More than 30GB space missing in WinXP

[CypherHackz]

Run a checkdisk ?

Already done that but still it shows me 5GB space left.

I'd suggest you search for alternate streams in your files, and/or for rootkits.

There is a very helpful util from sysinternals (now in microsoft) called streams.exe that shows all the alternative streams in your files.

They also have a rootkit revealer utility. Google sysinternals

Regards,

Yianni.

Will google the app. Thanks for your reply.

Hmm... I'd recommend a backup + reformat of your drive, and see if that retains full functionality/space from it. Really the recovery partition isn't needed, because (you should) have the XP disk...

What have you been using the laptop for? Intensive use? Has there been lots of crashing applications recently? It could be that a few of your log files may have gotten huge.

This laptop is use in my office. It is company laptop. No crashing just sometimes it hang and then it back to normal.

Yeah, it just seems like you need a fresh reinstall.

Also, now I see that in your 5th post, the 24 gb is not the total capacity of your hard drive but it represents the used space. That means you have 70 - 24 = 46 gb free.

So question is, where is it reported that you only have 5 gb free? Right click on C: drive and post your properties page here.

If it is indeed showing only 5 gb free, definitely you got a lot of residual junk in your system and fresh install recommended for a faster system.

The above is the screenshot of my C drive partition. Btw the Recover partition was installed by default. I do not know where it comes. Maybe it comes from factory.

Thank you.

[techywiz2007]

Try this application, to trace where those files are: http://www.jam-software.com/freeware/TreeSizeFree.zip

Also, if it's a company computer, why not swing it by your IT department and see if they can do something with it.

But either way, I strongly would suggest a backup / reinstall to retain full disk functionality. It's always good to reformat once in awhile, and get a clean system running again.

[SngBrdb]

My bet is on the change journal... something turned it on, and when it gets turned on, it gets HUGE.

The Change Journal is an NTFS hidden file; couldn't tell from the post, but is the partition giving you trouble the first one, drive c:\? Looks like the second partition is FAT32, which would shoot down my theory.

The Change Journal is located at C:\$UsnJrnl... basically, it tracks every change made to the disk. Worse, there's a registry setting to cap the maximum size, which will thrash the disk terribly on any file system action when the ceiling is reached. The Change Journal is disabled by default, but sometimes an app will enable it; I think it was Paragon's hard drive utilities that enabled it last time on my pc.

http://technet.microsoft.com/en-us/library/bb742450.aspx

It really serves no purpose (imo), unless an app is making critical changes that could need to be rolled back in case of a failed transaction. The tool to work with the change journal is fsutil. To delete the change journal on drive c, use the following command:

fsutil usn deletejournal /d c:

Another useful tool is here: http://www.codeproject.com/KB/files/Eyes_on_NTFS.aspx

Grab the demo project and run the executable... it will tell you if the change journal is active, and list every record it contains. I haven't found a utility to tell you how big the @#$* thing is, but once enabled, it's usually measured in GB (If I remember correctly, Diskeeper will give you info on the file if it's fragmented, which it usually is).

The only other hidden disk-eater I could think of that Kels didn't mention is the Master File Table... it's usually not more than a gig, though, but worth remembering.

Other disk-eaters (that would show up in a normal directory scan) include the Windows Installer Cache (C:\Windows\Installer) and global loggers (C:\WINDOWS\system32\LogFiles for most of them, but also places like C:\WINDOWS\system32\wbem\Logs). I've had huge wbem logs before when trace logging or kernel debugging gets enabled. Go here in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\GlobalLogger - make sure 'start' is set to 0

Also:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing - various max file sizes can be set here

The installer cache can be limited through the group policy editor... this sets the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\MaxPatchCacheSize

I personally set my MaxPatchCacheSize to 0... this is on my top-ten list of Windows Peeves; the cache is hardly ever used, and grows to gigabyte size easily. The only problem with setting the MaxPatchCacheSize is that it doesn't clear installer patches already installed, so if you don't tweak this early in a machine install, it may be too late. You can delete the installers manually, or using Microsoft's Installer Cleanup Utility, but I can almost guarantee you will have problems with apps if you do so... programs are fine if they know the patch isn't there, but if they think it's there and it's not, they can fall into an state where they can't be installed or uninstalled with the original installer.

An example of patch caching: Visual Studio 2005 Service Pack 1 is a 300-400Mb msi installer... it expands to take up about 3Gb. When you run the installer, it unpacks everything to the temp directory, filling up 3Gb of disk space in the temp directory. It then copies all of that to the Windows Installer cache, filling up another 3Gb of disk space... if you try to run that 300-400Mb file and don't have at least 6Gb of disk space free, the installation will fail. If you don't limit the installer cache, you lose 3Gb of disk space for files you won't ever need again.

There are other disk-eaters, but I've already pushed my brain to critical limits pulling these up... if they don't help, let me know, I'll try to think of more.

[CypherHackz]

I think I know who is the culprit behind this. The notebook that im using is IBM lenovo and it do backups regularly and use space on the hard disk. In that folder there are several files that have size about 11GB.

Thanks to techywiz for the software. It helps me to find the hidden and restricted backup folder. I searched in google how to remove it and now deleting the backup files. Not sure how long it will take. Hopefully I will regain back my free space.

Thanks you all for the help. Especially to techywiz for the software.

Will update you guys after all the backup files have been deleted.

Edited August 22, 2008 by CypherHackz

[techywiz2007]

Your welcome.

Make sure you check with your IT department before deleting anything that you're not sure of though, otherwise, you may end up with an expensive paperweight for awhile. hehe

I searched in google how to...

Woohoo! another IT pro in the making!

Edited August 22, 2008 by techywiz2007