....

Spyware infection. What anti-spyware programs do you use? Are they
kept up to date?
...
Ken Blake, Microsoft MVP - Windows Desktop Experience
Please Reply to the Newsgroup

Well, it wasn't malware but you were right, Ken, in that the loss of
"allocation units" was due to C: filling up. It turned out to be
embarrassingly simple, although I had tried all kinds of ways to spot
the mysterious "dark matter" monster file(s) and how they were
created. I used several file management tools to list recently
created files, watched reads/writes with Task Manager and other
monitors, but no luck. It wasn't until I fired up Defrag-a-File
tonight that the answer became apparent. All the space that
previously had shown in white as unused was marked in red as a
fragmented file or files.

Clicking anywhere on this whopping big stretch of red space showed the
same filename - procmon.pmb in C:\Windows. It had been created
6/10/09, the same day I did the monthly MS downloads and right about
the time that my empty disk space suddenly evaporated. It was 200+
GB, which is the amount of available space that had disappeared.

Apparently either something I downloaded triggered the boot monitoring
process that then created this file after I did the post-download
reboot; or I initiated boot monitoring before that reboot (although I
don't remember doing so and can't imagine why I would have).

Bottom Line: procmon.pmb was deleted without any hassle from OS user
rights/protections, the missing available space has been restored and
defragmented, and I assume I'll be no worse off for doing so.

I'm filing this After Action report so that you and the others here
can add this to your personal knowledge base of file management, not
to mention the Defrag-a-File trick. And believe me, after sweating
this one out, I'm not ever going to forget it!

 

[Ken Blake, MVP]

Well, it wasn't malware but you were right, Ken, in that the loss of
"allocation units" was due to C: filling up.

Glad to hear it wasn't malware. Yes, as I tried to explain, using
allocation units *means* the drive is filling up. That's what
allocation units are.

It turned out to be
embarrassingly simple, although I had tried all kinds of ways to spot
the mysterious "dark matter" monster file(s) and how they were
created. I used several file management tools to list recently
created files, watched reads/writes with Task Manager and other
monitors, but no luck. It wasn't until I fired up Defrag-a-File
tonight that the answer became apparent. All the space that
previously had shown in white as unused was marked in red as a
fragmented file or files.

Clicking anywhere on this whopping big stretch of red space showed the
same filename - procmon.pmb in C:\Windows. It had been created
6/10/09, the same day I did the monthly MS downloads and right about
the time that my empty disk space suddenly evaporated. It was 200+
GB, which is the amount of available space that had disappeared.

Apparently either something I downloaded triggered the boot monitoring
process that then created this file after I did the post-download
reboot; or I initiated boot monitoring before that reboot (although I
don't remember doing so and can't imagine why I would have).

Bottom Line: procmon.pmb was deleted without any hassle from OS user
rights/protections, the missing available space has been restored and
defragmented, and I assume I'll be no worse off for doing so.

I'm filing this After Action report so that you and the others here
can add this to your personal knowledge base of file management, not
to mention the Defrag-a-File trick. And believe me, after sweating
this one out, I'm not ever going to forget it!

Thanks very much. I hadn't been aware of this issue, but I just read
some more about it here:
http://forum.sysinternals.com/forum_posts.asp?TID=12517

 

[mazorj]

....

Thanks very much. I hadn't been aware of this issue, but I just read
some more about it here:
http://forum.sysinternals.com/forum_posts.asp?TID=12517

That's where I learned its source and that it was okay to delete it.

Some of us do perform our homework before taking any actions or
posting here. ;-)