Home / server / Questions / 1031988
Accepted
Mat
Asked: 2020-08-30 11:47:16 +0800 CST

Windows 2019: can't figure out why my drive is full

  • 772

On a Windows 2019 Server the drive D: is 100% full (500 Gb used):

enter image description here

I'm trying to understand why the disk is full but I can't because both File Explorer and Total Commander reports no more than 33 Gb used:

enter image description here

enter image description here

It's also strange that WinDirStat reports 100% (500 Gb) used in the start summary, but only 33 Gb used after the analysis:

enter image description here

enter image description here

Please note that:

  • I'm logged in as Administrator
  • I started WinDirStat with Administrator privileges
  • I tried with both local Administrator and Active Directory Domain Admin
  • I enabled hidden and system files in File Explorer and Total Commander
  • I ran chkdsk on the D: drive without finding any issue

I found 33 Gb of data. Where are other 467 Gb?

windows disk-space-utilization windows-server-2019

4 Answers

  1. Best Answer

    You could try WizTree (wiztreefree.com), which is similar to WinDirStat but it bypasses the filesystem driver and reads the MFT directly if run as an administrator. It will show space taken by alternate data streams, metadata files ($MFT, $Secure, $BadClus, etc.), and directories you don't have access to. It doesn't appear to show space allocated for directory indexes, and it may miss some other things, but I wouldn't be surprised if the culprit does show up.

    • 58

  2. I couldn't edit my comment any longer so I post it as an answer.

    I've met once such an incident: It was due to Alternate Data Streams, a feature of NTFS for classic MacOS compatibility in shared folders. Unfortunately this ill-fated feature can be used for malicious purposes. In simple terms, it can be used to fill up your disk but the reserved space cannot be located, as in your case. If you want to check on this, I suggest MS sysinternals tool, streams.

    Just beware that there are used in some legitimate cases, for example MS SQL server prior to 2014 uses them.

    • 15

  3. The default permissions on C:\System Volume Information are NT AUTHORITY\SYSTEM:(OI)(CI)F. This means that even when you Run as Administrator you can't normally see files in it. You can use e.g. psexec to launch an application under the Local System account, which will then allow WinDirStat et. al. to display everything, or you can use it to add Administrators to the ACL. In particular, if you are using Previous Versions then the volume shadow copies are stored within this directory, and these can get quite large.

    • 7

  4. This was very useful. I've found that Windows Server 2019 has set the default size of the Failover Clustering Diagnostic log to 18014398507384832Kb (!) so server disk was filling up. WinDirStat did not show this .EVTX file but WizTree identified it. Saved the day.

    • 1