Regarding the topic that is being asked for most often. Use the following approaches:
- Run a file system check on the file system (read: drive/partition) in question. E.g.
chkdsk /f X:. You’ll have to have admin privileges and if this is the system partition you will have to reboot. - Check whether you have System Restore Points (SRPs) enabled. If so, check whether the size reported for
- If you have any special software installed that manages its own recycle bin or allows to restore old states of the system this software could use the same facility as the SRPs. Therefore the data may just be hidden/inaccessible to WDS. Nothing to worry if the previous steps didn’t give a reson to worry.
// Oliver
PS: I am about to create a Wiki where users can maintain a FAQ and so on (and possibly translate the help).
Sorry . . . forgot to ask!
As I can’t get windirstat to run a full drive check as ‘admin’, can I just run as a normal user then simply delete all the unknown files?
I’ve tried many things with this problem and nothing seems to work
Thanks
Biggy
Hi Oliver,
I’m not sure if you’ll be interested but I’ve solved my problem . . .
I had to leave windirstat running for approx 9 hours (seriously!) and I discovered that Windows Media Player had decided to continually cache millions of .jpg’s for my very (VERY!) large music collection inside its local folder on the Windows system
I’ve turned the WMP library and cache function off (I never use it for music) and added the folder to ‘CCleaners’ list of user added locations to clean out
I’ve just run CCleaner and I’m slowly watching over 50 gig’s of useless images, duplicated hundreds of times, being slowly banished. I have a slowly expanding hard drive!
Apparantly there’s some glitch in WMP on Windows 7 64 bit machines whereby the program just continually creates album art non stop the whole time the machine is on. No solution for it at this time
Thanks for your hard work, you certainly helped me to fix my PC
Biggy
Dear Oliver,
I am having win7 ultimate. For the last two days my HDD free space is nearing to zero. I free up some space by deleting some movie files, and within hour those free spaces were filled. Had no clue, thought of Viruses and Trojans tried everything I could do.Did chkdsk /f several times. No luck. After googling I installed your WDS. Still with no luck. At least this time, after some more googling, it shows the unknown space. This blog helped me find who was the real culprit. It was my AV program Dr. Web which created a hidden directory DrWebQurantine where it stored thousands of files. Just a suggestion, is there a way you can embed the cmdassys inside your windirstat itself. And an advanced user can enable it under the options menu.
BTW, You saved the pain of reinstalling the OS + All the software. Thanks you very much
-Jegatheesh
Thanks for having this site and info. I had this same problem with 74GB of unknown. I have an IBM ThinkCentre workstation and windows disk management was reporting 145GB hard drive with only 5GB space left. WDS reported different. I had to go into system recovery and delete backups from the advanced drop-down. Solved the problem and now have 79GB of free space. Thanks a ton!!!
Olivier,
I wanted to leave a word of thanks for the superb utility that you have provided.
Permitted me to get rid of some hidden junk in my PC that occupied 30 percent of valuable space.
Hats off!
Srikanth
Very good tool, easy and simple! I have a WIN 2008 server and it helped me in finding “areas for improvement” (like deleting the 4gb hibernate file which is useless on a server).
Now I am struggling with the “unknown” files (over 20 GB out of 67 GB). Any clues of what they could be on a Win Server? Win Server offers no “System Restore Functions” and I already limited the space of Shadow Copies to 3 GB (enough for keeping 2 copies on my disk). I run chkdsk and everything is fine… no need for defrag either…
Thank you for any suggestion you may have!
Hello there, I was having similar issues with my lenovo x61. Just deleted the backups in the think vantage rescue and recovery software and was able to reclaim a whopping 62 GB!
Thanks guys, this was a life saver
Hello Olivier
I am chasing after about 400GB of what shows up as in WDS. I have just tried to download cmdassys.exe but the link to the file http://assarbad.net/stuff/localsystem.zip is blocked by my AV (kaspersky security 2011) because of a trojan… Do you mind checking again ? Your tool seems to have worked for others and I’d be pleased to try it.
Add me to the list of satisfied customers! (And dissatisfied with Lenovo!)
76 GB of “unknown” found in ThinkVantage back-ups. Deleted and future backups cancelled.
Thanks 2 all for info.
borgak, the tool is safe, see my comment above. There are two versions (one using an old exploit to get system rights), but only one of those versions works on newer systems and I never checked that on Vista. You might want to use the one from blog.delphi-jedi.net, a project in which I was involved, too, though.
But again, working for an AV vendor, I do consider the possibility of false positives.
// Oliver
Hello Oliver
I have notice my hard drive space was getting smaller. I currently using Windows 7 Enterprise. I ran WinDirStat and notice 97.8/137.1 GB of my hard drive is Unknown space. I tried you suggested methods above. Do you have any other suggestions.
Hi James,
not really any suggestion. But I’ve got some vacation and we should see some progress (and perhaps a release or at least beta-release of WDS). And this will include some adjustments specific to Vista and Windows 7.
// Oliver
Hi Oliver, i came across this blog after trying to solve what appears to be the same problem most people are suffering.
I am using Windows Xp sp3, fully updated but older machine with smaller hd, needing space i bought a 1tb external and used the HP utility to format it FAT32 (for PS3 compatibility in particular). After format everything was fine, full space showing etc.
After placing 90gb worth of data on the drive i noticed it was now reporting 41gb free, running WinDirStat showed me 802gb unknown file.
Following your blog i ran chkdsk (4 days) which reported and recovered bad links on 27,000,000 clusters but has not returned the space to me. I have also now ran WinDirStat under Cmdassys and it is still showing as unkown.
I do not use any backup software, system restore is turned off for all drives. Any ideas on how to recover this space because i no longer have the space on my main to copy it all back and reformat and would prefer not to lose this data.
Thank you.
Running WDS through CMDasSys.exe allowed me to find my culprit: gigs and gigs of Microsoft Media Player (an application I never use) art cache files. They were tricky to delete — I booted into Linux and mounted my C drive there — but I have my space back! Offending files were at
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Media Player\Art Cache
Good riddance. Thanks so much for all the help.
Hello,
I have an pc with Win 7, (500gbs, with 455 usable) I have 25.5gbs of unknown space in my hard drive, checked system restore and it’s set to use only 2% (10gbs) cleared old restore points, ran Chkdisk, no change, ran window defrag, tells me hard drive is 7% fragmented, defrag finished and hard drive is still 7% framented.
Forgot to mention my pc is a compaq CQ5604f, thanks.
Found cause, it was a recovery program called Rollback RX. it was creating “zombie” space in the hard drive, uninstalled, and defragmented hard drive. You can’t defragment hard drive with rollback installed. In order to remove zombie space either uninstall program, or create new baseline (you’ll know what baseline is, if you use that program) hope this info is usefull to someone, thanks.
I administer a Win 2008 R2 Server that was “missing” about 48 gigs. 2008 doesn’t support system restore points, and this server doesn’t use shadow copy.
WDS show the files as unknown. Ultimately, I decided to run a second tool, just in case. I used SpaceSniffer , which helped me determine that the system security log was writing verbose archives to the winevt folder.
I love WDS, and use is all the time. It is just worth noting that there are other tools out there, too.
We just encountered a 500G drive with 60G of unknown space. The system restore was turned off long long ago. CHKDSK reports no error. Running WDS with SYSTEM AUTHORITY shows rather small System Volume Information folder (not zero) and still 60G of unknown. After some rough time we finally figured out that hugh space is actually deleted files “protected” by Norton Protected Recycle Bin. This is definately a bug rather than a feature for us…
some final thoughts:
– OK CMDasSys.exe is NOT virus, but NOD32 suspect it to be some variant of a trojan. So we use sysinternal’s psexec to gain SYSTEM privilege;
– Beside rootkits there are other ways to hide something in NTFS filesystem which will contribute to the “unknown space”. I confirm that Alternative Data Stream, for one, will simply eat space flagged as unknown.
– There’s still 400-700M of unknown in each partition. Too small to bother any more. How does WDS treat directory and MFT? Are they what I saw?
Forgot to mention that, I like WDS and I still think it’s the best of its kinds. Hail to the Author!
To those who still encounter huge (>1G) UNKNOWN space when running WDS in SYSTEM account, the next good step might be running sysinternal’s Rootkit Revealer.
Thanks a lot for your post Luke!
Your simple solution worked perfectly for me!
@Justin-
Thanks for the clue on SpaceSniffer – for whatever reason WDS wasn’t showing me the space used by IIS logfiles, while SpaceSniffer did. Reclaimed 2GB there, which was sorely needed 🙂
My Westerndigital my passport 750 gig drive has about 7.5 gigs of unknown space what would happen if i delete them any ideas? is it important?
Most of the problems people are seeing on server is from the local drive snapshots. By default it can use as much of the drive as is available to keep the snapshots.
You can go to the Storage Manager and right click the drive and select properties.
There will be a Snapshot tab. Adjust the size as needed and you will see the unknown file size adjust accordingly.
If it is a machine where you are positive that you will never need a previous version of a file, you can disable it in the same place.
bwquestion – Storage Manager – you mean Windows Snapshots. If so then yes that is one of the first things you should check. But from what I can tell, people usually come here only after they have fixed that and several other things like emptying temp folders…
Not really at all computer savvy but would just like to add something that worked for me with the same problem. I had a large ‘unknown’ file which I knew was there thanks to WDS but I couldn’t find it or delete it. I did suspect it was something to do either with page filing or with system restore but I had both turned off and had had them turned off for well over a year. (I have an Asus eee 901 pc with a very small solid state hard drive so they are luxuries I can’t afford). I tried lots of solutions, chkdsk, etc. but nothing worked. Finally, I tried turning system restore back on and then turning it off again and, hey presto, the unknown file disappeared. It may work for you.
if you have a Lenovo computer, the likely culprit is the Rescue and Recovery software. This is detailed in other entries across the web: you have to delete recent backups. I tried all the other things, but none worked, until I got onto the Lenovo angle.
Hi!
I have a windows server 2003 R2 with a C: partition with 60Gb capacity.
I’ve tried what people write in the comments, but I can’t find out whats exactly wrong.
you see, 85% (49,7gb or so) of my disk is allocated in the section. I’m not an expert and wasn’t able to figure it out.
-Sebastian
YES! YES! Spent so many hours on this. I reinstalled XP and there was not a complete wipe for some reason. Here is how to see unknown stuff with more complete instructions:
Download this : http://assarbad.net/stuff/localsystem.zip
Then I found these instructions:
Right click on your WinDirStat shortcut > Properties, on that page > Start in: Copy the info on that line.
Start the executable (as Administrator) named ?CMDasSys.exe? after unpacking the archive ( localsystem.zip ) to some temporary location.
Enter this in the dos window:
cd ( space after cd ) paste & hit > Enter.
Now type windirstat.exe to that line & hit > Enter.
WinDirStat will now fire up. Run WinDirStat and you’ll see everything. Delete the crap.
When finished with Command Prompt, close it.
I got rid of 90 Gb of images and music from the previous XP install.
When I used F7 to unhide hidden files it is showing 0 byte Unknown File in my main C drive .
I am running Win7 64 SP1
Does the software not like win7 ?
Thanks , still cool and useful never the less.
I couldn’t find where all my disk was being used. Using your s/w I found I had c200Gb of – turned system restore off and on again after reading this blog – 200Gb of free space appeared. Miraculous.
My computer crashed a while back and I did a system restore on it. It kept freezing for a while and finally got it to work, but now I cant find all my old software music and pictures. I installed wds and it found ALL my files movies pictures and music but I cant access them. I am running win7 ultimate, any suggestions?
Oliver,
Thanks for mentioning running WinDirStat as Administrator. My old Win 7 64 bit ultimate is used by the family with 3 user accounts. We kept running out of space. There was a large Unknown space use on my compact C: drive.
By right clicking on the WDS icon on my desktop, I was able to select Run As Administrator and this time WDS showed the unknown space to be an AVG log file called ‘toolbar_log.txt’.
The file was 4 GB and growing. AVG forums report it can be cleared by disabling the AVG browser bar (View | Toolbars | click on AVG security toolbar).
I was able to delete the file directly from WDS – thanks for that too. Saved me from the restore I was considering next.
I love the information WDS provides – wonderful work!!!
Thanks,
Simon
Hello and thank you Oliver and all posters!!
I had almost FIFTY PERCENT of my hard drive unaccounted for. WinDirStat told me that almost 100 GB was UNKNOWN.
I tried all the fixes on this thread, starting with Oliver’s three point plan- no luck.
Then I turned System restore off- and turned it back on.
A BLOODY MIRACLE I got all my space back.
Best part is, I created a restore point, and I have one now, and it didn’t use up half my C drive to do it.
If I lose half my hard drive again, however, now I know what to do, thanks to you guys.
Biggy wrote:
2010-05-31 at 16:30
“Sorry . . . forgot to ask!
“As I can?t get windirstat to run a full drive check as ?admin?, can I just run as a normal user then simply delete all the unknown files?
I?ve tried many things with this problem and nothing seems to work
Thanks
Biggy”
To run WinDirStat as administer, just right click on the program- a menu will come up with an option “run as administer”. Double click that option and you can get into the program with full access to all files and information on your computer.
http://www.sevenforums.com/general-discussion/233528-hard-drive-showing-full-mysteriously.html
Good Morning Everyone,
I also have a Lenovo and have had soem serious problems with unknown space (as you can see in the link i posted above). I have a 714GB harddrive with 587GB of unknown space!!!!! This happened a couple of months a go but I have yet been able to conquer this problem. If anybody has an advice I am all ears.
I have done the disk check and deleted system restore points. My Lenovo has the One Key Recovery program which I have tried to delete, but it didn’t let me. But I was unable to discover if it was that which created the unknown space.
Also I tried and failed to run cmdassys.exe using the instruction Chris posted above, and other instructions? I typed:
cd Program Files (x86)\WinDirStat …..did not work
Also, is it possible to run WinDirStat from the Hiren reboot disk? I was advised that you could but when I booted I did not see the option.
Using the tool here:
http://blog.delphi-jedi.net/2008/05/08/runassys-10-preview/
We ran WDS as system, and we were able to see the offending Unknown files. Worked like a charm. Windows 2008 Server.
spacesniffer also did the trick for me. it was security event logs in the winevt folder eating 80GB of space up. All is good now. Thanks for WDS and thanks to all the folks that posted solutions/suggestions.
I found all my unknown space in my drive Properties–Shadow Copies. I have server 2003 and SpaceSniffer also has the unknown space as Windirstat.
WOW is all I can say. I took turned my System Restore off and them back on and I freed up over 60% of my HD. Thanks so much everyone. I wonder if I could do that the same with the USA!!!!!
Windirstat found 172 gig unknown on my Win 7 X200T tablet from Lenovo.
Spacesniffer was able to delete it. It was inside a directory.
Sometimes the problem seems to be files somehow “stuck” in a directory.
However, these are not real files. It is a drive error. It took only a few seconds to delete 172 gigs. Normally it would probably take quite a while. So they are erroneous file links. If you can not delete with this program (I could not) run spacesniffer as admin and it works. Do not delete the directory, drill down and delete the files.
Hi………
I had over 50GB of a 128GB SSD as Unknown. Running W8, I considered everything here especially Restore points, but made no progress. Tried SpaceSniffer and it immediately identified all the Unknown space was allocated to SPOOL. Amazing. Did a quick search and found the method for clearing spool:
Clean out the pending print jobs
Open a Command Prompt window
Type the following
net stop spooler
del /Q “%windir%\system32\spool\PRINTERS\*.*”
net start spooler
exit
Instant GB back for me!
I now realise that the spool queue had filled due to problems with a PDF print spooler. The consequences were very difficult to sort out, but WINDIRSTAT and SpaceSniffer were extremely useful in working it out.
Thanks…………
Just turn off hidden files and system files and you will see the dreaded folders that are “unknown”.
I just erased 70gb of Windows Index DB because some moron at my work decided to index a year time worth of logs.
Hi Gil, this isn’t exactly true. WDS does not share the handling of “hidden and system files” that Explorer has. So it wouldn’t care about it. Running it as admin is a much more sensible method 🙂
Or perhaps I missed something else.
Have a nice weekend.
I’ve used this tool to identify and clean up restore points in the past, but ran into this again with over 100G in Unknown space with no restore points or shadow copies.
A little digging around and I isolated this to a backup from the Comcast provided Norton Security Suite that was being written to my local C drive, in a directory named C:\N360_BACKUP. I thought I had turned this off (backing up C to C is bad, after all) but wasn’t routinely reviewing it, and 2 million files later I had under 19G free on a 500G drive.
This was compounded by the fact that the entire directory was inaccessible to me as the admin user. cacls wasn’t running recursively, so I was getting parents but not children in the file system. I think I got it worked out by removing the read only attribute from the parent and pushing it down, but Windows Explorer kept dying on me and I don’t know if this completed (I’d left it running over night). I’ve identified all the files and the space they’re consuming and a Shift-Del is running, but we’ll have to see how much of it is actually removed.
Just wanted to throw this out here for anyone else that gets hit by this Norton backup issue.
HP laptop running Win-7 Prof 64-bit.
use AVG Anti-Virus, Erunt for Registry backups, Auslogics for defrag
Machine has 3 users set up and I logged in as Admin.
Window Explorer shows that System Drive has only 8Gb free out of 95.7GB.
Disk Mgmt – shows drive as 95.7GB and 8GB free, No unallocated partition etc is shown.
Restore – deleted all old restores and disabled restore
VSSAdmin – checked for shadow copies and everything seems fine
WinDirStat – ran as Admin. Shows “Unknown Space” for 26.9GB
Also had run chkdsk and no issues were found
How should I proceed to either find what is in this unknown space or get this space back?
thanks
I just solved this problem, my SSD was completely filled and I could not account for the space. Windirstat indicated that the problem was in c:\progdata\microsoft\search.
I had turned the windows indexing on for drive C:, which is a mistake for SSDs, so I turned it off. (Indices on the SSD will wear them out faster, because of the write operations every time a file is changed ). I did not recover the space but now the search folder became an unknown file in Windirstat. By opening up the folders manually in windows explorer, I could regain permission to view them and Windowdirstat would recognize them again.
It was my 1 TB harddrive index that was stored on drive C:, which was still occupying the space. I went to the control panel and under index, I was able to move this index to the harddrive and get it off the SSD. Windows actually does not move the file, but deletes it and recreates it, so if it is a large 50 GB, it will take at least 30 min to move. However, after it completed, I had regained the 50 GB on my SSD, which was required to install other MS bloatware that only install on drive C:.
I did not see this fix in other places, so I hope that it help someone else.
Cheers,
Pete
This worked perfectly and we were able to fix a lingering issue on this old laptop we are working on for a local youth group. Thanks!