I have SBS2008 server that has a Data drive partition (physical drive letter E: ) that’s setup as RAID 5 with 410GB available.
Just recently on 6/19/2015, the server alerted that there’s less than 10 %of available disk space.
- We believe know the day before, the server had near 40% of available disk space
- We feel that sometime on the 19th, someone had inadvertently copied a large amount of data onto the server’s E-Drive but not sure where
- Some time ago, I moved all the WSUS repositories onto the E-Drive. I recall several weeks ago that this WSUS folder was over 100Gb but I don’t recall exactly. Today its 160GB’s in size. I doubt very much that it grew by 20 or 30 GB’s in a few weeks. I believe there’s a wizard to shrink the repository. I’ll have to look into this.
- There’s also a few log files from SHAREPOINT that are very large. One log file was 19.9GB’s in size and it’s last modified date was on 6/19/2015. Ironically, we don’t use SHAREPOINT. I also know that you can’t just uninstall it. Supposedly there are tools that shrink it
I ran “diruse” and Sysinternals “Du”
- However these to programs outputs didn’t help me
- I tried a GUI tool called “WinDIrStat”. It was very complex to follow. I’m not familiar with this tool
I looked a t my backups to see what changed
- I use two backup programs. MozyPro for cloud backups. Not everything on the E-Drive is tagged for backup. The backup data barely changed from the day before or the day after the 19th
- The other backup method is the built-in “Windows Backup”. I use it to back up the entire server onto the locally attached USB drive. The logs are very basic and don’t provide much information. However, interestingly, it showed a massive amount of data that changed during that backup but not clues as to what these changes were (at least I was not able to determine)
So here’s what I’m trying to accomplish
- Is there a command or tool I can use to determine what data changed or was added on the 19th? I need to determine if a large chunk of data was copied into a folder under the E-Drive of the server
Any help would be appreciated