What is “<Unknown>”?

WDS shows a certain item labelled “<Unknown>” and recently someone posted a comment asking for details:

i think it would be nice to put in the faq or in help or in some docs what’s in the <unknown> space

sometimes it’s an huge amount of space! like 700 or more MB ! i think it could be the “system volume information” but! what mysterous things are within this space? he he he!

This mysterious item is just the difference between what Windows reports as the free space on the volume minus size of the files WDS can access. Please note the part WDS can access! This is the important point here. WDS cannot access the files under System Volume Information on all the (NTFS?) drives, so it cannot sum up the sizes of these items. And by the way, we have had reports of up to 30 GB of “<Unknown>” space.

Now what is stored in this directory? If you could gain SYSTEM access (and I will not tell you how that is possible …), you would see that the system keeps some binary log files there, but these take up only a small portion of what is stored in there. The biggest portion is usually being taken up by the System Restore Points (SRPs) you can create (or that are automatically created by software installers). The contents are a dump of the registry at the time the SRP was taken and of relevant files (usually from the system folders). I personally turned this feature of since I have a different backup strategy – however, this may not apply to everyone, so you’ll have to live with the “<Unknown>” item :mrgreen:.

There also have been reports that some third-party software stores data there, but I cannot confirm this. Also in the very unlikely case that your file system is corrupt there may be a non-zero sized “<Unknown>” item. In that latter case run a file system check and the problems should be fixed afterwards.

// Oliver

PS: If you run under a non-privileged account this could also cause a lot of files to be inaccessible and therefore to count as “<Unknown>” …

This entry was posted in Uncategorized. Bookmark the permalink.

102 Responses to What is “<Unknown>”?

  1. Tim Young says:

    In my case the space (156GB) turned out to be taken up by old event logs in “C:\Windows\System32\winevt\Logs”, which weren’t getting deleted when I cleared my event logs through the event viewer. I’m not sure why Windirstat was unable to see these files properly, but I just got rid of them and all was well.

  2. Alex. says:

    wow.. just searching for long time and this comment solved it all – i had 50GB of unknown space and nothing helped, no checkdisk and disk cleanup to find or fix problems/old logs.
    my winevt\logs are full of 17.500 archive-security and so on objects of around 2-4MB
    and the server needs to run since >10years due to a special software.
    😀 THANKS – saved my day

Leave a Reply

Your email address will not be published. Required fields are marked *