What is “<Unknown>”?

WDS shows a certain item labelled “<Unknown>” and recently someone posted a comment asking for details:

i think it would be nice to put in the faq or in help or in some docs what’s in the <unknown> space

sometimes it’s an huge amount of space! like 700 or more MB ! i think it could be the “system volume information” but! what mysterous things are within this space? he he he!

This mysterious item is just the difference between what Windows reports as the free space on the volume minus size of the files WDS can access. Please note the part WDS can access! This is the important point here. WDS cannot access the files under System Volume Information on all the (NTFS?) drives, so it cannot sum up the sizes of these items. And by the way, we have had reports of up to 30 GB of “<Unknown>” space.

Now what is stored in this directory? If you could gain SYSTEM access (and I will not tell you how that is possible …), you would see that the system keeps some binary log files there, but these take up only a small portion of what is stored in there. The biggest portion is usually being taken up by the System Restore Points (SRPs) you can create (or that are automatically created by software installers). The contents are a dump of the registry at the time the SRP was taken and of relevant files (usually from the system folders). I personally turned this feature of since I have a different backup strategy – however, this may not apply to everyone, so you’ll have to live with the “<Unknown>” item :mrgreen:.

There also have been reports that some third-party software stores data there, but I cannot confirm this. Also in the very unlikely case that your file system is corrupt there may be a non-zero sized “<Unknown>” item. In that latter case run a file system check and the problems should be fixed afterwards.

// Oliver

PS: If you run under a non-privileged account this could also cause a lot of files to be inaccessible and therefore to count as “<Unknown>” …

This entry was posted in Uncategorized. Bookmark the permalink.

96 Responses to What is “<Unknown>”?

  1. Huh says:

    What could this be on a fat32 flash drive though? There’s no system volume information or anything like that. 2 GB of my 8 GB card is “unknown” and you can’t even tell me what folder it’s in??

  2. Oliver says:

    Yes, if the file system were damaged or if files exist on the file system which cannot be accessed with Win32 (e.g. you created files on Linux which don’t adhere to the operating system semantics of the Win32 subsystem). The file system is only part of the equation.

  3. Huh says:

    Wait is this because I have lots of little files and you’re calculating based on the size of the files alone and not based on “size on disk”? That seems right. Windows reports as 4.99 GiB size, but 6.81 GiB “size on disk” = 1.8 GB

    Windirstat should calculate based on the true amount of space taken up on the disk due to cluster size, not just the file size.

  4. Oliver says:

    Well possible. And no, it shouldn’t. What WDS should probably do is offer the user to choose or behave intelligently. The problem becomes more evident with compressed files. What’s the point in a program showing you the disk space taken up with clusters taken into account when the compression then shifts the bias into the other direction again?

    Even better would be if compressed files would use a different logic or if logic depends on compression and file system. Please file a feature request. Those are good points.

    But using another wrong equally method (if applied to everything) is certainly no solution.

  5. Bytemi says:

    I have 500 gigs showing as unknown space. :shock: I checked the system volume but it is not there. It is a Windows 2003 Server, system restore is disabled and shadow copy is disabled.

    I just can’t figure out where half a terabyte of my space has disappeared too. Any other ideas?

  6. Douglas Butler says:

    I’ve had a similar quandary with several of my servers recently, when looking at disk space and running WinDirStat. The one thing I haven’t seen mentioned very frequently is to run WDS as an Administrator. In at least one instance for me, the majority (over 150GB) of the data identified originally by WDS as “Unknown” was actually space taken up by file shares that I didn’t have access to, directly.

    (The security permissions had been changed on the folders, and I wasn’t explicitly in there.)

    When I ran WDS as an Administrator, poof! I was able to see all the files chewing up disk space.

  7. RuneOslo says:

    Make sure you see hidden files in your directories, go to c:\windows\system32\config and look for files with .BLF and .REGTRANS-MS extension.

    I had gigas of them and deleted them all. Then this ‘unknown’ is reclaimed!

  8. Earl B says:

    Check your System32 folder for junk content. In particular, look for files that have been copied from the root of other drives.

    In my situation, there are at least two drives that have had content copied off their root system to my System32 folder.

    Using WinDirStat to check after deleting folders that I *KNOW* shouldn’t be there, I found the size of “unknown” reduced.

    If anyone can help figure out *which* of these files shouldn’t be there, it’ll help my clean up efforts!

    I have posted this issue to Microsoft support at http://social.technet.microsoft.com/Forums/systemcenter/en-US/877b155a-9c66-4aa6-9c64-9efc2e787978/junk-content-in-system32?forum=w8itprogeneral

  9. kiwi439 says:

    I have 48.9 GB of unknown space according to WinDirStat!!! :sad: :sad: :sad:

  10. Joe Barrett says:

    I’ve seen where the “unknown” is taken up with VSS Shadow Copies. If there old Shadow Copies they can be deleted.

  11. Wolfgang says:

    I had a similar issue, and reduced the ‘unknown’ space using the Windows Disk Cleanup tool.

    In the Windows Explorer, right click on the hard drive and select Properties.
    From the Properties dialog select ‘Disk Cleanup’.
    In the Disk Cleanup tool, select the 2nd tab (‘More Options’) and use the function to clean up system restore and shadow copies.

    Before clean up the unknown space was 32 GB.
    After clean up it was ‘only’ 14 GB.

    This happened after I had uninstalled some large programs.
    Before uninstalling free disk space was around 10 GB.
    After uninstalling it was around 25 GB.
    I took a longer break, the PC went to sleep, and when I came back – Windows reported only 9 GB of free space. :(

    That’s when I started digging and WinDirStat came to the rescue :)

    128GB partition, NTFS, Windows 7 Pro, 64 bit.

  12. Donut says:

    Yeah, umm, I have 300 gb, so i kinda need to clear that somehow

  13. Richard says:

    I have a WD Red 2 TB drive and the unknown space has been growing. Currently is occupies 1.0 TB of my 2.0 TB drive. Formatted, the 2.0 TB drive is actually only 1.8 TB as an NTFS partition of 4k sectors. So, over 50% of the usable space of drive is allocated as “unknown”. I will next investigate the VSS aspects you all have been talking about. Thanks.

  14. Richard says:

    Hey guys, in response to my own post of 12-28, I found VSS was NOT the problem, as it was already off. I did find the problem though. :smile:

    WinDirStat seems to have an issue with VERY long filenames (as in recursive directories). So I found another utility that is very similar to WinDirStat which could handle the long filenames (so long that Windows will not delete them nor recycle them).

    I love WinDirStat, so I am not going to be brash about competitive products, but I DO SINCERELY HOPE this gets fixed soon. If you want more info, you might search SevenForums.com. Thanks guys, LOVE your product despite the bug.

  15. @iRchard, what is the name of the tool you found that’s an alternative to WinDirStat? SequoiaView by any chance? That one hasn’t been updated since 2002.

  16. isabela says:

    EU ENCONTREI! Se você está procurando isso de 2015 em diante, saiba que depois de revirar a internet eu achei a real solução. Esses arquivos escondidos realmente vêm do nosso querido Windows, e não são visíveis nem habilitando a bendita opção de mostrar pastas ocultas. Bom, vamos lá.

    1 – baixe o programa Space Sniffer para analisar seu HD e te mostrar tudo o que há nele (é leve, sem vírus e cumpriu a função melhor do que o famoso WinDirStat)

    2 – Depois de baixado, tire ele do arquivo .rar, cole em uma pasta qualquer e execute como ADMINISTRADOR. Veja bem, essa parte é MUITO importante, se executar ele normalmente não vai dar certo.

    3 – Observe as áreas que ocupam espaços gigantescos do seu PC. Certamente terão algumas que não foram listadas antes. Tente pegar o nome delas e pesquisar na internet para ter certeza de que não irá apagar nada importante, afinal eu não estou aí para te dizer se seu caso é igual o meu. De qualquer forma, se você encontrar um arquivo gigantesco que o nome é composto por uma chave dentro de colchetes (ex: {b4e1b4w2ekkwi46xma54isw-wiejeja0mm89siw-a0wjw2ei7wj} ), certamente seu caso é o mesmo que o meu.

    4 – Essa maldição tem a ver com o espaço que o Windows reserva para pontos de restauração. No meu PC haviam 130 GB reservados para essa coisa. Um exagero… Mas não apague ainda, pode dar problema, vamos mandar o próprio Windows dar jeito na bagunça que ele mesmo criou.

    5 – Vá no menu iniciar, pesquise por “criar ponto de restauração do sistema”, dai vai abrir uma janela que no canto inferior direito tem escrito “defina configurações de restauração, gerencie espaço em disco e exclua pontos de restauração”, você tem que clicar em “configurar”

    6 – Daí vai ter uma parte escrito “uso de espaço em disco” e você só terá que definir um valor menor para “Uso Máx.” – O meu uso máximo era de 130GB, por isso tanto espaço estava sendo jogado fora.

    7 – Coloque o uso máximo em uns 5 gigas, tá mais do que bom. Prontinho, tenha seu HD limpo e com espaço novamente :)

    Ps: meu sistema operacional é o Windows 7 Ultimate 64bits, mas isso deve valer para todos os Windows.

  17. Frank says:

    I am missing some 10GB of my 64GB hdd.

    WDS tells: 8,4GB unknown, System Volume Information 0GB.
    SpaceSniffer tells: System Volume Information 13,4GB and lists files and filedates.
    TreeSize Free tells: SVI 13GB and lists files and filedates.
    These are broken files being created in the last days by bad java apps.

    To open SVI you gotta gain full access:
    Open console window and enter:

    cacls “c:\System Volume Information” /E /G meier:F

    Change meier into your username (must be an administrator).
    Now you see the files and can del them.

  18. Duffy Gorski says:

    Could someone please tell me what the black box in WinDirStat directory listing means?

  19. matrushko says:

    Hi

    I am cleaning my two partitions of c: and D: and in C:\WINDOWS my windirstat shows….THIS:

    [img]http://i.imgur.com/21do7wF.jpg[/img]

    6.6GB of “unknown” space. Huge space indeed, comparing to the 22gb that windows itself occupies.

    How can i know what unknown is?

  20. Arne Bergman says:

    I deleted all .BLF and .REGTRANS-MS files in c:\windows\system32\config and suddenly all unknown were gone. Got back over 100 Gbyte. Great and thanks for the advice. However unknown are slowly coming back? /Arne

  21. Boris says:

    Most of the times it’s to do with recovery files: just clean C disk hidden and recovery files (in more options as an admin). Not just simple disk clean

  22. Aimee Staats says:

    Tried everything all the way down to Boris’s tip. Finally freed up half my hard drive. Thanks :cool:

  23. Shailendra Sadh says:

    The “Unknown” is the system Restore points. I saved around 200Gb of space by following the advice of “Carwiz” in this discussion.

    Hope this helps.

  24. Dillip Phick says:

    In Windows 8(.1) or Windows Server 2012 the Windows Search Service may bloat the Windows.edb file, so it can grow to over 30 GB. To check if this is the issue, run WDS as administrator. If your Windows.edb is bloated, just rebuild your search index: Indexing Options > Advanced > Rebuild.

  25. Josh says:

    Can confirm that running WDS explicitly as an Administrator will show a better snapshot of disk usage/availability including accounting for the folder and it’s mysterious contents.

  26. richard says:

    I have 111.9 gb unknown

  27. MOSES says:

    I have no hard drive space remaining! WDS indicated that I have 856 gig as UNKNOWN.
    I have tried most of the suggestions indicated here to no avail.
    I NEED MY HARD DRIVE BACK!!!!!!!!!!!!!!!

  28. joeyishar says:

    I found the reason for my 350gb of unknown. it was windows backups. I highly recommend these steps for cleaning your pc, they really helped me (one of them is WDS).

  29. joeyishar says:

    I found the reason for my 350gb of unknown. it was windows backups. I highly recommend these steps for cleaning your pc, they really helped me (one of them is WDS).
    just noticed that my link didnt get inputed. here it is in plain text
    http://www.howtogeek.com/125923/7-ways-to-free-up-hard-disk-space-on-windows/

  30. Albert says:

    I had a 45GB portion of my SSD labeled as and none of the above suggestions helped. Running chkdsk /f as admin solved the problem and the portion is now labeled as .

    My system: HP Elitebook, Windows 8.1, INTEL SSDSC2BW180A3H (166 GB)

  31. shivam says:

    I used wds it showed me 375 gb unknown space …when i ran data recovery software i was able to retrive many game setups from that portion but that space is still being consumed by 300gb of game and 75 gb of movies …i know this because i used folder lock software to lock them ,but something went wrong and they were moved to unknown portion as shown by wds…please tell me how to delete them and get my space back

  32. Nelson says:

    Hi there!
    I solved my problem. I had a 38GB that were files I didn’t have reading access, for example, other users directories, system files. After setting the proper access rights, and running WinDirStat as administrator, I got a zero size file.
    Hope it helps someone.

  33. Tri Huynh says:

    Albert’s solution did really work for my case. Many thanks to you, Albert! You have no idea what I’ve been through just because of this. It is definitely “unknown” space, I really don’t know what it is, I just know it is not files.

  34. Pingback: Exchange 2013 Log Files | Girl Gone Geek

  35. Joost says:

    Found my missing gigabytes.
    Windows mediaplayer had gone nuts and wrote nearly half a million JPG images in its cache.

    http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_programs/windows-7-keeps-on-writing-thousands-of-jpg-files/5c263f66-472d-4c1c-99d9-be8fc18ebea8?auth=1

    I found the problem by running windirstat “as administrator” so it could access all files. With half a million files it gets extremely slow and unresponsive – be patient, but it works. Then I removed/disabled WMP and deleted its cache folder from a administrator CMD prompt.

  36. Episodex says:

    tl;dr
    Always run WDS as Administrator!

    For me WinDirStat didn’t list /Users directory when run as regular user. This caused 40GB of . The solution was to run WDS as administrator and then it listed contents of /Users. I found there 11GB of After Effects old cache for example.

  37. Gabriel Bakker says:

    Windirstat is showing 367GB of on a secondary drive of mine that doesn’t house any important operating system files. What is taking up all that space???

    I have tried every suggestion on this list. System Restore is disabled for that drive and always has been. I ran WinDirStat as Administrator and the space is still .

    367 GB!!!!!

  38. Tom S-J says:

    Hi. Try to run Windirstat as “administrator”. I had the same problem with “unknown” files, but “run as adminstrator” fixed the problem :)

  39. gerard says:

    Windows Server 2008R2
    Windirstat 1.1.2.80 missed completely windows/system32/spool (the directory was not even displayed).
    Rights inheritance is disabled at this directory level and it seems to block WDS, too. Note that the Windows user running WDS *has* sufficient rights to see directories and files *below* the spool directory (in Windows Explorer all is displaying fine).
    Btw SpaceMonger (the free version) has the same problem.
    I checked on another 2008R2 and a 2012R2 server and it’s the same, the spool directory is not ‘seen’ by WDS. When printing is working correctly that’s not a big matter, but when huge print files are left over after failed print jobs it can add to quite a lot of disk space.

  40. Pierre says:

    Run WinDirStat as Administrator. The “Unknown” space will likely show up under the \Windows directory, or somewhere you can identify it.

    I found 70GB in \Windows\temp\cab_*, which I backed up to an external file and deleted all but the last month’s. There is also lots of space wasted by C:\Windows\Logs\CBS\*.log

    These files were not deleted by the Disk Cleanup process.

  41. I've SOLVED says:

    Thanks Joe Barrett! With your answer i have finally found what was the problem after these years. My C drive had 28 Gb of . Nothing helped until I tried deleting VSS Shadow Copies. I just opened CMD in administrator mode and ran
    –> “vssadmin delete shadows /oldest” then
    “vssadmin delete shadows /all”

    Ant it worked! Now WinDirStat shows Unknown Size 0.

  42. Joe Barrett says:

    You’re more than welcome!

  43. Kevin says:

    Had a similar problem on a Server 2016 Datacentre machine – OS disk down to 1Mb free, and couldn’t find the cause. Windirstat identified (even when running as administrator) 109Gb of “Unknown” – scanned the same disk with TreeViewFree and found them. 109Gb of memory dump files in c:\windows\system32, which for some reason WDS would not see (expanding the windows folder in WDS, System32 still showed up as 1.8Gb).

    Not sure why it didn’t spot ’em, but hopefully will help someone else out.

  44. Andrew Sarkkinen says:

    Ran WDS as administrator and it worked. I could see the files in a user folder, that was creating the big file.

  45. harry says:

    Company uses all kinds of key and web loggers – so it’s all put in those areas – I needed IT to come in and remove their security tools to free up space :-(

Leave a Reply

Your email address will not be published. Required fields are marked *