Windows Server 2008 R2 Finding Hidden files that are causing drive to fill up

Question

What is the best way to find out what files are sucking up so much space? My Windows directory lists its size as 15 GB but when I run a powershell script against it, it shows 40 GB. It seems 40 GB is about right because if I use that 40 GB and add it to the rest of my folders on C I get the 45 GB that is in use.

I checked volume shadow copy and that is disabled and there are no volume shadow files listed. My page file is limited to 3 GB. How can I find out what files are taking 25 GB of space?

Final Results: We ended up disabling UAC and then the Properties showed the true file size of the Windows folder, as shown in powershell script. This allowed us to drill down to the folder that had the issues... In our case it was in C:\Windows\System32\config\systemprofile\AppData\Local\VMware\VDM there were several large dump files, these were the mysterious unknown files in WinDirStat. It turns out our nessus scan is crashing a view service for a couple seconds so it creates a large dump file. So we will try this.. https://discussions.nessus.org/thread/5212

Solution 1

WinDirStat is a good tool for visualizing filesystem usage on Windows volumes. It's helped me find "missing" space plenty of times before.

Solution 2

TreeSize visualizes your folder structure and the data density of each node. Helped me with the same problem uncounted times. Here´s a link to the website.

Comments

[Admin]

Found the Unknown files in the logs. The security logs had been set to archive instead of writeover. Had to clear them here: C:\Windows\System32\winevt\Logs

[Xaxum]

Thanks for the link. I tried this but WinDirStat is only showing what the properties shows of all the folders, total 19.2 GB instead of what the volume shows as in use, 43 GB. Any other suggestions?

[Xaxum]

Ahh I think I see it. I checked show Unknown and there is a 23.3 GB file. There is my missing space. So now it becomes a question of knowing what that huge file is.

[MDMarra]

That's usually because of a file/folder structure that your current account doesn't have permission to. This is usually a Volume Shadow Service misbehaving or being turned on by someone else. Poking around with the vssadmin list commands should hopefully shed some light.

[Xaxum]

listing shaows, shadowstorage, shows no files. I am at a loss to figure out what this file is. I logged in as admin and still the same result, unknown.

[ponsfonze]

@Xaxum Is the missing space your page file?

[Xaxum]

@ponsfonze The page file is sitting at 900 MB as per the results from WinDirStat. I am going to try a few things today to see if I can figure out where this file is coming from.

[Xaxum]

@MDMarra you answered the original question of how to find the files. Thanks. I will ask a new question on how to find what the file is.