521 Gigs of Unknown Space According to WinDirStat

I have a Windows 2003 R2 Server (running in a virtual environment using XenCenter) that is missing about half a terabyte of space.  When I ran WinDirStat, it displays 521 gigs of unknown space being used (see picture below).

I can tell you what this is not:

This is not the System Volume Directory
Shadow Copy is NOT enabled on the Server
System Restore is disabled on the machine
I used Disk Space Fan Pro, it did not let me regain the space
I used cmdassys.exe to elevate the permissions of WinDirStat, that did not work
I ran chkdsk /r /f

I am not sure what else I can do to recover the space.  I was thinking it could be offline files, but as a Domain Policy Offline Files are disabled and I can find the directory where they are stored.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Brian PringleSystems Analyst II, SCM, ERPCommented:
Can you post a picture of Disk Management?
Please attach the snapshot.
commengAuthor Commented:
There is no hidden partition or recovery space.  See attached.
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

It lists unknown files as files whose extensions aren't registered in the registry. So, if you have a file named Mybackup.spq, windirstat doesn't know what a spq file is. This does not necessarily mean it's a file you don't need. I think if you click on unknown or it's position on the graph, it will list the file names in that group.
commengAuthor Commented:
No I have tried that all the options are grayed out and clicking on it does nothing.
Try TreeSize from below link and check once.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Brian PringleSystems Analyst II, SCM, ERPCommented:
Can you go to a command line and run diskpart?

select disk 1
detail disk

select partition 1
detail partition

Please post screen shots of those.

Internet explorer will also hide files on the hard drive in a "Junction" folder, so most programs cannot see it.
Seth SimmonsSr. Systems AdministratorCommented:
those files are marked as unknown because the user account it's running as doesn't have rights to those folders.  it calculates that unknown size based on the total drive size minus everything else it has calculated.

if you ran that as local system (used psexec from sysinternals tools), you won't see anything as unknown.  did that last week on my system that showed some 5gb as unknown and was able to find it when running as system.  would be cautious running things under this account but for this purpose of finding 'unknown' usage it works

commengAuthor Commented:
I am running everything as domain administrator. I will follow these steps in the morning.
Seth SimmonsSr. Systems AdministratorCommented:
what i did with psexec is run:

psexec -i -s -d "\Program Files (x86)\WinDirStat\windirstat.exe"

the above link is for the entire suite but this is just for this tool

Lee W, MVPTechnology and Business Process AdvisorCommented:
First, check my page on disk space on a 2003 server - www.lwcomputing.com/tips/static/bootdrivesize.asp  - Check ALL the places my article talks about for usage.

If WinDirStat is not seeing it it's because the domain admin account doesn't have permissions to see it.   ESPECIALLY check settings on Volume Shadow Copy
commengAuthor Commented:
OK, I ran the psexec -i -s -d "\Program Files (x86)\WinDirStat\windirstat.exe" command and ended up with the same results, see attached picture.

I ran disk part as requested but it really didn't give any information see attached picture.

I really don't think this is a permissions issue.

I am downloading and trying TreeSize now.
Seth SimmonsSr. Systems AdministratorCommented:
that's bizarre - especially at that size...
would be interested in seeing if treesize shows anything different
commengAuthor Commented:
It is still running, I will let you know.
Lee W, MVPTechnology and Business Process AdvisorCommented:
Google DIRUSE and then download from MS.  It works fine on 2003 though it's a resource kit utility from 2000.

Then run DIRUSE /* /, /M C:\ from a command prompt.  It's text output to a command prompt but I found it more accurate in the past than either WinDirStat and TreeSize.  You can get more granular as needed - for example, if you find a lot in temp, you can run it against temp and see that folder's largest directory - DIRUSE /* /, /M C:\Temp
commengAuthor Commented:
OK, I found the answer using TreeSize, there are three directories in the Profile folders that have file name over the 260 character limit, which is why I wasn't seeing the files.

Now I just have to figure out how to delete these directories.
Treesize always worked for me that is why I suggested you in earlier post. I think you might face permission issues while deleting them, so better you take the ownership of those folders and then delete them.
commengAuthor Commented:
No I have ownership the file name with directory structure is over the 260 character limit.
commengAuthor Commented:
The final solution was using Treesize to find the directory with the missing data.

I then used Robocopy Purge feature to regain the space as follows:

MKDIR "C:\empty"

    Creates an empty directory.

ROBOCOPY "C:\empty" "c:\ProblemDir" /PURGE

Worked great and I have my space back.
commengAuthor Commented:
The Treesize let me to the directory but my comment explains how to delete this unknown data when the path/filename is longer than 260 characters.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.