I have a server (Windows Server 2008 R2 SP1), which is reporting only 2 GB free space on C drive. But when I run WinDirStat or Treesize over the disk, both of them say that only 21 G is being used out of 40 GB.

I have run the Disk Cleanup tool to remove windows update backup files from winsxs folder.

I tried running "vssadmin List Shadows" on a command line, and I got the following result:

No items found that satisfy the query.

I have made sure that System files are not hidden as well as protected OS files.

If I am only using 21 GB out of 40 GB, I should have roughly 19 GB free space. Where is the other 17 GB? What can I do to find what is using it up?

Windows says I have 2.13 GB free space

And that I am using 37 GB

But Treesize says I am only using 21 GB

  • can you tel me your chkdsk result ? i have almost same trouble: serverfault.com/questions/671582/… check the "used by system" section – Froggiz Feb 26 '15 at 17:10
  • I didn't use chkdsk. I used SpaceSniffer to find out what was using up all the disk space - it was log files in the C:\Windows\system32 folder. – MrGordonz Feb 27 '15 at 21:34

I found the cause of the problem - I used a tool called SpaceSniffer. Turns out there was about 19 GB of log files in the C:\Windows\system32 folder. I have no idea why they didn't show up in Treesize or WinDirStat, but regardless of why, I found the culprit. I have now deleted those files and voilà - 22 GB free space!

  • 2
    Were you running those tools elevated ("Run as Administrator")? Not running tools like that elevated is typically the reason why they don't show complete data. – Evan Anderson Oct 6 '14 at 18:43
  • That may be it - I don't think I did run those tool elevated. – MrGordonz Oct 7 '14 at 21:48

It might be trashes from users, or System Restore information, or something similar. WinDirStat or TreeSize wont be able to access those directories, at least if you don't run them with elevated privileges. And even then, you can't enter System Volume Information (that contains among others the restore points) because even not the administrator account is able to see it. On older versions of Windows there was a trick (using AT /INTERACTIVE) to run a program as the local system account so it gets access even to those protected locations, but I don't know a way to run an interactive program with such privileges on Windows 2008. One possibility would be to mount the partition (in read-only, just to be sure) from a Linux live CD, as the Linux NTFS drivers ignore all access control, and using the du command to check what takes space.

Another reason for what you observe could be that something is storing data on NTFS alternate data streams (see for example http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx), I don't know whether TreeSize or WinDirStat are able to report data stored this way.

  • I am the only person who logs on to this server so it can't be deleted items for other users. Also, I changed the permissions for the folder "System Volume Information" so I could see what was in it - only 6 MB of files. – MrGordonz Oct 3 '14 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.