Phantom hard drive loss

[kill3rb]

So, i was trying to scan my micro SD card when my computer freaked out and blue screened. Said something about a memory dump. I restarted and everything was going suuuuper slow. I ran a scan disk and a defrag, took forever but it was still slow after. I restarted and it was working close to normal but it said that i have 0 free space on my hard drive when i should have 30+ gigs. I even started deleting file and removing programs, none of which seemed to affect the fact the mard hard drive is now "full". So i restart again and it is back to having 30+ gigs of free HDD space. I was surfing some of my usual sights when it tells me once again my HDD is full. I have even deleted temporary files, though where 30 gigs of temporary files would come from... i dont know.

Any insight?

[Tripredacus]

I've seen this type of loss on infected systems. When the HDD is reporting full, see if you can find what folder has the most files. When I ran into this, I found a 40GB Windows folder, but after evaluating the files in that folder, I only found 4GB. You are likely dealing with super-hidden files and folders, which means you can't see them in Windows or from WinPE. I could see them in NTFSDOS. Otherwise you could have a drive that is going bad. You can try running an HD Tester on it, but you'd need to post your hard drive model.

Memory dumps (full ones) will take up some space, about 2-4GB but they would take up this space without you knowing it.

[jaclaz]

You are likely dealing with super-hidden files and folders, which means you can't see them in Windows or from WinPE.

Isn't this Registry key all that's needed?

http://www.windowsitpro.com/article/configuration/how-can-i-view-super-hidden-files-.aspx

In any case, by using a tool like DMDE, you should be able to see files directly from the $MFT:

http://softdm.com/

jaclaz

[Tripredacus]

You are likely dealing with super-hidden files and folders, which means you can't see them in Windows or from WinPE.

Isn't this Registry key all that's needed?

http://www.windowsitpro.com/article/configuration/how-can-i-view-super-hidden-files-.aspx

At this point we do not know if the OP has the same situation as the system I worked on that had the virus on it. I hadn't known about that registry setting before, but these files I found in NTFSDOS would not even show up using a DIR /A:SH which was interesting.

Oh I remember another issue that virus-laden PC had. The OS volume would not appear in the lower pane of Disk Management, but would appear in the upper pane.

[kill3rb]

i dont have any idea what kind of HDD it is. I would generally consider myself pretty handy with a computer but most of this stuff is going over my head.. lol

I deleted some old files i dont use any more and its still super filled up but i have like 6 gb available now. lol

e: also, i very very highly doubt its any sort of virus. I am pretty careful and dont believe i have picked any up.

Edited November 24, 2010 by kill3rb

[RJARRRPCGP]

Looks like a malware attack.

The only other thing that I'm aware of that can hide space is a hard disk drive with HPA set.

[Tripredacus]

i dont have any idea what kind of HDD it is.

You can find the name of it in Device Manager. Common brands are Western Digital, Seagate, Toshiba, etc.