Solved

Lost disk space on Windows NTFS

Posted on 2014-01-13
1
1,877 Views
Last Modified: 2014-01-13
I have a pair of Windows 2008 R2 web servers which were using DFSR (Distributed File System Replication) to replicate the website content between the two servers.

I noticed that the free disk usage on the data volume (total space 60GB) was much lower than it should have been. There should be about 15GB in use, but the disk properties was showing around 39GB in use. The Windows and Program Files folders are not on this volume.

I used the excellent WinDirStat (http://windirstat.info/) to see where all the data had gone, and found the 'Unknown' space was nearly 24GB. (you can see this in WinDirStat by pressing F7 once it's finished its scan).

The 'Unknown' disk space is the difference between what the system reports is in use on the disk (same as if you right click a drive and select properties) and the space reported if you select all the folders/files on the root of the drive and right click and select properties.

I did this and confirmed the issue -
All files/folders properties: 210,836 files, 1,199 folders, 16,397,094,183 bytes (15.9GB)
Volume Properties: Used space 41,822,511,104 bytes (38.9GB)

I ran chkdsk and found:
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
  458240 file records processed.
File verification completed.
  917 large file records processed.
  0 bad file records processed.
  0 EA records processed.
  0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
  463132 index entries processed.
Index verification completed.
  0 unindexed files scanned.
  0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)...
  458240 file SDs/SIDs processed.
Security descriptor verification completed.
  2447 data files processed.
CHKDSK is verifying Usn Journal...
  539559752 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems.  62911487 KB total disk space.
  40631676 KB in 430038 files.
    233212 KB in 2448 indexes.
         0 KB in bad sectors.
   1045235 KB in use by the system.
     54464 KB occupied by the log file.
  21001364 KB available on disk.

      4096 bytes in each allocation unit.
  15727871 total allocation units on disk.
   5250341 allocation units available on disk.

You can see the number of files found by chkdsk (430,038) is over twice the number the all files/folders properties reported (210,836)

So, where is all the space being used?
To resolve this, I have, so far:
Rerun WinDirStat as Administrator, in case there where any files I didn't have access to
Completely disabled all DFRS replication nodes, and deleted all the DfsrPrivate folders (this is where I though the data would be. This released some space but the stats above is what remains after I did this.
Checked there where no System Restore Points - there aren't. This feature does not seem to be enabled on Windows 2008 R2
Checked there were no Volume Shadow Copies enabled - there aren't
Checked for other hidden folders (dir /a:hd /s) - there aren't except other users Recycle Bins, which I deleted
Checked the File Allocation Block size - there are a lot of small files, but the block size is small - 4K (see chkdsk results above) so there is little wasted space here
Searched for System folders - there are only two - $RECYCLE.BIN and 'System Volume Information'. The first is empty, the second I can't get into (and I'm wary about resetting the owner and re-applying permissions in case I break this system folder. Besides, I believe (though I am not 100% sure) that this folder is where System Restore Points are stored and as I said above, there are none).

So now I'm stuck - I can't see where all this disk space has gone and how to recover it.

The other server (it's a load balanced pair) has a similar issue, but has only 8.8GB of lost space instead of 24GB

Any ideas?

Thanks!
0
Comment
Question by:Cyber-spy
1 Comment
 
LVL 12

Accepted Solution

by:
Cyber-spy earned 0 total points
ID: 39776810
Solved it!
Using TreeSize Professional, I can see into the System Volume Information folder (no idea why WinDirStat can't do this when run as Administrator).
In there there is a 23GB folder called DFSR - something else to do with the Distributed File System

Anyway, that's where the data is hiding, and deleting this folder returned my disk space.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

The Samsung SSD 840 EVO and 840 EVO mSATA have a well-known problem with a drop in read performance. I first learned about this in an interesting thread here at Experts Exchange: http://www.experts-exchange.com/Hardware/Storage/Hard_Drives/Q_2852…
Having issues meeting security compliance criteria because of those pesky USB drives? Then I can help you! This article will explain how to disable USB Mass Storage devices in Windows Server 2008 R2.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now