Hard Drive Space Disappeared

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I was noticing some degradation in performance yesterday and looked at my HDD
usage. In the 35 GB of the hard drive, only 4 GB was available - and this
after dumping the trash bin and offloading a mess of documents. I've looked
at all the directories that I can see, including hidden directories, and can
account for only 12 GB of the 31 GB in use. Microsoft technical documents I
can find talk about running ntbackup.exe, which doesn't appear to be
available on my laptop. Those documents indicate there may have been a
corruption of the drive with files that contain leading blanks not recognized
by the file system. Anyway, I appear to be at a dead-end, unable to identify
and remove 23 GB of files. Does anyone have suggestions on how I might
proceed?
 
Take a look at CCleaner as a tool to remove Internet history info, cookies,
temp files, auto complete and other junk. In the 'Windows' tab listing check
the item types you want deleted.
Also available is customization, see Options/Custom to add any
other/additional folders you want files deleted from.

http://www.ccleaner.com/

JS
 
I am not sure whether you are seeing all files and folders. Go to Start,
Control Panel, Folder Options, View, Advanced Settings and verify that
the box before "Show hidden files and folders" is checked and "Hide
protected operating system files " is unchecked. You may need to scroll
down to see the second item. You should also make certain that the box
before "Hide extensions for known file types" is not checked. Next in
Windows Explorer make sure View, Details is
selected and then select View, Choose Details and check before Name,
Type, Total Size, and Free Space. Even then there are still certain
folders that remain hidden and this regularly promps discussion about
"lost" disk space. The System Volume Information folders containing
System Restore points, which by default is allocated 12% of the drive /
partition, is just one example of what remains hidden.

The size of files and free space reported by Windows Explorer can also
mislead. Compressed files mess up reporting.

It is likely that an allocation of 12% has been made to System Restore
on your C partition which is over generous. I would reduce it to 700
mb. Right click your My Computer icon on the Desktop and select System
Restore. Place the cursor on your C drive select Settings but this
time find the slider and drag it to the left until it reads 700 mb and
exit. When you get to the Settings screen click on Apply and OK and
exit.

Another default setting on a large drive which could be wasteful is
that for temporary internet files especially if you do not store
offline copies on disk. The default allocation is 3% of drive.
Depending on your attitude to offline copies you could reduce this to
1% or 2%. In Internet Explorer select Tools, Internet Options,
General, Temporary Internet Files, Settings to make the change. At the
same time look at the number of days history is held.

The default allocation for the Recycle Bin is 10 % of drive. Change to
5%, which should be sufficient. In Windows Explorer place the cursor
on your Recycle Bin, right click and select Properties, Global and
move the slider from 10% to 5%. However, try to avoid letting it get
too full as if it is full and you delete a file by mistake it will
bypass the Recycle Bin and be gone for ever.

Select Start, All Programs, Accessories, System Tools, Disk CleanUp to
Empty your Recycle Bin and Remove Temporary Internet Files. Also
select Start, All Programs, accessories, System Tools, Disk CleanUp,
More Options, System Restore and remove all but the latest System
Restore point. Run Disk Defragmenter.

Using Disk CleanUp you need to run it in all User Profiles. cCleaner
avoids that necessity. Also the More Options suggestion above could
well have been overlooked when you ran Disk CleanUp. cCleaner
does not touch Restore Points.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
Thank you JS & Gerry. I have followed your suggestions, but didn't end up
with any significant change to the file space availability. (I had done most
of what you had suggested already, but gave it another try for completeness
sake).

Having set the files so I could see them all as suggested by Gerry, I did a
Select All, Properties, and get: 49,197 Files, 5,900 Folders, 13.1 GB Size,
11.7 GB Size on Disk. However, if I select Explore, My Computer, right click
Properties, I get: File System NTFS, Used Space 28.8 GB, Free Space 3.86 GB.
Disk Defragmenting doesn't want to run because there's not 15% free space,
but if I force a run, it does complete and reports Volume Fragmentation of
38% total, 73% File Fragmentation and 4% Free space fragmentation. I'm still
suspecting a corruption of some sort, but don't know where to go next. Your
thoughts?
 
This is brute force and you may not want to do it but...
Start by checking each folder (and files, including the pagefile size) under
the root (Examples: C:\ and C:\Windows and C:\Documents and Settings). You
will be looking for anything that appears out of the norm. On my PC for
instance C:\Windows takes up about 3GB and has over 14,000 files and 1002
folders. This may be smaller than some systems as I have removed almost all
the Windows Update folders (see below). Once you have checked the folders
and files under the root if any seem way too big starting checking the
subfolders.

Now as to the Windows Update Folders (Example: $NtUninstallKB27891$)
These folders and associated files in these folders are safe to remove,
however once deleted you will no longer be able to un-install a patch or
update that was associated with the deleted folder/files.
I would keep the most recent set (last two months just in case) of folders
and delete the older updates.
As a safety net I burned these folders to a CD before deleting them.

Warning: One folder you should not delete is: $hf_mig$

Also See Doug Knox's page on this issue:
http://www.dougknox.com/xp/utils/xp_hotfix_backup.htm

JS
 
Are you using a backup programme like Norton Ghost?

System Restore will account for nearly 4 gb of the difference, unless
you followed my suggestion when it will be 0.7 gb. The Recycle Bin just
over 3.2 gb.

Do you use the Hibernation feature?

If your hard drive is formatted as NTFS another potential
gain arises with your operating system on your C drive.
In the Windows Directory of your C partition you will have
some Uninstall folders in your Windows folder
typically: $NtServicePackUninstall$ and
$NtUninstallKB282010$ etc.

These files may be compressed or not compressed. If
compressed the text of the folder name appears in blue
characters. If not compressed you can compress them.
Right click on each folder and select Properties,
General, Advanced and check the box before Compress
contents to save Disk Space. On the General Tab you
can see the amount gained by deducting the size on disk
from the size. Folder compression is only an option on
a NTFS formatted drive / partition.

Another default setting on a large drive which could be

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
OK, JS & Gerry, I can't work on this issue for a couple of days, but wanted
to respond to the questions I know the answer to now, and will take time
early next week to address the others.
1. I don't think I have any backup program like Norton Ghost.
2. System Restore is set for 1 GB. Recycle bin is 2% or 0.7 GB.
3. Yes, I use the hibernation feature extensively. In fact, one reason I
suspected a problem was that the system wasn't (and I think still isn't)
going into hibernation when I close the lid any longer. Is this a
significant issue?
4. I'll see what success I can have with deletion of uninstall folders, and
appreciate your caution to burn them to a CD just in case. Likewise, I'll
try compressing any folder not already compressed, as I do have an NTFS
formatted drive.

Finally, Gerry, you'll note on your last response a line that says, "Another
default setting on a large drive which could be". Can you finish the thought?

I appreciate your help
 
I would only compress the files JS has suggested deleting. I am more
cautious than JS but then in recommending deleting he is in good
company.

Missing information is only a repeat of an earlier post you have taken
into account. I failed to delete that line.

Are you running any Norton products. Norton Protected Storage can stay
invisible.

Are all Temporary Files being removed?

How much Disk Space is still not accounted for?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
As Gerry said compressing them is safer, either way (I should have mentioned
this before) you will not gain more than about 2GB or less by deleting them
depending what MS products you have installed.

JS
 
I have - as best as I could - followed the advice Gerry & JS have provided,
with no improvement in disk space. Here are the details:

Hard file size = 32.7 GB (Actually, there's a 2nd partition of 4.5 GB on the
drive, for a total of about 37 GB. Perhaps the 2nd partition holds the OS?)

Space Used = 28.9 GB according to the Properties.

Space Available = 3.8 GB

If I highlight all (including hidden) files in the C: drive from explore, it
says there is 11.7 GB being used. I have done a folder by folder analysis,
without finding any folder that looks bloated, and the total I come up with
(ignoring folders that have less than 1 MB) is 9.9 GB.

Space missing without explanation = 16.2 GB. This seems like it's like an
elephant being missing in a broom closet. It ought to be obvious, but I
can't find it.

All the Windows Uninstall files were already compressed. They take up < 200
MB. System Restore has been minimized as has the Recycle Bin. There is
about 0.1 MB in use by temporary files. Compressing old files can save
another 0.2 MB - clearly peanuts in comparison with what's missing. I do not
find any functional Norton software on the system.

I use the hibernation feature of the laptop extensively.

I'm thinking we've covered all the obvious places to look and had no
success. It's almost like there is mirroring being done, but I'm not looking
in the right place to identify that.

I've read about files that can't be recognized by Windows due to leading
spaces in their names - corruptions either on purpose or by accident. Can
you comment on whether that's a possibility and how to find them if present?
Or can you suggest a new path to take that might lead me to a solution?

Once again, thanks for your help.
 
How large is hiberfil.sys. This is a hidden file like the contents of
the System Volume Information folder. It needs to go into your
reconcilation.

Quote by Shenan Stanley
"When you hibernate your computer, Windows saves the contents of the
system's memory to the hiberfil.sys file. As a result, the size of the
hiberfil.sys
file will always equal the amount of physical memory in your system."

Are you using Windows Live OneCare? I am not sure whether this is
relevant but if you are I could check it out.

Another way to check what is in your C partition is to use Windows
Explorer to search for files over 1 mb. Check Size, At Least, enter
500000 and check Advanced Options and the first three items in Advanced
Options. You should see pagefile.sys. What do you find?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

What is the make and model of your computer. Knowing it could with
finding out the purpose of your second partition.
 
saxman said:
I have - as best as I could - followed the advice Gerry & JS have provided,
with no improvement in disk space. Here are the details:

Hard file size = 32.7 GB (Actually, there's a 2nd partition of 4.5 GB on the
drive, for a total of about 37 GB. Perhaps the 2nd partition holds the OS?)

Space Used = 28.9 GB according to the Properties.

Space Available = 3.8 GB

If I highlight all (including hidden) files in the C: drive from explore, it
says there is 11.7 GB being used. I have done a folder by folder analysis,
without finding any folder that looks bloated, and the total I come up with
(ignoring folders that have less than 1 MB) is 9.9 GB.

Space missing without explanation = 16.2 GB. This seems like it's like an
elephant being missing in a broom closet. It ought to be obvious, but I
can't find it.

All the Windows Uninstall files were already compressed. They take up < 200
MB. System Restore has been minimized as has the Recycle Bin. There is
about 0.1 MB in use by temporary files. Compressing old files can save
another 0.2 MB - clearly peanuts in comparison with what's missing. I do not
find any functional Norton software on the system.

I use the hibernation feature of the laptop extensively.

I'm thinking we've covered all the obvious places to look and had no
success. It's almost like there is mirroring being done, but I'm not looking
in the right place to identify that.

I've read about files that can't be recognized by Windows due to leading
spaces in their names - corruptions either on purpose or by accident. Can
you comment on whether that's a possibility and how to find them if present?
Or can you suggest a new path to take that might lead me to a solution?

Once again, thanks for your help.
Click to expand...

It is pretty hard to guarantee that you see everything on a disk. For example,
I've heard of rootkits, where they replace a system file, and that compromised
system file prevents any file beginning with a certain first letter from being
listed. That allows hidden directories, like where the root kit is located. So
asking the OS, what files are present, could in fact return a wrong answer,
because the system is compromised.

Disks have a capability to support HPA or host protected area. A reason for doing
that, might be to hide a recovery partition. The "total size" of the disk may
report less than what the user knows the physical size of the disk to be. If
the properties of the disk appear "normal", then perhaps an HPA isn't being used.
HPA effectively changes the declared physical size of the drive.

*******
You can get ATA/ATAPI specs here. Password is listed on the first link.
See "4.9 Host Protected Area feature set" in the first document, for features.

http://www.t13.org/FTPSite/Default.aspx

ftp://ftp.t13.org/docs2002/d1532v1r1a-ATA-ATAPI-7.pdf (a volume 1)
ftp://ftp.t13.org/docs2002/d1532v2r1a-ATA-ATAPI-7.pdf (a volume 2)
*******

In your situation, I would be hard pressed to guarantee I could see all
files. I think I've even tried examining my Windows disk in Linux, and not
everything was visible. Commercial forensic software might be able to do
a better job of seeing stuff.

I found this toy. It runs from the DOS prompt. Disk Usage from sysinternals.

http://www.microsoft.com/technet/sysinternals/FileAndDisk/du.mspx

This is the command syntax I used in a DOS box, while CD'ed into the
directory containing du.exe .

du -v c:\ >out.txt

At the end of the run, it tells me the totals, as in:

Files: 24473
Directories: 2505
Size: 13,504,574,025 bytes
Size on disk: 12,610,603,430 bytes

Anything outside of the ordinary, is probably not visible that way.
But it only takes a few minutes to run.

If I do properties on my C drive, my used space is 12,763,529,216 so
I'm missing a small bit.

Paul
 
With apologies, I thought I'd posted a reply yesterday, but see today that
there's nothing shown.

Tried the JS suggested JDiskReport, which is indeed a slick way to visualize
the stored data. It shows 13 GB of the 33 GB allegedly in use, which is
consistent with all the other work I've done. It also answers the question
that Gerry asked about the size of hiberfil.sys: 900 MB. I don't use
Windows LiveOne Care, so that's not a viable solution path.

The other suggestion from Gerry was to search for files of 0.5 MB and
greater. This confirmed the result of JDiskReport - same large files
identified and nothing additional learned. (So I wouldn't have needed the
JDiskReport, but it's color charting is so neat, I'm glad I have it).

The disk utilization evaluation suggested by Paul also provided the same
basic information. I tried reading the ATAPI specs to see if there was
something there I could utilize, but this was beyond my comprehension level.

Finally - I called the hard disk drive (not much) help line for the HDD
manufacturer. Their recommendation was to back up the HDD and reformat it,
which was not what I wanted to hear, but may be the only option, unless one
of you wizards is able to perform some magic.

Once again, I appreciate your efforts.
 
If you have a USB drive or can borrow one from a friend to store the image
backup it might prove useful to see what the size of the image file is after
the imaging has completed. I say this because on my PC the resultant image
file size (using Ghost set at a middle level of compression) is about 50% of
the actual used space on my C: drive.

In your case if the image file is half the size of the approximately 30GB
that is reported as used, then reformatting and restoring the image will
only result in the same predicament you have now. However if the image file
is only about 7GB (about half of what JDisk reports) then the format and
restore should fix the problem. While I use Norton Ghost there is another
utility which is recommended by a number of people called True Image (has a
15 day trial free version which should be good enough for the purposes of
this test.)
http://www.acronis.com/homecomputing/products/trueimage/

JS
 
Back
Top