Windows 2000 server

Posted on 2005-03-15
Medium Priority
Last Modified: 2010-04-14
I notice that yesterday between 1:00 pm and 5:00pm the amount of free space on my server system dirve (c:) went from 5GB of free space to about 11 MB of free space!  I cannot seem to figure what is eating up space.

In the past i had a similar problem and the issue was with the Exchange "Bad Mail" folder filling up.  I alleviated that issue by creating a batch file to auto delete the contents of that folder every few days.  I checked that folder to be sure it was not the culprit.

Other than that, i have no idea what could be causing this.  Here is the specs on my server.

OS: Windows 2000 Server sp4
Role: Domain Controller/DNS/Email/File Server

Running the following apps:

Exchange 2000 sp3
Blackberry Enterprise edition
Symantec Corp 9.0
Symantec Mail Security for Exchange
Dantz Retrospect 6.5
I hate Spam Server Edition

Anybody have an idea of what is eating up my disk space? Help!!!

Question by:andreacadia
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 6
  • 5
  • +3

Expert Comment

ID: 13547638
Try using Treesize, it's a great utility that will graphically map out where a drives space is being consumed.

There is a freeware version:

Or a $40 professional version:

LVL 27

Expert Comment

ID: 13547803
Are your Exchange backups working?
Online backups will purge the committed logfiles when they complete properly.
LVL 33

Expert Comment

ID: 13548531
Why not do a search on your hard drive for recent files?  or do a search for large files (memory.dmp for example, if you system crashes, it will copy RAM to the hard drive...this takes up tons of space.)  I would search for files largers then 100MB's and see what you can see.,..
Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

LVL 31

Expert Comment

by:Wayne Barron
ID: 13549338
NJComputerNetworks; has the right information here.
Also, have you done any type of Movie Making?
If so, then the file that outputs may be a tiny 5mb files, but take up about 2Gigs on the Hard Drive.

I would check like NJComputerNetworks suggested, for files that are Large in Size.
The Win2k Memory Dump  .dmp file should only be largest at 500MB, so no unless you had
About 10 Dumps happen within that 4-hour span, that would not be the problem.

Most Recent Files, anything of size really, does not have to be a HUGE file.
It can be a tiny file. But Disk Space Size may vary from a little over, to GB's Over
Its original size.


Author Comment

ID: 13550491
i tried that and did not see anything out of the ordinary...Furthermore, as far as exchange ois concerned, my priv1.edb file is locating on a separate RAID partition...so a growing information store shouldnt be the culprit here..I need help desperately!

Whats also weird...according to the Treesize program, i only have 8 GB of a 17GB hard drive used...I dont know whats happening here.
LVL 31

Expert Comment

by:Wayne Barron
ID: 13551902
What is the size of your "Paging File" ?
I do know, that if it is set to large that it can get right HUGE.

Example; On our Server, we had it set to high several years ago, and the Paging File grew to about 2.6Gb's.
So that might be something that you can take a look at as well.
Just a suggestion.

LVL 35

Expert Comment

by:Nirmal Sharma
ID: 13552448
>>>Whats also weird...according to the Treesize program, i only have 8 GB of a 17GB hard drive used...I dont know whats happening here.

The best way to know which application or process is trying to access or filling up your hard disk is FileMon utility from Sysinternals. Keep this utility running in your system. This utility will give you a list of all applications/process running and telling you the path where they are trying to access or trying to fill up something. You can download FileMon from here: -

FileMon from Sysinternals: -

Let me know.


Author Comment

ID: 13556229
the program isnt really telling me where disk space is being consumed.
LVL 31

Expert Comment

by:Wayne Barron
ID: 13557655
andreacadia ; Did you read my last post?

Expert Comment

ID: 13557844
In your question you said:
"the amount of free space on my server system dirve (c:) went from 5GB of free space to about 11 MB"

Where was it you noticed this?  Was it in windows explorer?  Or did you right click the drive and view the properties?
It seems very odd that you are seeing 11mb of space somewhere, but elsewhere (treesize) you are seeing 9gb of space.

What happens when you run CHKDSK /F from a command prompt?  It should fix any errors it finds and tell you exactly how much space is free and how much is in use.
Look for the lines that say "XXXXXXX KB total disk space." and "XXXXXXX KB available on disk."

If you could, cut and paste that info here.


Author Comment

ID: 13557985

I did overlook your last post...my paging file appears to be ok here are the specs:
Initial size: 1536
Max size:   2072

minimum allowed =   2MB
Recommended =       3070MB
Currently allocated=  1536MB

what is really strange is that on this same screen, its says there is 1796MB of space available on C:.


I first noticed this by viewing the c: drive in windows explorer, then i right clicked and click properties and it still said there was only 11MB free space.  

- According to windows explorer i am at 260MB of free space
- if i right click my computer>properties>advanced tab>performance options>change...and view these settings, it tells me that i have 1796MB space available on drive C: as i mentioned above.
- according to Treefile, the entire size of the c: drive is 7,849MB....unless i am reading this wrong.

in order to run chkdsk i would have to reboot...

Expert Comment

ID: 13558113
Hmmm how about CHKDSK without the /F option.  That should run it in read-only mode, but at least it will provide some info.
Although I'd suggest running it with the /F option sometime in the near future since it is giving some weird info that could be related to a corrupt file allocation table.

When running Treesize, look in the bottom left corner of the window and it should say "Free Space: XXXX MB"
It also has a few different views to choose from; Size, Bytes Allocated and Percentage.  The difference between Size and Bytes Allocated is roughly the same thing as windows 'Size' and 'Size on Disk'.


Author Comment

ID: 13558338
i ran chkdsk and then it asked to schedule for next reboot so i agreed...i then rebooted the server and chkdsk ran...it completed steps 1 through 3 then said something to the effect of "checking usp names"  and then it just all of a sudden rebooted..i never got a summary or anything.

Looking in the bottom right corner of Treefile it tells me there is 243 MB of free space.  i dont even have enough space to try and defrag.


Expert Comment

ID: 13558607
Hmmm that's very strange that it didn't complete.  Hopefully it gave some information in the log; go to your event viewer and look under Application Log for an entry whose source is CHKDSK and lets see what it tells us.

What happened when you ran it without the /F (read-only)?
It shouldn't require a reboot in read-only mode since nothing is being changed.

And I guess I should have asked this earlier, but what size is the system drive?


Author Comment

ID: 13558999
The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...        
100 percent completed.              
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...              
100 percent completed.              
Index verification completed.
CHKDSK is recovering lost files.
Recovering orphaned file tree[1].js (29658) into directory file 73404.
Recovering orphaned file TREE_1~1.JS (29658) into directory file 73404.
Recovering orphaned file SCANJO~1.ICO (30738) into directory file 73406.
Recovering orphaned file ScanJobs[1].ico (30738) into directory file 73406.
CHKDSK is verifying security descriptors (stage 3 of 3)...              
100 percent completed.              
Security descriptor verification completed.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

  17912443 KB total disk space.
  16152108 KB in 60364 files.
     23828 KB in 5181 indexes.
         0 KB in bad sectors.
   1471951 KB in use by the system.
     65536 KB occupied by the log file.
    264556 KB available on disk.

      4096 bytes in each allocation unit.
   4478110 total allocation units on disk.
     66139 allocation units available on disk.

Expert Comment

ID: 13559124
The part that concerns me is this:

Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.
Correcting errors in the master file table's (MFT) BITMAP attribute.

According to microsoft (http://support.microsoft.com/default.aspx?scid=kb;en-us;814594) the bitmap attribute could indicate that it is marking free space as allocated, which would explain your problem.  See below:

NTFS File System Corruption
In very rare circumstances, the NTFS Metafiles $MFT or $BITMAP may become corrupted and result in lost disk space. You can identify and fix this issue by running the chkdsk /f command against the volume. Toward the end of chkdsk, you receive the following message if you must adjust the $BITMAP:
Correcting errors in the master file table's (MFT) BITMAP attribute. CHKDSK discovered free space marked as allocated in the volume bitmap. Windows has made corrections to the file system.

We're going to have to get that CHKDSK /F to run properly in order to get this resolved.  Could you give it another try?  I know rebooting a server is a pain in the ass because it usually means upset users.....sorry.


Author Comment

ID: 13571334
I did run the chkdsk /f again and it seems to have not made a difference.  To make things worse, the same thing has happened again.  I managed to free up 2.17GB of freee space on the server at around 12:00 this afternoon.  So eventhough we had not figured out the issue i felt a little better by making 2.17GB of free space by deleting some files i did not need.

So in my head i thought why  not run the chkdsk /f again, when the drive has significant free space and see what happens.  After the system booted...I was back down to 4MB of free space!!  I have never seen something like this before and i am leaving next week for a week.  Last thing i need is for the company email server to go down.

Does anybody have any ideas?

LVL 31

Accepted Solution

Wayne Barron earned 1500 total points
ID: 13571447
This sounds like maybe there is a File that is on the server, maybe in C:\WinNT\System32\
That is having data written to it when ever the system boots up.
Maybe the Filing System is not working like it should, to let the disk know that it has enough space
Available. (Just thinking aloud here)

    I would do the following.

Go to: (Check these locations by "Right Click | Properties | )
( What you are looking for is the "Size on Disk" Differs GREATLY from the "Size" (or Vis-Versa) of the actual File/Folder )

Right click on the \System32  Folder

Also. Check in the C:\Documents & Settings\Your User Profile\Local Settings\Temp
Right click on the \Temp  Folder

Check different places that may get data written to it by a program that is installed.
Maybe there is a program with a [Memory leak] that might be dumping itself into a File on your drive?

If I can think of anything else I will post it in here tomorrow.
Time for bed now.

Take Care and Good Luck;

LVL 31

Expert Comment

by:Wayne Barron
ID: 13571980
I just thought about something here while cleaning up one of my computers.

Are you using "Norton" As your AntiVirus Software for the Server?
If so, Is it set up to:
Recycle Bin =  "Auto Protect Files On This Computer"

If so, then please do the following.

Go into the Recycle Bin. (Norton's [UnErase Wizard] Will Appear) <-- If Norton if enabled on it

Let is Generate all the Files on the System that have been Deleted.
Now. Once it is Finished. View through all of C:\ Drive files, that are listed.
Do a quick Figure in your head on the "Size" of the files. "" There could be 1,000's of them""
Once you are sure of the files, not being Needed anymore.

Click on the "Very First File"
Hold Down your [Ctrl & Shift] KEYS on your Keyboard.
Then scroll all the way down to the very last file. And Click on it (Remember to hold down the [Ctrl & Chift] keys
During this process)
This will   [ Select All ] of the Files in the "UnErase" Window List.
Then While still holding down the [Ctrl & Shift] key.
Right Click on a File in the "List Window" and choose [Delete]

This process will take a little while, depending on the amount of data that is being Protected by Norton.
Once this process is complete.
Check your    C:\ Drive, and see if it has its size back again?
If not, then let us know, and we can thank of something else?

By the way. Notate the Size of the Drive, Before performing this feature.
Then Notate the Size of the Drive After.

If the Drive does perhaps gain its size back.
Run "Disk Defrag" on it, and then see what the outcome is.

  I just freed up over 13.86 Gigs From 12-Partitions on my Main Programming Computer.
(3 Hard Drives.   40 Gig & 30-Gig & 20-Gig = 90Gigs Total)
C:\ Drive, cleared up over 2.4Gigs alone.

Good Luck
LVL 31

Expert Comment

by:Wayne Barron
ID: 13667353
Checking in to see if any of the above information from anyone has assisted you in your issue?

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Learn how to use the free Acronis True Image app to easily transfer data between iPhones and Android phones.
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…
Suggested Courses
Course of the Month12 days, 12 hours left to enroll

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question