Windows 2019: can't figure out why my drive is full

Solution 1:

You could try WizTree (wiztreefree.com), which is similar to WinDirStat but it bypasses the filesystem driver and reads the MFT directly if run as an administrator. It will show space taken by alternate data streams, metadata files ($MFT, $Secure, $BadClus, etc.), and directories you don't have access to. It doesn't appear to show space allocated for directory indexes, and it may miss some other things, but I wouldn't be surprised if the culprit does show up.

Solution 2:

I couldn't edit my comment any longer so I post it as an answer.

I've met once such an incident: It was due to Alternate Data Streams, a feature of NTFS for classic MacOS compatibility in shared folders. Unfortunately this ill-fated feature can be used for malicious purposes. In simple terms, it can be used to fill up your disk but the reserved space cannot be located, as in your case. If you want to check on this, I suggest MS sysinternals tool, streams.

Just beware that there are used in some legitimate cases, for example MS SQL server prior to 2014 uses them.