Server Disk Space Search tools for Windows Server 2008
I have SBS2008 server that has a Data drive partition (physical drive letter E: ) that’s setup as RAID 5 with 410GB available.
Just recently on 6/19/2015, the server alerted that there’s less than 10 %of available disk space.
- We believe know the day before, the server had near 40% of available disk space
- We feel that sometime on the 19th, someone had inadvertently copied a large amount of data onto the server’s E-Drive but not sure where
- Some time ago, I moved all the WSUS repositories onto the E-Drive. I recall several weeks ago that this WSUS folder was over 100Gb but I don’t recall exactly. Today its 160GB’s in size. I doubt very much that it grew by 20 or 30 GB’s in a few weeks. I believe there’s a wizard to shrink the repository. I’ll have to look into this.
- There’s also a few log files from SHAREPOINT that are very large. One log file was 19.9GB’s in size and it’s last modified date was on 6/19/2015. Ironically, we don’t use SHAREPOINT. I also know that you can’t just uninstall it. Supposedly there are tools that shrink it
I ran “diruse” and Sysinternals “Du”
- However these to programs outputs didn’t help me
- I tried a GUI tool called “WinDIrStat”. It was very complex to follow. I’m not familiar with this tool
I looked a t my backups to see what changed
- I use two backup programs. MozyPro for cloud backups. Not everything on the E-Drive is tagged for backup. The backup data barely changed from the day before or the day after the 19th
- The other backup method is the built-in “Windows Backup”. I use it to back up the entire server onto the locally attached USB drive. The logs are very basic and don’t provide much information. However, interestingly, it showed a massive amount of data that changed during that backup but not clues as to what these changes were (at least I was not able to determine)
So here’s what I’m trying to accomplish
- Is there a command or tool I can use to determine what data changed or was added on the 19th? I need to determine if a large chunk of data was copied into a folder under the E-Drive of the server
Any help would be appreciated
Just recently on 6/19/2015, the server alerted that there’s less than 10 %of available disk space.
- We believe know the day before, the server had near 40% of available disk space
- We feel that sometime on the 19th, someone had inadvertently copied a large amount of data onto the server’s E-Drive but not sure where
- Some time ago, I moved all the WSUS repositories onto the E-Drive. I recall several weeks ago that this WSUS folder was over 100Gb but I don’t recall exactly. Today its 160GB’s in size. I doubt very much that it grew by 20 or 30 GB’s in a few weeks. I believe there’s a wizard to shrink the repository. I’ll have to look into this.
- There’s also a few log files from SHAREPOINT that are very large. One log file was 19.9GB’s in size and it’s last modified date was on 6/19/2015. Ironically, we don’t use SHAREPOINT. I also know that you can’t just uninstall it. Supposedly there are tools that shrink it
I ran “diruse” and Sysinternals “Du”
- However these to programs outputs didn’t help me
- I tried a GUI tool called “WinDIrStat”. It was very complex to follow. I’m not familiar with this tool
I looked a t my backups to see what changed
- I use two backup programs. MozyPro for cloud backups. Not everything on the E-Drive is tagged for backup. The backup data barely changed from the day before or the day after the 19th
- The other backup method is the built-in “Windows Backup”. I use it to back up the entire server onto the locally attached USB drive. The logs are very basic and don’t provide much information. However, interestingly, it showed a massive amount of data that changed during that backup but not clues as to what these changes were (at least I was not able to determine)
So here’s what I’m trying to accomplish
- Is there a command or tool I can use to determine what data changed or was added on the 19th? I need to determine if a large chunk of data was copied into a folder under the E-Drive of the server
Any help would be appreciated
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I'm trying to determine what data was added or changed.
"indows Backup" there is no option to browse the backup file
“WinDIrStat" - I am aware that you sort by clicking on the column. but I still need to know what changed on that particular day.
Had a used a more informative backup solution, it might have been able let me know what was added that day.
"indows Backup" there is no option to browse the backup file
“WinDIrStat" - I am aware that you sort by clicking on the column. but I still need to know what changed on that particular day.
Had a used a more informative backup solution, it might have been able let me know what was added that day.
Without a reference, you may have to manually search. Even that may be tedious.
ASKER
I believe the only option I have is to perform a restore on to an external USB drive from a date prior to noticing Drive size increasing and then compare all the folders.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks for your input
Can you browse the backup file? Maybe that will help.