Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Lost 20 GB in the past week


  • This topic is locked This topic is locked
27 replies to this topic

#1 MadDemon64

MadDemon64

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 06 March 2016 - 11:09 AM

So I recently noticed that my hard drive space has been filling up with stuff I can't seem to locate and I don't know if its a virus or if its just something my computer is doing to prepare for the Windows 10 update.

 

Last week it was up to 164 GB but this week it went down to 156, and yesterday I noticed that it went down to 143 GB, up to 145, and stopped at 144.

 

Can somebody help me?



BC AdBot (Login to Remove)

 


#2 Niweg

Niweg

  • Members
  • 802 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US of A
  • Local time:04:13 PM

Posted 06 March 2016 - 12:26 PM

 Most likely this is a result of System Restore.  Windows periodically makes restore points so you have a way to get back to a system you had prior to some problem.  This process takes a percentage of your total hard drive space which you can change if need be.  If you want to see where every bit and byte are going, you can download a program called Treesize and run it. 

 

 Good luck.


Make regular full system backups or you'll be sorry sooner or later.


#3 MadDemon64

MadDemon64
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 06 March 2016 - 12:36 PM

 Most likely this is a result of System Restore.  Windows periodically makes restore points so you have a way to get back to a system you had prior to some problem.  This process takes a percentage of your total hard drive space which you can change if need be.  If you want to see where every bit and byte are going, you can download a program called Treesize and run it. 

 

 Good luck.

I tried that.  System restore only takes up 9 GB and Treesize isn't helping me figure out where everything is going.  Either multiple things are updating at once and the total amount of space they take up is 10 GB or I have no idea what's going on.



#4 Chris Cosgrove

Chris Cosgrove

  • Moderator
  • 6,895 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Scotland
  • Local time:10:13 PM

Posted 06 March 2016 - 05:06 PM

One thing you haven't said is - how big is your hard drive ?  Indeed you have given no information at all about your computer.

 

If your hard drive capacity is in the range 200 - 250 GB then 10 GB is something to worry about. If you have a 1TB drive then it is only 1% of capacity and not even worth worrying about. If I had concerns about possible infection I would run an A/V scan and an anti-malware one then take it from there.

 

One other possibility that is worth checking - it happened to another member recently - is to see if automatic backups are enabled and set to save on your main drive.

 

Chris Cosgrove



#5 MadDemon64

MadDemon64
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 06 March 2016 - 05:18 PM

One thing you haven't said is - how big is your hard drive ?  Indeed you have given no information at all about your computer.

 

If your hard drive capacity is in the range 200 - 250 GB then 10 GB is something to worry about. If you have a 1TB drive then it is only 1% of capacity and not even worth worrying about. If I had concerns about possible infection I would run an A/V scan and an anti-malware one then take it from there.

 

One other possibility that is worth checking - it happened to another member recently - is to see if automatic backups are enabled and set to save on your main drive.

 

Chris Cosgrove

It's 1TB big, but divided into C and D drives, with C being 584 GB big.

 

I ran Malwarebytes and Norton and they came up empty.  I even downloaded RogueKiller and it said nothing was amiss.  Honestly part of me thought that it wasn't worth stressing over since I have so much HDD space, but of course I'm paranoid and worry less about how much space is being taken up and worry more about the cause behind it being taken up.



#6 MadDemon64

MadDemon64
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 06 March 2016 - 10:27 PM

So I ran a Chkdsk and found no bad files but it did say "CHKDSK discovered free space marked as allocated in the volume bitmap."

What does this mean?  Is there something going on with my computer that I don't know about or is this nothing more than my computer preparing space for the Windows 10 update?



#7 Niweg

Niweg

  • Members
  • 802 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US of A
  • Local time:04:13 PM

Posted 07 March 2016 - 08:37 PM

 CHKDSK should've fixed that problem it found, but you didn't say whether it did or not.  

 

Getting back to the C: drive space, 10 GB out of 584 GB is less than 2%, so don't worry about it.

 

The amount of space System Restore is VARIABLE, not CONSTANT, but the maximum amount you have reserved for it is constant.  You can change it to whatever you want however.

 

As for Treesize, I've been using it and seeing many others using it, but yours is the very first I've seen it doesn't help you see where your space is going.  There's something wrong here, maybe you need to spend a little more time learning to understand it.

 

 Good luck.


Make regular full system backups or you'll be sorry sooner or later.


#8 MadDemon64

MadDemon64
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 07 March 2016 - 08:49 PM

Well I ran Chkdsk /F afterwards and it said that it found no problems, but I don't know if that's because it stopped at stage 3 or if there were no problems.  I have also used the check disk function from the C drive properties window and it found nothing either, but again I don't know if that means that there are no problems or if the check disk fiction doesn't go that far.  It did say that "Windows made corrections to the files system.  No further action is required." during chkdsk /r but I don't know if that fixed the issues then and there or not, but given that I did not get back the GB I had lost I assume that I never lost it due to a disk corruption.  Either that or the corruption was never fixed, which given the fact that subsequent chkdsks don't report it means that that's unlikely...unless they never go that far in which case we are back to square one.

 

Also are you talking about TreeSize Free or TreeSize Professional, because I have TreeSize Free.  Also I have tried organizing things by "date last modified" but that doesn't help much, or does TreeSize Professional have a function that tells you exactly what happened to what files on what day?


Edited by MadDemon64, 07 March 2016 - 09:47 PM.


#9 jcgriff2

jcgriff2

  • BSOD Kernel Dump Expert
  • 1,109 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey Shore
  • Local time:05:13 PM

Posted 07 March 2016 - 10:19 PM

Screen print or write down the Treesize free numbers (the amount of space being used). Then compare it to another day's output. What folder/file(s) increased or decreased by 10 GB? You should be able to easily spot the movement of 10 GB or more.

 

The line in chkdsk output that is important is "bad sectors". If no bad sectors were found, you're OK.


Microsoft MVP 2009-2015
Microsoft Windows Insider MVP 2018 - Present

#10 MadDemon64

MadDemon64
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 07 March 2016 - 10:45 PM

Screen print or write down the Treesize free numbers (the amount of space being used). Then compare it to another day's output. What folder/file(s) increased or decreased by 10 GB? You should be able to easily spot the movement of 10 GB or more.

 

Well I would need a screen print of the files as they were on March 4th, which is something I can't do since I didn't download TreeSize until the 5th.

 

And while I was typing this out, my computer decided to give me back 2GB, bringing my total up to 145GB.  Is that normal?



#11 jcgriff2

jcgriff2

  • BSOD Kernel Dump Expert
  • 1,109 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey Shore
  • Local time:05:13 PM

Posted 08 March 2016 - 01:37 AM

2 GB of files could easily be explained away - possibly by Windows Updates, system restore or other. I honestly don't know off hand as I have never compared total space in  any of my systems from day-to-day or week-to-week.

 

Are you able to track the 2 GB of file(s) using Treesize? i.e., do you have folder size numbers available prior to the 2 GB change?

 

If not, make a screen print or write the folder size numbers down now and then compare them when the disk space usage changes by a large amount again - in a day or days from now.

 

I would suggest starting with the root of c: drive - just looking at folder size to start. Once you figure out what folder(s) is changing in size, then expand that folder and repeat the process until you have found the file(s) involved.

 

It is a tedious process, but is the only way that I can think of to figure out where the space increase/decrease is occurring.

 

There is no app that I know of that will automate this task for you.

 

Regards. . .

 

jcgriff2

 

EDIT: this is the level (c: root) that I suggest that you start with in Treesize:



C:\>dir /a

 Volume in drive C is Windows 8.1 x64

 Volume Serial Number is C8D9-F1EF
 Directory of C:\
03/08/2016  01:34 AM    <DIR>          !__del
07/31/2014  11:40 PM    <DIR>          $Recycle.Bin
12/20/2013  01:34 PM            20,480 bcd.LOG
01/19/2016  02:58 AM    <DIR>          boot
08/22/2013  12:31 AM           427,680 bootmgr
06/18/2013  07:18 AM                 1 BOOTNXT
07/27/2014  06:47 PM    <DIR>          ckeditor
02/21/2016  02:43 AM    <DIR>          Config.Msi
08/22/2013  09:45 AM    <JUNCTION>     Documents and Settings [C:\Users]
02/12/2016  12:21 AM    10,250,895,360 hiberfil.sys
03/15/2014  04:02 PM    <DIR>          HP
08/26/2013  01:13 AM    <DIR>          inetpub
05/25/2015  02:04 AM    <DIR>          Intel
06/04/2014  03:22 AM             4,172 keys30.zip
06/06/2015  01:10 AM    <DIR>          MSOCache
02/12/2016  12:21 AM     1,946,157,056 pagefile.sys
06/26/2014  09:19 PM    <DIR>          PerfLogs
01/30/2016  06:52 PM    <DIR>          Program Files
02/21/2016  02:42 AM    <DIR>          Program Files (x86)
01/30/2016  06:52 PM    <DIR>          ProgramData
12/20/2013  01:41 PM    <DIR>          Recovery
01/19/2016  02:58 AM           353,754 Reflect_Install.log
02/12/2016  12:21 AM       268,435,456 swapfile.sys
06/05/2015  10:11 PM    <DIR>          SWSetup
03/08/2016  01:19 AM    <DIR>          symbols
02/22/2016  08:41 PM    <DIR>          SysInternals
03/06/2016  04:54 AM    <DIR>          System Volume Information
03/05/2014  09:01 PM    <DIR>          SYSTEM.SAV_03-15-2014
08/18/2014  01:00 AM    <DIR>          system.sav__bkup
05/23/2015  08:02 PM    <DIR>          Users
02/24/2016  04:16 PM    <DIR>          Windows
12/23/2014  01:04 AM    <DIR>          wmi
               8 File(s) 12,466,293,959 bytes
              24 Dir(s)  294,767,099,904 bytes free
C:\>

Edited by jcgriff2, 08 March 2016 - 01:39 AM.

Microsoft MVP 2009-2015
Microsoft Windows Insider MVP 2018 - Present

#12 MadDemon64

MadDemon64
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 08 March 2016 - 09:05 AM

I am doing that right now and will continue to do that for a few days.

 

Thanks.



#13 rp88

rp88

  • Members
  • 3,048 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:09:13 PM

Posted 09 March 2016 - 07:16 AM

Post #1"I don't know if its a virus or if its just something my computer is doing to prepare for the Windows 10 update."

It could be many other things too, but there are atleast ways of ruling in our out those two possibilities. To check if it's a virus firstly run your usual antivirus scanner, see if it finds anything, then download malwarebytes anti-malware, let it perform a scan and see if it finds anything. If neither does but the symptoms you have seen cannot be explained by other causes then post in the "am I infected" section here and someone will advise you on how to use other scanning tools to identify if you're infected.

As for seeing if it's a background download of windows 10, go to folder options within windows file explorer. Set it to show "hidden files and folders" and "protected operating system files", it will give a warning when you ask it to show the latter, clcik ok on this warning. curucial system files are now shsoing in the file explorer, from this point until you finish don't edit any file at all in any way, this is a look-don't touch matter for now. Go to "this pc" so you can see a screen a bit like this

http://www.eightforums.com/attachments/tutorials/24448d1373433950-pc-add-remove-folders-windows-8-1-a-folders_in_this_pc.jpg

double click C:\ drive to go into it. Look and see if there are any folders named $WINDOWS.~BT, if so hover over it, see the size, or look at it's properties (right click then "properties"). Don't try altering anything yet. Now write down whether you've seen it, if you have then write down it's properties as well. Now go back to folder options, set "protected operating system files" to be hidden again", as for "hidden files and folders", if they were hidden before then set them to be hidden again, if they were showing before you started this leave them showing. Report in a post here whether you saw the $WINDOWS.~BT folder or any folders with very similar names, if you saw them report their properties as well. If you didn't see them you can be sure windows 10 hasn't been downloaded in the background, hence is not the cause of your sudden loss of free space. If you do see them I'll need to sk for mroe details about them, so I can tell if they are windows 10 downloading itself or if they are something else, then after that if you want to get rid of them I can explain how. If you don't find the folder described and can't attribute your loss of space to anything else then ask for help in "am i infected".

Edited by rp88, 09 March 2016 - 07:16 AM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#14 MadDemon64

MadDemon64
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Local time:05:13 PM

Posted 09 March 2016 - 09:04 AM

Post #1"I don't know if its a virus or if its just something my computer is doing to prepare for the Windows 10 update."

It could be many other things too, but there are atleast ways of ruling in our out those two possibilities. To check if it's a virus firstly run your usual antivirus scanner, see if it finds anything, then download malwarebytes anti-malware, let it perform a scan and see if it finds anything. If neither does but the symptoms you have seen cannot be explained by other causes then post in the "am I infected" section here and someone will advise you on how to use other scanning tools to identify if you're infected.

As for seeing if it's a background download of windows 10, go to folder options within windows file explorer. Set it to show "hidden files and folders" and "protected operating system files", it will give a warning when you ask it to show the latter, clcik ok on this warning. curucial system files are now shsoing in the file explorer, from this point until you finish don't edit any file at all in any way, this is a look-don't touch matter for now. Go to "this pc" so you can see a screen a bit like this

http://www.eightforums.com/attachments/tutorials/24448d1373433950-pc-add-remove-folders-windows-8-1-a-folders_in_this_pc.jpg

double click C:\ drive to go into it. Look and see if there are any folders named $WINDOWS.~BT, if so hover over it, see the size, or look at it's properties (right click then "properties"). Don't try altering anything yet. Now write down whether you've seen it, if you have then write down it's properties as well. Now go back to folder options, set "protected operating system files" to be hidden again", as for "hidden files and folders", if they were hidden before then set them to be hidden again, if they were showing before you started this leave them showing. Report in a post here whether you saw the $WINDOWS.~BT folder or any folders with very similar names, if you saw them report their properties as well. If you didn't see them you can be sure windows 10 hasn't been downloaded in the background, hence is not the cause of your sudden loss of free space. If you do see them I'll need to sk for mroe details about them, so I can tell if they are windows 10 downloading itself or if they are something else, then after that if you want to get rid of them I can explain how. If you don't find the folder described and can't attribute your loss of space to anything else then ask for help in "am i infected".

Already scanned with Norton.  And Malware Antimalwarebytes.  And RogueKiller.  And ESET.  Nothing has shown up.  I'll post on the "Am I infected" page, but I'm starting to suspect that a virus isn't the cause.



#15 Niweg

Niweg

  • Members
  • 802 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US of A
  • Local time:04:13 PM

Posted 09 March 2016 - 11:18 AM

 I haven't seen anything abnormal in any of your posts.  If you're worried about 2% of your disk space, go buy something like a 3 TB hard drive and put your system on it.  I bought one for $80 7 or 8 months ago.  I use the free Treesize myself; it normally displays the "last modified" date, and you can right-click anything in the listing, click Properties, and it will tell you the creation date.  Seems simple and easy to me.

 

 Good luck.


Make regular full system backups or you'll be sorry sooner or later.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users