6

We run 12 Dell Optiplex 755 desktop computers. All of them have the exact same hardware and softawre, configured exactly the same. As such, they are all:

  • running Windows XP
  • on the same network
  • denied access to the internet
  • running with Windows updates up to as recently as November 2011
  • running with virus definitions up to as recently as November 2011

One computer today reported that it was running low on disk space - indeed it reported that it had less than 6GB remaining of an 80GB drive. All of the other computers are sitting in the realm of 64 GB free on their hard drives.

I ran a check through the file system and could only account for maybe 6-7 GB on the file system, so I ran WinDirStat and it reported that there was a 50 GB block of data labled as "Unknown".

I did my research and did the following things:

  • Ran WinDirStat as an administrator, so the app had access to everything
  • I checked System Restore - It is configured to only use up to 9GB for it's restore points.
  • The Volume Shadow Copy service is not running, and is set to be manually run.
  • Chkdsk completed with no errors.

The only difference between this computer and the rest in production is that this machine was recently one of two that were deployed (several months ago) to replace a couple that failed for unrelated reasons. The other computer has not exhibited any symptoms.

We cannot figure out what this massive inaccessible block of hard drive space is, and we would like it back. Any help would be greatly appreciated.

2
  • So there's no file in the filesystem, but 50GB of disk space is somehow occupied? Is the partition table intact? Feb 28, 2012 at 21:13
  • 1
    Has the computer ever been connected to the internet? If so, it might be worth checking for a root kit that might be hiding files on the file system.
    – Bryan
    Feb 28, 2012 at 21:23

2 Answers 2

2

As I read this 3 obvious causes come to mind:

  1. root-kit: You're best bet is to boot from clean media (like a Linux live-cd) and scan the disk from there using one of the online virusscanners. Even if the scanner doesn't see anything suspicious you might see some very large files or weirdly named folders on the disk that would otherwise be invisible from the infected system.
  2. Some sort of disk-corruption that chkdsk misses. Did you ran chkdsk during boot instead of on the online file-system already ? If not try that first. (Run chkdsk c: /X from a cmd prompt to force it into a boot-time chkdsk.) If that is clean too a disk-corruption issue seems unlikely.
  3. Some sort of hidden file (like an ADS stream) that got completely out of hand. Try clearing the Internet Explorer cache. This is full of ADS streams that are completely invisible and sometimes get 'run away'. There is a tools to hunt ADS files down in the SysInternals Suite. You can give that a try too.
0

Check your System32 folder for junk content. In particular, look for files that have been copied from the root of other drives.

In my situation, there are at least two drives that have had content copied off their root system to my System32 folder.

Using WinDirStat to check after deleting folders that I KNOW shouldn’t be there, I found the size of “unknown” reduced.

If anyone can help figure out which of these files shouldn’t be there, it’ll help my clean up efforts!

I have posted this issue to Microsoft support at http://social.technet.microsoft.com/Forums/systemcenter/en-US/877b155a-9c66-4aa6-9c64-9efc2e787978/junk-content-in-system32?forum=w8itprogeneral

You must log in to answer this question.