I have a pair of Windows 2008 R2 web servers which were using DFSR (Distributed File System Replication) to replicate the website content between the two servers.
I noticed that the free disk usage on the data volume (total space 60GB) was much lower than it should have been. There should be about 15GB in use, but the disk properties was showing around 39GB in use. The Windows and Program Files folders are not on this volume.
I used the excellent WinDirStat (http://windirstat.info/
) to see where all the data had gone, and found the 'Unknown' space was nearly 24GB. (you can see this in WinDirStat by pressing F7 once it's finished its scan).
The 'Unknown' disk space is the difference between what the system reports is in use on the disk (same as if you right click a drive and select properties) and the space reported if you select all the folders/files on the root of the drive and right click and select properties.
I did this and confirmed the issue -
All files/folders properties: 210,836 files, 1,199 folders, 16,397,094,183 bytes (15.9GB)
Volume Properties: Used space 41,822,511,104 bytes (38.9GB)
I ran chkdsk and found:
Running CHKDSK in read-only mode.
CHKDSK is verifying files (stage 1 of 3)...
458240 file records processed.
File verification completed.
917 large file records processed.
0 bad file records processed.
0 EA records processed.
0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
463132 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)...
458240 file SDs/SIDs processed.
Security descriptor verification completed.
2447 data files processed.
CHKDSK is verifying Usn Journal...
539559752 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems. 62911487 KB total disk space.
40631676 KB in 430038 files.
233212 KB in 2448 indexes.
0 KB in bad sectors.
1045235 KB in use by the system.
54464 KB occupied by the log file.
21001364 KB available on disk.
4096 bytes in each allocation unit.
15727871 total allocation units on disk.
5250341 allocation units available on disk.
You can see the number of files found by chkdsk (430,038) is over twice the number the all files/folders properties reported (210,836)
So, where is all the space being used?
To resolve this, I have, so far:
Rerun WinDirStat as Administrator, in case there where any files I didn't have access to
Completely disabled all DFRS replication nodes, and deleted all the DfsrPrivate folders (this is where I though the data would be. This released some space but the stats above is what remains after I did this.
Checked there where no System Restore Points - there aren't. This feature does not seem to be enabled on Windows 2008 R2
Checked there were no Volume Shadow Copies enabled - there aren't
Checked for other hidden folders (dir /a:hd /s) - there aren't except other users Recycle Bins, which I deleted
Checked the File Allocation Block size - there are a lot of small files, but the block size is small - 4K (see chkdsk results above) so there is little wasted space here
Searched for System folders - there are only two - $RECYCLE.BIN and 'System Volume Information'. The first is empty, the second I can't get into (and I'm wary about resetting the owner and re-applying permissions in case I break this system folder. Besides, I believe (though I am not 100% sure) that this folder is where System Restore Points are stored and as I said above, there are none).
So now I'm stuck - I can't see where all this disk space has gone and how to recover it.
The other server (it's a load balanced pair) has a similar issue, but has only 8.8GB of lost space instead of 24GB