Storage leak on NTFS system drive in Windows 10 (huge system files?)

Hi - I'm an IT professional with a baffling Windows 10 problem (Pro 1809 10.0.17763.615/semi-annual channel).

Recently over 300 GB of space has mysteriously gone missing on an NTFS system drive, and none of the tools I've found can tell me why. It's unclear exactly when the problem began, because the missing space wasn't noticed until the drive reached capacity during normal operation. Windows Storage settings reports a whopping 347 GB for "System Files", but I suspect this is a display glitch as the space doesn't seem to actually exist in any files on the file system.

I've tried all the obvious things, and scoured the internet and tried all the less obvious non-destructive suggestions I can find (screenshots below). Things I've tried include:
  1. Searching the entire file system (including hidden folders) using WinDirStat, SpaceSniffer, Cygwin du, and others running with administrative access
  2. Repeated on-line and off-line chkdsk (no errors)
  3. vssadmin list commands to audit shadow copies
  4. dism scans (no problems)
  5. Unprivileged and Administrative Disk Cleanup (nothing useful)
  6. Full virus scans with Windows Defender and AVG (installed after the problem began) are clean, and I've noticed no other virus-like activity.
  7. Drive-level diagnostics: SeaTools and Samsung Magician (all clean)
This system is a server with a large investment in configuration, so reformatting or resetting windows is not really an option.

Can anyone provide suggestions on what else to try for tracking down and reclaiming my missing space?

Thanks,
-Dan

          

|
Hi Dan, Windows Explorer is useless when it comes to working out where your hard drive space is being used . . .

Click the link below to download a small free utility called Treesize. Using that tool, you will instantly see where this space is being used

https://www.jam-software.com/treesize_free/

Please provide a screenshot of that drive in TreeSize, so I may anapyze that to find out what the underlying problem may be . . .

________________________________________________________
Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.
___________________________________________________________________

Power to the Developer!

MSI GV72 - 17.3", i7-8750H (Hex Core), 32GB DDR4, 4GB GeForce GTX 1050 Ti, 256GB NVMe M2, 2TB HDD

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

DaveM121 wrote:

Windows Explorer is useless when it comes to working out where your hard drive space is being used . . . 

Hi Dave - I'm well aware of this fact, which is why I did not mention Windows Explorer anywhere in the OP. Guess you didn't actually read it.. ;-)

DaveM121 wrote:

Please provide a screenshot of that drive in TreeSize, so I may anapyze that to find out what the underlying problem may be . . . 

Screenshot is below.

Unlike WinDirStat and SpaceSniffer (see OP), TreeSize does not seem to even acknowledge the existence of the missing space. Guess it never compares the file space it can account for to the partition size, which is exactly where my discrepancy appears to be.

To its credit, TreeSize does clearly report the number of files it scanned, however the value is significantly higher than the file count reported by a fresh chkdsk I ran right after the scan. Not sure what that's about..

This sadly seems to leave me no closer to a solution?

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Dan

My name is Andre Da Costa; an Independent Consultant, Windows Insider MVP and Windows & Devices for IT MVP. I'm here to help you with your problem.


Press Windows key + R
Type: C:\Windows\Logs\CBS
Hit Enter

Do you see any log files in that folder?

I remember users reporting issues with Windows 10 1809 in particular suffering from disk space usage disappearing without any known reason.

This should be resolved in the latest Windows 10 feature update, 1903. Have you considered upgrading to that release?

Go to the following page then click 'Update Now'

https://www.microsoft.com/software-download/win...
Best regards,
Andre Da Costa
Independent Advisor for Directly

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Andre - 

The C:\Windows\Logs\CBS directory contains 31.1 MB of log files, so totally reasonable and definitely not the cause of my problem.

We are intentionally conservative with the Windows versions we run on this system, as the intent is to provide a stable testing environment. Hence I'm hesitant to blindly upgrade Windows in the hopes that it magically fixes the problem (especially if this is due to some NTFS damage that is already done).  I looked through the change logs of available updates and nothing seems directly relevant. Can you point at any published change or other evidence that newer versions claim to address this problem?


Thanks,

-D

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

The only other option I can think of is the WinSXS is using up space and it needs to be cleaned up.

Click Start, type: CMD
Right click CMD
Click Run as administrator

At the prompt, type:

Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase

Hit Enter


When complete, restart then check if the problem still persists.
Best regards,
Andre Da Costa
Independent Advisor for Directly

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

The only other option I can think of is the WinSXS is using up space and it needs to be cleaned up.

Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase

When complete, restart then check if the problem still persists.

Thanks Andre, but this command did not fix the problem.

As mentioned in the OP, I'd already tried dism cleanups.

-D

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Well, at this point, contact Microsoft support and let them remotely connect to the machine and investigate whats going on.

https://partner.support.services.microsoft.com/...

But, you gotta admit, its something in your configuration, because, between Dave and I, we have pretty much answered over hundred thousand questions and the fact that you none of the recommendations have achieved a solution, suggest, that maybe you need to back up and just perform a clean install.
Best regards,
Andre Da Costa
Independent Advisor for Directly

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

It turns out this was apparently caused by a bug in Cygwin 3.x leaking removed files into the NTFS hidden folder:

c:\$Extend\$Deleted

These files (some months old) were presumably meant to be auto-deleted by some service, but never were (even after dozens of reboots). It took booting from a Linux rescue DVDto access and cleanup the 350GB of garbage files.

I suspect this was caused by this recent change in Cygwin:

Use the new POSIX unlink semantics on NTFS starting with Windows 10 1709.

  Deleting an in-use file now actually removes the file, rather than moving

  it to the recycler bin.

I need to investigate further before submitting a formal bug report to the Cygwin community.

1 person found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated March 17, 2021 Views 609 Applies to: