What's eating my drive space when normal files + hidden + system doesn't equal total drive space used
This is very strange. All directory sizes are normal, and all other folders are within 20GB of what they should be. The discrepancy is that I can’t locate the files that are consuming 150GB of space in the bottom screenshot.
Below, I issued properties against many sub directories. The second screenshot is the size of the drive. Compare the space used and you’ll see a discrepancy of about 150GB on the single drive.
Does anyone know where this could be coming from? I am viewing all hidden and system files in explorer.exe
Update
C:\Users\>vssadmin List Shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Contents of shadow copy set ID: {4407d687-5021-4a57-a8bf-a94dd03428ce}
Contained 1 shadow copies at creation time: 3/22/2012 7:09:43 PM
Shadow Copy ID: {bf5b69c9-76cf-4218-b1ef-4c264ab3c468}
Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
Originating Machine: TXEXPF01.exchangeHost.com
Service Machine: TXEXPF01.exchangeHost.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
Contents of shadow copy set ID: {e2d1cc68-4afd-41ec-9e52-ef9e3f390e71}
Contained 1 shadow copies at creation time: 4/28/2012 10:43:42 AM
Shadow Copy ID: {3864609a-7f14-4b22-9cff-b3e74b7b568e}
Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6
Originating Machine: TXEXPF01.exchangeHost.com
Service Machine: TXEXPF01.exchangeHost.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
Contents of shadow copy set ID: {da92436b-bd7f-4e61-ab19-db3f8adbf47a}
Contained 1 shadow copies at creation time: 5/23/2012 7:22:24 PM
Shadow Copy ID: {f66b0c06-a0db-4765-b3d7-55634eb1a131}
Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy9
Originating Machine: TXEXPF01.exchangeHost.com
Service Machine: TXEXPF01.exchangeHost.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
Contents of shadow copy set ID: {2ea830c0-bf45-4c8f-9dbd-9a0060f70602}
Contained 1 shadow copies at creation time: 7/5/2012 6:07:36 PM
Shadow Copy ID: {1735116d-9166-4ce0-9dcb-ec57c61516ce}
Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15
Originating Machine: TXEXPF01.exchangeHost.com
Service Machine: TXEXPF01.exchangeHost.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
Contents of shadow copy set ID: {bcda7c37-ba89-426d-bf62-f7459e4051ea}
Contained 1 shadow copies at creation time: 8/14/2012 8:56:02 PM
Shadow Copy ID: {79ee42fc-7561-4eff-95d7-1750f18269f7}
Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44
Originating Machine: TXEXPF01.exchangeHost.com
Service Machine: TXEXPF01.exchangeHost.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
C:\Users\>vssadmin List Shadows > ShadowsSave.txt
Update 2:
Result of deleting the VSS images results in leftover images
C:\Users\ >vssadmin delete shadows /all
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Error: Snapshots were found, but they were outside of your allowed context. Try
removing them with the
backup application which created them.
C:\Users\ >vssadmin list shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Contents of shadow copy set ID: {2ea830c0-bf45-4c8f-9dbd-9a0060f70602}
Contained 1 shadow copies at creation time: 7/5/2012 6:07:36 PM
Shadow Copy ID: {1735116d-9166-4ce0-9dcb-ec57c61516ce}
Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy15
Originating Machine: TXEXPF01.exchangeHost.com
Service Machine: TXEXPF01.exchangeHost.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
Contents of shadow copy set ID: {bcda7c37-ba89-426d-bf62-f7459e4051ea}
Contained 1 shadow copies at creation time: 8/14/2012 8:56:02 PM
Shadow Copy ID: {79ee42fc-7561-4eff-95d7-1750f18269f7}
Original Volume: (C:)\\?\Volume{f02f2f87-87dd-11e0-bed5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44
Originating Machine: TXEXPF01.exchangeHost.com
Service Machine: TXEXPF01.exchangeHost.com
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ApplicationRollback
Attributes: Persistent, No auto release, Differential, Exposed locally,
Auto recovered
C:\Users\>vssadmin delete shadows /all
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Error: Snapshots were found, but they were outside of your allowed context. Try
removing them with the
backup application which created them.
C:\Users\ >
It's probably VSS snapshots. Try stopping and starting the "Volume Shadow Copy" service.
If that doesn't work then from a command prompt you can run:
vssadmin List Shadows
to list the shadow copies and then run:
vssadmin Delete Shadows
to delete the listed shadow copies.
The GUIDs in the System Volume Information folder are the list of VSS snapshots. You can list them and delete them with the vssadmin tool.
The System Volume Information folder is used by VSS when performing any backups using VSS aware backup applications, like Windows Server Backup or BackupExec
It's files or folders you don't have permissions to view. (Or need to "take permissions" with a UAC prompt to view.) They'll show up as being 0 size, no matter how big they really are.
Like joeqwerty suggested, VSS snapshots are one source, so are the contents of System Volume Information (by default), other users' profile locations (blocked by default when UAC is enabled), and some other "miscellaneous" locations, by default... as well as anything that your user's been denied access to read by another administrative account or service.
Quickest way to track it down is to run WinDirStat and get a view of where your drive usage is actually coming from. (It uses calls to the command line utilities for viewing disk usage, so it doesn't have the same problems as the Explorer shell. Just remember to run it elevated.)
Since we've determined it's the VSS snapshots, you can free up the space by 1) manually deleting the GUIDs you see in System Volume Information, or 2) Changing the amount of disk space available to VSS. (I prefer #2, since it keeps the problem from coming back, unlike just deleting a bunch of VSS snapshots.)
Administrative Tools -> Computer Management -> Shared Folders (right click) -> All Tasks -> Configure Shadow Copies... -> Select Volume -> Settings.
Change the limit to something "proper." While you're in there, you can also delete individual shadow copies from the GUI.
Although JowQuery's answer is correct in principal, the correct command to use in 2008 and newer is "diskshadow" followed by "delete shadows all"