39

I recently noticed that one of my external hard drive seems to be missing a lot of space. It was recommended that I try WinDirStat, as it could help identify how much space each file was taking up. This is the result:

http://i.imgur.com/KU0Yia7.png

As you can see, there is about 244.7GB "unknown" usage.

Doing a bit of research online, the most common suggestion was (a) Recycle Bin and (b) System Volume Information.

(a) As you can see, empty. To double check, I ran Disk Cleanup. It confirmed that it was empty. (Note that a new file appeared by the time I took this screenshot, but it's only 129 Bytes.)

(b) Harder to tell. However, according to various forums, the most common reason for System Volume Information to grow large is due to System Restore Files. I had a look, and it is definitely turned off for this drive, as seen here:

http://i.imgur.com/JZ49qrC.png

What else could be causing this issue? It is an enormous amount of storage to have gone missing!

DavidPostill
  • 153,128
  • 77
  • 353
  • 394
BSnapZ
  • 493
  • 1
  • 4
  • 8
  • "System Restore Files. I had a look, and it is definitely turned off for this drive" - was it ever turned on in the past? – DavidPostill Aug 30 '15 at 10:23
  • 5
    Did your run windirstat as administrator? – DavidPostill Aug 30 '15 at 10:28
  • @DavidPostill This is the first time I've checked system protection settings since buying the drive earlier this year, so I'd say that it has never been turned on. And yes, this was run as administrator. – BSnapZ Aug 30 '15 at 10:53
  • Did you upgrade to Windows 10 from a previous version of Windows? Perhaps there were files on the drive from the old version that now have the wrong owner/permissions and cannot be read by WinDirStat. – DavidPostill Aug 30 '15 at 10:55
  • Try taking ownership of the whole drive and and run WindDirStat again afterwards. See my answer [How would I use Takeown to take ownership of all folders on one drive?](http://superuser.com/a/813881). – DavidPostill Aug 30 '15 at 10:57
  • 2
    I prefer TreeSizeFree over WinDirStat . Run TreeSizeFree as admin to see more. – magicandre1981 Aug 30 '15 at 18:22
  • @DavidPostill Yeah, I upgraded from Windows 8. I'm at work now and only have a Mac until I get home. Interestingly, I plugged the drive into the Mac and had a look through the Sys Vol Info directory from the terminal, and it only has a few log files amounting to KBs. Otherwise, it's empty. – BSnapZ Aug 30 '15 at 21:09
  • 1
    @magicandre1981 I just took your advice and tried using TreeSizeFree. It actually did find the missing space! It is a very well hidden folder which I can only assume was created by the backup software I use (CrashPlan). Now I just need to figure out whether it needs to be kept or not... http://i.imgur.com/JE6fVzt.png – BSnapZ Aug 31 '15 at 06:11
  • @DavidPostill I took ownership of the drive as suggested, but WinDirStat still couldn't find the space. However as you can see in my reply to magicandre1981, I did end up (mostly) solving the mystery. – BSnapZ Aug 31 '15 at 06:12

6 Answers6

23

Running Windirstat as Administrator will reveal most of this. In some cases it can be system protection files, corrupt files, old installers, or in my case, the Recycle Bin.

Per the Windirstat Propaganda Blog,

https://blog.windirstat.net/20061013/unknown-space/

This mysterious item is just the difference between what Windows reports as the free space on the volume minus size of the files WDS can access. Please note the part WDS can access! This is the important point here. WDS cannot access the files under System Volume Information on all the (NTFS?) drives, so it cannot sum up the sizes of these items. And by the way, we have had reports of up to 30 GB of “” space.

The root of the problem is permissions, apparently.

J E Carter II
  • 376
  • 2
  • 6
17

Instead of windirstat you should use TreeSizeFree.

enter image description here

Run it as admin, so that TreeSizeFree shows all hidden/system files.

magicandre1981
  • 97,301
  • 30
  • 179
  • 245
  • 1
    Thanks. In my case, it showed that the space of 40 GB was the virtual drive used for Docker (`C:\Users\Public\Documents\Hyper-V\Virtual hard disks\MobyLinuxVM.vhdx`). – Michaël Polla Nov 05 '17 at 14:54
  • I also have the `MobyLinuxVM.vhdx` which is about 2gb. And I have a similar situation, but how can I confirm that it's docker related? https://superuser.com/questions/1371209/sd-card-has-26gb-large-file where did you find that? Since both windirstat and treesize do not show a name or anything even when I run it as admin. – JP Hellemons Oct 31 '18 at 10:30
  • 2
    I don't see how TreeSize can help. I have an of 100.6 GB on the C-drive (reported by WinDirStat) and TreeSizeFree reports a Size of 54.2 GB and 54.3 GB Allocated on C-drive. The total size of the C-drive is 213 GB. – AH. Oct 21 '19 at 09:05
  • 1
    you need to run it as admin... – magicandre1981 Oct 21 '19 at 14:40
  • 1
    I tried TreeSize and it cannot free "unknown" space for instance allocated by multiple restore points. – AH. Oct 31 '19 at 08:58
  • I never see unknown. Run as admin. I told you this so many times and this is my last reply. – magicandre1981 Oct 31 '19 at 13:47
  • Yes, TreeSizeFree (running as Admin) found 1TB of missing space for me inside `D:\System Volume Information\Dedup\ChunkStore`. WinDirStat (running as Admin) apparently couldn't get into System Volume Information. – mwfearnley Jul 13 '21 at 10:00
  • 1
    Run `WinDirStat` as admin and you will also see what occupies previously unknown space. No need to install yet another program. – Monsignor Aug 08 '22 at 05:24
2

This might be of interest, or not.

I run WinDirStat (NOT as admin) and get 7.3GB unknown. Program Files 1.7GB. When I run it as admin I get 5.2 and 3.2GB respectively. There are other differences too but I won't muddy the water by posting all of them.

It's definitely a permissions issue for me. For example the difference in Program files is the WindowsApps directory. I changed the owner from Unable to display... to ....\users and WinDirStat sees it in either mode (no admin/admin).

Same for SystemVolumeInformation, despite not being able to change owner for all items. Found all but 0.6GB of unknown space. Some of the remainder is in ProgramData and small amounts in other places e.g. Config.Msi.

I am not so concerned as to spend time hunting through the whole drive and changing premissions but I now understand the differences. Hope this helps.

mwfearnley
  • 7,172
  • 5
  • 26
  • 38
KeefyW
  • 21
  • 3
1

In my case it's the Windows search file, Windows.edb, in: \ProgramData\Microsoft\Search\Data\Applications\Windows.

Lll Fff
  • 11
  • 1
  • 1
    Can you please elaborate a bit more for what the file is and how much it takes up for other future answer seekers? – Eric F Apr 09 '19 at 19:12
1

For others facing this same question, you might want to check the VSS settings to be sure the amount reserved for shadow copies is not consuming too much space. (ie right click the drive in windows explorer and choose "Configure Shadow Copies")

KenO
  • 11
  • 1
  • 1
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Oct 24 '22 at 19:33
1

Important to know is how WinDirStat works and what this "unknown" means. For example: you have a drive of 256GB. You run WinDirStat and it will scan all the files it has access to. Let's say you run it as a normal user. That user has no permissions to 'see' all the files. If the list WinDirStat can see as that user can see 200GB, there will be 56GB unknown. It is logical that the administrator can see more files compared to a normal user. There are situations where the administrator still could only see a limited amount of GB's.

For example:

  • Previous versions of files
  • Shadow copies
  • Filesystem errors (ex: not reclaimed free space - run "chkdsk c: /F" and reboot to fix this)
  • ...
phulstaert
  • 21
  • 2
  • Avoid posting answers to old questions that already have well received answers unless you have something substantial and new to add. – Toto Feb 09 '23 at 12:24