Solved

What is stored in  \\windows\system32\backup and how can I shrink the size of it?

Posted on 2014-03-01
12
1,782 Views
Last Modified: 2016-11-23
I am running into an issue where my C: drive on a Small Business Server running Exchange is running out of space on the C: partition.  I have performed all of the normal cleanups recommended like log files, and WSUS.  My mailboxes were always on the D: partition.  While doing some digging, I found that a folder located \\windows\system32\backup is taking up almost 50 gb.   The odd thing is that the sub folders are all stating less than a GB of data.  What is stored in this folder and how can I shrink it?  I first thought that might be a backup of the OS installed by Dell but the time stamp dates of the smaller folders are current and I guess it would not make sense for them to create a restore folder within the C: partition anyways.  I am using the backup program offered with SBS to backup my server to an external NAS drive.
0
Comment
Question by:MrGD
  • 4
  • 3
  • 3
  • +2
12 Comments
 
LVL 23

Assisted Solution

by:Eirman
Eirman earned 50 total points
Comment Utility
Try using a space analyzer tool on the entire C: drive and then on the windows\system32\backup folder.

The first one here looks quite good ....
http://lifehacker.com/5915921/the-best-disk-space-analyzer-for-windows

This should graphically show you what subfolders within \backup are chewing up your space.
--------------------------------------------------------------
When you get to the point that you need to delete files on your OS partition, it's time to consider changing the drive to a bigger and faster one. Most OSs work better when you have plenty of free space on the drive.

It's not as big/daunting a task as you might think, once you have the right tools.
0
 
LVL 76

Expert Comment

by:arnold
Comment Utility
Look at the backup data to see when they were updated, than look at schtasks /query to see what you have running.  One of these might be storing data.

Look at the backup item to see what is being backed up.

The backup folder might include the index of backed up data.

I.e. Restore in time. Check the backup setting to see if it references that location.
0
 
LVL 21

Expert Comment

by:Larry Struckmeyer MVP
Comment Utility
Please tell us the version of SBS you have.  And I agree with a space analyzer.  Others are Windirstat and Treesize pro.  Be sure to run as administrator if you have SBS 2008 or 2011.
0
 

Author Comment

by:MrGD
Comment Utility
I have SBS 2011 which I guess is also called 2008 R2.  I used the free version of Treesize and that is how I found the folder that was so large.  I remember that some of the files had the index somewhere within the name so I bet that is what they are, but I do not remember any options within the backup software asking or stating where they were going to be stored.  Again, just used the backup program that was offered within SBS 2011.  Will check and post what I find.   Hopefully there is an option to store them on the D partition.
0
 

Author Comment

by:MrGD
Comment Utility
OK.  Ran WinDirStat and it did not show anything out of the ordinary until I selected the option of showing Unknown file types and then it showed Unknown 51.3% 57GB.  I then ran TreeSize and it again showed the attached report.  I went into the backup program offered within SBS 2011 and it does not show nor give you any options on storing index files.  About the only real option is to specify the destination for the backups.

There are a number of folders within the BackupDatabase folder.  Each appears to be whenever a backup is ran.  Within the folder is a number of files that reference Index.  I am also including an attached image of those contents.  

Previously I stated that I was backing up to a NAS drive.  That is not completely correct.  It is a Sans Digital USB external enclosure running RAID1. I am running Windows Server Backup.  If the files are indexes of the backups, how can I delete them without messing up my backups?
SpaceUsed.jpg
FolderContents.jpg
0
 
LVL 21

Accepted Solution

by:
Larry Struckmeyer MVP earned 350 total points
Comment Utility
Hi:

I just checked three different SBS 2011 servers.  There is no folder under System 32 called backup, and I have never seen an SBS 2011 exhibit this behavior.  Can you verify you are using the SBS Console Backup and Server Storage/Backup to do your backups?

A review of the parameters for wbadmin, the program Windows uses to create backups also does not mention location, but there is a reference to a CLI to delete catalogs, so I suspect you are using wbadmin?.   If so, switch to the wizard in the console, or specify a different location for the indexes in the CLI.   On reflection, in the event of a system failure such indexes would be useless anyway.  

If using the SBS console, are you using any add on such as Backup Assist?  Is there any other program installed that could be making backups in perhaps a set and forget mode that someone else may have installed?

One thing you could do is mark that folder for compression or zip up the oldest files and move them to another partition while you figure it out.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 74

Assisted Solution

by:Jeffrey Kane - TechSoEasy
Jeffrey Kane - TechSoEasy earned 100 total points
Comment Utility
From the looks of that contents image you posted you have something called RavenDB Backup installed.  This is what's causing your problem.

Get that configured properly so it doesn't store its cache on your C: drive and you'll be in good shape.  Or, if you aren't using it, uninstall it and then just delete that directory.

Jeff
0
 
LVL 21

Assisted Solution

by:Larry Struckmeyer MVP
Larry Struckmeyer MVP earned 350 total points
Comment Utility
Agreed.... just never heard of RavenDB.   A quick search for it turns up what appears to be a document management system, which would involve intensive indexing.  So rather than looking for another backup program, look for a document management system called Raven and check where it stores its indexes and its backups.  Then reconfigure to store elsewhere or, as Jeff says, uninstall/disable then delete the folder if you are not going to use it.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
Comment Utility
LOL, I Should have spent more time looking at their website... I just quickly assumed it was a backup app -- even though I never heard of it either.  Thanks for checking further.
0
 

Author Comment

by:MrGD
Comment Utility
We found what was causing the issue.  It was a program that another person who has admin rights added.  It was a Tax software package that was saving information hourly.  He has since moved the index files to the data drive where it should have been in the first place.  Heading in there right now to verify and will update.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
Comment Utility
Really?  Is that what RavenDB is being used for?  Because I'm absolutely sure that is what your problem is.

Jeff
0
 

Author Closing Comment

by:MrGD
Comment Utility
Hope that I split the points fairly.  A lot of good help and recommendations.  The one that really got be thinking as to ask if anyone might have added software or app.  The office manager has admin rights and never thought about the fact he might have added something without telling me.  Thanks all.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Remote Apps is a feature in server 2008 which allows users to run applications off Remote Desktop Servers without having to log into them to run the applications.  The user can either have a desktop shortcut installed or go through the web portal to…
When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now