Regarding the topic that is being asked for most often. Use the following approaches:
- Run a file system check on the file system (read: drive/partition) in question. E.g.
chkdsk /f X:. You’ll have to have admin privileges and if this is the system partition you will have to reboot. - Check whether you have System Restore Points (SRPs) enabled. If so, check whether the size reported for
- If you have any special software installed that manages its own recycle bin or allows to restore old states of the system this software could use the same facility as the SRPs. Therefore the data may just be hidden/inaccessible to WDS. Nothing to worry if the previous steps didn’t give a reson to worry.
// Oliver
PS: I am about to create a Wiki where users can maintain a FAQ and so on (and possibly translate the help).
My hard drive on my HP laptop is 100GB. Over the past while, it has been filling up. It’s gotten to the point where there’s less than 10GB left. The odd thing is, I save all files to an external hard drive, so I did a little investigating. I downloaded WinDirStat, and it showed 57.2GB “unknown” of unknown space. I did all the steps above, which gave me some more hard drive space, but the 57.2GB unknown space is still there. Any ideas?
Well, this probably means that point 3 applies in your case. If you’d like to test this, download a tool from my homepage (only if you use XP, Windows 2003 does not work in all cases – also you will have to work on the console, i.e. not via a terminal session):
localsystem.zip
Start the executable (as Administrator) named “CMDasSys.exe” after unpacking the archive to some temporary location. Then
cdyour way to the folder where you installed WinDirStat and execute WinDirStat (either windirstat.exe or windirstatU.exe) using the command prompt window. Tell me whether there is lots of stuff on the drive in question underSystem Volume Information. Moreover tell me, how much “Unknown” space is left using this method.Please do not delete anything when running WDS this way. This command prompt runs with elevated privileges and can do serious damage!
If you find that there is stuff inside
System Volume Information, pleasecdintoSystem Volume Informationand doand send me the
wds_problem.txtby email (to my private email address please!!!). The naming of the files therein may give us a clue as to what program is responsible for putting the files into theSystem Volume Informationfolder then.// Oliver
Thanks for the detailed response, Oliver. After running WDS through the CMDasSys, it shows practically no unknown space, but most of the previously unknown stuff is in a folder called “System Recovery” in folders called “USERDIFF.#” where # = numbers 1 to 29. There is 48Mb in the System Volume Information folder.
Do you still want the wds_problem.txt folder, or does it now not apply. Ideas on getting rid of the System Restore stuff?
Alright. The TXT file is not needed of course, at least not for the
System Volume Informationfolder. Apparently the culprit is thisSystem Recoveryfolder. One thing that you didn’t mention and that I didn’t ask: which OS are you running WDS on? Vista?If it is XP or 2003 it has to be some third-party software such as from Symantec or so. If it is Vista then it is possibly some new facility.
By the way, you can of course just remove everything using the command prompt with elevated privileges, but I assume it would be wiser to find out first what belongs where and then conclude the next step.
// Oliver
It is Win XP Pro SP2. I run AVG as my AV, no Norton installed. From what I can figure out, it belongs to the HP Recovery and Backup program that came installed on the laptop. I have uninstalled that program, but the files remained. I called HP, and they recommended I just reinstall Windows to get rid of the space (obviously a little extreme of an option). With the program removed, do you think I would be ok to just remove the files?
Certainly that is no problem with the program removed!
Please note down the exact path to the
System Recoveryfolder, e.g.C:\whatever\System Recovery.Now open the command prompt again (see my first reply). make sure not to go into the folder in question. Then issue the following command:
(Replace the path with yours, of course. Also make sure the whole path name is enclosed in double quotes, since the folder name contains blank spaces!
RDmeans “Remove Directory”.)That should do it. However, with more than 50 GB this can take a while, so be patient and don’t close the command prompt before the action finished. Also be really careful with the folder name because any glitch could seriously damage your system.
Good luck!
// Oliver
Hey Oliver,
Thanks! That seemed to do it. It removed the directory in less than a minute, even. Not sure why it removed it so quickly, but whatever. If I can donate to the WDS program somehow, let me know, and I’d be happy to do so.
Cheers,
Tim L. Walker
Hi Oliver,
I have a similar problem to thebassman. My 3-month old T60 Thinkpad (running Win XP) shows about 77GB (56% of my hard drive) as “unknown” space and only 7GB of free space. I went back to my IBM/ Lenovo dealer yesterday, their answer was to reload my Win XP OS which, in addition to being very time consuming, seems like a lazy solution.
I tried running WDS through the CMDasSys, it still shows 77GB of “unknown” and only 20KB under System Volume Information.
I disabled System Restore but that didn’t seem to help. I am tempted to try running rd /s “C:\whatever\System Recovery” but how do I find where the System Recovery folder is? Any other suggestions?
David
Did you try the chkdsk first?
// Oliver
Does the thinkpad have it’s own back-up or system restore feature on it? The HP backup software is what was causing my problem…
Good luck,
Tim L. Walker
Oliver,
I’m not an expert on using DOS prompts but instead of typing:
chkdsk /f X:
I just typed:
chkdsk and it ran for a while and then the window closed by itself so I don’t know what the result was.
Tim,
The Thinkpad does have its own system restore feature but I can’t find how to check if there is a problem. And when I use Disk Management it shows that the ServiceV001, which I assume is for Thinkpad applications, is only 4.41GB.
David
David, press Win R and type in CMD, then press Return. A console Window should open. In it type:
chkdsk /f X:
once for every (hard drive) letter in your machine, where you change X into the driver letter in question.
// Oliver
Oliver,
I ran chkdsk /f C: after my system rebooted, there didn’t seem to be any problems and Windows started afterwards. I still have 77GB of unknown space on my hard drive. I guess this is where I start preparing to reload Win XP …
Not necessarily. There are more problems that can cause these symptoms. But it may be the last resort at some point, that’s right. I can only offer you to have a look at it in 2 hours from now. If you want it, contact me via ICQ 281645.
// Oliver
David,
If you are still having trouble with this, on a Thinkpad T-60 Go to the “ThinkVantage” rescue and recovery advanced dropdown and select delete backups. Then delete all of the backups that you don’t “NEED”. I cleared up ~24Gigs of Space with this. I would set this up to only back up files that you really need…and only keep the last 1 or so backups, once you’ve determined that you don’t have a problem, delete all but the last one. You can also set it to back up to a different device. But the Backups come up as unknown on WebDirStat…
lettuce
Oliver,
Thank you so much for this information, it really helped me with my computer problem. I’m running Win XP Home Edition on a Dell with 100GB and lately I’ve found that all of my free space is gone even though I should have about a third of the space free. Your post helped me find the culprit, using windirstat and your program I found that my system volume information file is taking up 28.7 gigs. I’ve had system restore disabled for a while. I actually had about 36 gigs in the svi file but by enabling system restore and telling it to delete everything but the most recent snapshot I gained 8 gigs. I’d really like a way to get rid of all of these files in the svi but from research online it looks like I could do a lot of serious damage that way. How should I proceed? Thank you so much for all of your advice, it really helps the less tech-savvy.
-Paul
Hi,
it really depends whether you have some other backup measure in place. If you do, I – in your stead – would turn of system restore points and remove everything. There are indeed a few files in SVI which are vital, so be careful. Better use the controls the system offers you.
// Oliver
I just remedied a major problem with . Basically, what had happened was at one time or another, Windows allocated about 260gb of free space on a WD Mybook as used. Chkdsk did nothing, disk management reported the disk as 100% full, and windirstat showed a huge chunk of <Unkown>. I don’t use system restore, and the chances of me getting a virus are pretty slim (I run Linux 90% of the time. Windows is only for light amounts of gaming), so basically the way I found to fix it was fairly simple: just run chkdsk /f X: under CMDasSys.exe. It spit out the message “CHKDSK discovered free space marked as allocated in the volume bitmap.” almost immediately, and repaired it within a fraction of a second.
Hey. Good to hear you could fix it for yourself. Just as a side-note. CHKDSK is supposed to be able to fix this even without running as SYSTEM. Sometimes this will involve a restart (if the volume is mounted and in use and can’t be unmounted forcibly), but all in all this is supposed to work from a normal admin account as well.
// Oliver
I have a 2GB USB with 400MB unknown. I have both U3 and PortableApps on it. After running WinDirStat as System, it still turns up as unknown.
Great information. Thanks. I was able to clear my problem. I have Restore Points turned off on both drives, but it appears that the install of either Sophos or Microsoft Search triggered a 7.5 Gb RP file.
Exactly what I needed, and without the flaming that goes on in many other boards.
hi oliver,
i have an HP dv2730tx laptop run in vista home OS with 250gb hard drive.
i have my drives partition plus it has another 12GB recovery. So all in all i have 3 partitions, my C: and D: drives have equal spaces.
my problem is, when i look in the windows explorer and see the bar of how much space is still free, it says 63.0gb of 112gb. but i know it could not be because only few programs are installed in my laptop, when i go inside my C: and selected all the folders then right click –> properties, only 20GB are used. I even used windirstat and it also produces the same result 20GB used, i wonder where does the remaining 30++Gb go?
thanks
Hi,
there could be one reason only, that I can imagine here: sparse files. NTFS offers to create totally or partially sparse files where the contents will be filled in over time. This means that not all the space is occupied when this sparse file is created. Depending on the tools you use, it will either show the real size on disk or the one that is reserved.
// Oliver
PS: Everything else would boil down to corruption of the file system. In this case run CHKDSK.
I had a similar problem: 150 gig hardrive in a T61 Lenovo thinkpad. unknown space was at 115 gig’s. My machine was running into trouble. I went to the ThinkVantage>system backup and restore>Advanced, and deleted all but the most recent backup…nothing changed (took a few hours). Then I went in and deleted the most recent backup (it said it was about 7 gigs), and shazam!!…bingo!! the unknown space went away and my machine is back to normal.
Thank you so much for this site, I found it doing a search on google.
I really think it was just the last backup/restore that was done and something went wrong with it to fill everything up, my machine was running fine until around when this backup occurred about 3 weeks ago.
Thanks again so much, I really appreciate the help.
Alright, for any readers of this post. There is another issue that has surfaced recently. WDS is not aware of some special “virtualized” folders on Windows for x64. This means that at the moment the results will – to some extent – be inaccurate for those platforms. This is being fixed for the next release.
// Oliver
Thanks a lot for the info – it cleared up 25 gig out of 32 gig unknown on this Lenovo X61 running Vista. The rest was recovered by running disk clean up with “System Restore and Shadow Copies” marked to remove.
hi i am running a lenovo 3000 n100 (vista service pack one) i have a 14.5 gig unknown that i cannot seem to get rid of
i have done a chkdsk c: from admin cmd and from the tools selection from hardrive properties
i have disabled system restore and deleted all system restore points
i have deleted all backups that rescue and recover made but the one on a portable hardrive
so i cant think of how to proceed
I have 3.6 GB (28%) space on a 16 GB USB drive with U# and portable apps on it.
I used Ubuntu to completely clear and reload the contents but the lost space is still lost.
My best guess is that the lost space has to do with life span of the individual cells on a flash drive. IE the lost space is out-of-order/expired sections.
i’m having a similar problem. i have a 1.5TB drive and some how 400 shows up as unkown, i have windows xp64 system restore is off no other programs installed other then WDS and localsystem.zip
using localsystem.zip WDS still shows 400 as unknown. when i look at my disk manager, it showed the full size of the drive and that i’m using 415gb. anyway to gain access to this unknown so i can fiigure out whats in it and see why i’m missing a chunk of my drive?
more advice would be to check to see if your unknown space matches with the disk space set aside for that disk in the windows system restore settings, found in: control panel/system/system restore/ select disk, “setings”.
if the size set aside is too large make it smaller (12% is default!)
i would advise to leave system restore on because it has saved me alot, even from a virus attack.
Charlie.
I think in general we can state that this is the single feature that has caused the most grief so far.
It’s likely that it will be default-off in the next version.
it could be better to just provide a list of things it could possibly be (just so ppl dont panic) and suggestions how the user could fix it. maybe there is a way to analize the unknown so it is known. i didnt know my pc allocated so much (and used it all), obviously others didnt either.
There might. The biggest “problem” in that sense is that WDS is multi-threaded. Under some circumstances fetching the backup privilege will already do the job and let me look into “System Volume Information” etc.
However, the privilege needs to be enabled for all threads and the user has to own the privilege in the first place. So basically WDS would then behave differently depending on the “context”.
I’m having exact same problem as the others, i.e. 50+ GB of unknown data I cannot reclaim. I tried the “chkdsk /f c:” but the process completes without error and without reclaiming my space. I then tried downloading and extracting your LocalSystem file but when I try running cmdassys.exe I never get a command window. I tried the other programs ans with RUNasSYS.exe I see a cmd window for the blink of an eye. Fyi, I booted in safe mode, logged in as Administrator and tried to run it, no help. Any advice on why I cannot get cmdassys to run? Thanks!!! Btw, I have WinXP sp2 build 2600.
Hi there, well I got your program to work and I think I’m going to be able to get myself sorted. Thanks!!!
Thank you for posting.
I have a Sony Vaio running Vista with 52 of 100gb showing as unknown in WDS.
After disabling the System Restore Points all of the unknown space came back.
WDS and the info on this page rocks !!!
I just now recovered approx. 14 GB of ‘Unknown’ space in my laptop because of valuable info on this page.
Many Thanks.
Hello Oliver —
I have been sifting through your excellent comments on the space problem. I have a ThinkPad T60 that’s about 3 years old, and usable space has been steadily eroding. Yesterday I all of a sudden lost another 6 gigabytes or so, which alarms me. WinDirStat doesn’t know what’s in the Unknown area.
I downloaded and ran CMDasSys.exe, ran chkdsk under it. It doesn’t come up with any Unknown space, and says I have the same amount of free space as is shown in Properties for my C drive.
I uninstalled all the ThinkVantage stuff when I got this laptop, since I was using it for multi-track audio and didn’t want anything clogging up the works. I wonder if that has caused more of a problem than is usual for these situations.
Any light you can shed would be greatly appreciated.
Ethan Campbell
One more thing: When I look at System Restore, the only option I see is to reduce the percentage of space allocated to Restore points — nothing about specific points, or how many points to allow. I did reduce the allocated space incrementally several times, to no effect.
Thanks,
Ethan
OK folks.
This is how I was able to see the contents of .
After hours of trying this was my solution: start WinDirStat through DOS, as administrator. Don’t start it through Windows.
– Start Cmd as administrator (in vista type cmd in the start box then right click and select run as administrator)
– In the DOS prompt navigate to where WinDirStat is installed and start it from there – to do this type winddirstat.exe. All of a sudden the 44% of my drive that was is now shown to be Windows/temp.
I had over 40% of my drive as Unknown. And this was after disabling System Restore, Deleting Shadow Copies, and running Chkdisk. I still had a huge amount .
My next step will be to find out whether I can delete all that temp folder stuff. That’ll be more investigation but I’m pretty happy. I’m 95% ahead of where I was before.
Above, I meant to write “the contents of <Unknown>.
I have a Lenovo X301 running Windows 7 and I realized I have been losing disk space. Using windirstat, I have 56.8GB of unknown file out of 128GB hard disk I have.
Lenovo has this “Enhanced backup and Restore” feature in their “lenovo ThinkVantage Tools”. I disable this service and delete any saved restore points. I eliminated 36GB from the unknown file! I presume the rest of the other 20.3GB of still unknown files are related to Window 7 restore points files. So I leave them there until I figure out other wise.
Hope it helps…
-Mark
LOL, I have to come back and clarify that in my comments above, I meant “the contents of Unknown”. I used the pointy brackets around Unknown and the word wasn’t being published.
Fixed it the glitch due to the angle brackets.
I have the same problem. I have a hard drive of 292GB and i used SpaceSniffer and WinDirStat and have 130GB of Unknown Space.
I also use system restore and backup.
Does anyone knows how to delete those files?
Lennert
The programs posted here LocalSystem is Trojan infected! Please do not download or use.
a.) Trojans don’t infect software, they do malicious things under false pretense.
b.) I wrote the programs, all three of them, and they should not contain anything malicious, unless my server got hacked.
c.) there are no indicators that my server got hacked.
d.) I ran the files through VirusTotal, a web-based multi-scanner, and cmdassys.exe yielded a “suspicion” from Comodo *only*.
e.) I am an antivirus developer and researcher myself and as such trust my own judgment as well as that of our command line scanner that got today released in the new 4.6.0 version.
f.) runassys.exe is a special version that would allow an unprivileged user to acquire system privileges, *if* the vulnerability exploited by it still existed. (unless you run NT4 or a Windows 2000 without updates, you will be safe.)
g.) look into the source code, it comes inside the archive and the detections are all false positives (see VirusTotal results for that file). However, you don’t need that program (cmdassys.exe will be sufficient) don’t use it. Aside from that, it is likelier that some script kiddies took the readily available source code from me and integrated it into their malware. Not my fault. I stand by FLOSS.
Common sense helps when an AV falsely reports something as malicious. But if I didn’t know that I wrote it, I might have judged it the same way as you if it would have come from another person. Although the results are not unanimous (our scanner does not falsely detect it ;)), one would be on the safe side assuming the worst instead of taking the risk.
In the end it depends whether you trust me or not. Being employed by an AV vendor I couldn’t and wouldn’t afford to write malware.
// Oliver
I should add, that if you don’t trust that program, better don’t trust WinDirStat either 😉
Seriously: If you don’t trust it, don’t use it. It’s okay not to use it. I checked it just under a Disassembler to be sure and the file is legit and unchanged since I released it in 2003.
Hello all,
Been reading the above with interest as I have a very similar problem
I run a 64 bit HP system but it has a clean install of Windows 7 with none of the HP rubbish on it!
My C: drive is 100gb and at the moment it’s showing 100% full except for about 5gb
A check with windirstat showed a huge amount of ‘unknown’ files (about 60gb) which adds up because my windows folder and programs account for the rest
My problem is: running windirstat in any way at all as an Aministrator leaves the program ‘hanging’ after a while
If I just start it as ‘administrator’ it goes to about 16% then seems to stick and goes ‘not responding’
I’ve used the zip file above Oliver (CMDasSys.exe) and it gets to 20% but still hangs
In both cases I’ve left it an hour or so to see if it was just taking a while!
Any thoughts or suggestions would be gratefully received
Thanks
Biggy