29

On a Windows 2019 Server the drive D: is 100% full (500 Gb used):

enter image description here

I'm trying to understand why the disk is full but I can't because both File Explorer and Total Commander reports no more than 33 Gb used:

enter image description here

enter image description here

It's also strange that WinDirStat reports 100% (500 Gb) used in the start summary, but only 33 Gb used after the analysis:

enter image description here

enter image description here

Please note that:

  • I'm logged in as Administrator
  • I started WinDirStat with Administrator privileges
  • I tried with both local Administrator and Active Directory Domain Admin
  • I enabled hidden and system files in File Explorer and Total Commander
  • I ran chkdsk on the D: drive without finding any issue

I found 33 Gb of data. Where are other 467 Gb?

Improve this question
3
  • What is the result when you run vssadmin list shadowstorage ?
    – user5870571
    Aug 29, 2020 at 20:05
  • @user5870571: No items found that satisfy the query.
    – Mat
    Aug 29, 2020 at 20:10
  • What Services are your running? Do you have automatic backups of the servers content? What are you using Windows Server 2019 for? Please give us some other information. Also were you doing anything out of the ordinary earlier in the week or weeks messing with system settings that may have caused this?
    – Arkest Must
    Aug 30, 2020 at 7:45

4 Answers 4

Reset to default
58

You could try WizTree (wiztreefree.com), which is similar to WinDirStat but it bypasses the filesystem driver and reads the MFT directly if run as an administrator. It will show space taken by alternate data streams, metadata files ($MFT, $Secure, $BadClus, etc.), and directories you don't have access to. It doesn't appear to show space allocated for directory indexes, and it may miss some other things, but I wouldn't be surprised if the culprit does show up.

Improve this answer
1
  • 27
    Thanks! I used WizTree instead of WinDirStat and I found that there was a directory which I had not access to, and it contains all of hidden data! Now I'm fixing permissions, thank you very much!
    – Mat
    Aug 30, 2020 at 7:53
15

I couldn't edit my comment any longer so I post it as an answer.

I've met once such an incident: It was due to Alternate Data Streams, a feature of NTFS for classic MacOS compatibility in shared folders. Unfortunately this ill-fated feature can be used for malicious purposes. In simple terms, it can be used to fill up your disk but the reserved space cannot be located, as in your case. If you want to check on this, I suggest MS sysinternals tool, streams.

Just beware that there are used in some legitimate cases, for example MS SQL server prior to 2014 uses them.

Improve this answer
9
  • 1
    I did not find any ADS, fortunately! Thanks!
    – Mat
    Aug 30, 2020 at 7:51
  • 3
    Alternate data streams are widely used for tainting files downloaded from the Internet (:Zone.Identifier), for the new NTFS compression methods in Windows 10, and probably for other purposes. I wouldn't call it an ill-fated feature. The problem is that directory-traversing functions don't return any information about the alternate streams, so you have to open every file to check for them (as far as I know).
    – benrg
    Aug 30, 2020 at 17:11
  • I called them ill-fated because they are not obvious, needing special tools to locate them and thus used for malicious purposes. Also have in mind that on ReFS, MS's new file system, ADS are no longer available. Probably that's why SQL 2014 and newer stopped using them, in order to be able to be installed on ReFS formatted volumes.
    – Krackout
    Aug 30, 2020 at 22:07
  • 1
    @Krackout alternate data streams were initially not implemented in refs, but they were added later. Ill-fated implies that there was some untimely demise or infamous misuse, which isn't really true
    – PC Luddite
    Aug 31, 2020 at 6:48
  • 1
    @Krackout it may just be a matter of semantics, but when I say infamous, I mean prevalent to the point that its misuse outweighs the actual usefulness. This is not something I had even heard of happening before, I had only known about its intended use, which is why I hesitate to call it "infamous". It's more of an edge case in my eyes, but I could be wrong.
    – PC Luddite
    Aug 31, 2020 at 14:34
7

The default permissions on C:\System Volume Information are NT AUTHORITY\SYSTEM:(OI)(CI)F. This means that even when you Run as Administrator you can't normally see files in it. You can use e.g. psexec to launch an application under the Local System account, which will then allow WinDirStat et. al. to display everything, or you can use it to add Administrators to the ACL. In particular, if you are using Previous Versions then the volume shadow copies are stored within this directory, and these can get quite large.

Improve this answer
1

This was very useful. I've found that Windows Server 2019 has set the default size of the Failover Clustering Diagnostic log to 18014398507384832Kb (!) so server disk was filling up. WinDirStat did not show this .EVTX file but WizTree identified it. Saved the day.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.