This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 70%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAF%3C/text%3E%3C/svg%3E)
Usually when files don't add up to drive's actually used space it is suggested to check apps like TreeSize, but in my case apps still don't show over 2GB of used space. The drive is 40GB, over 38,5GB of it is being used according to WindowsExplorer, but according to apps (Treesize+Spacesniffer) it should be only 36,4GB instead. Apps can see hidden and system files (admin privileges confirmed).
It is something that happened recently, so possibly virus (Nothing special in Windows Defender). I need those 2GB badly, so help me find what's using them please.
I have a lead with app WinDirStat which detects all 38,5 GB of the used space in contrast to other apps, but 5GB of them are marked as unknown and can't be located for now. Could you help me make these files known please?
Screenshots are taken from all mentioned apps and WindowsExplorer.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 94%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIX%3C/text%3E%3C/svg%3E)
Thanks for your post. The Windows Explorer and the TreeSize drive list do show the space that is physically allocated on the drive while TreeSize shows the space that is occupied by all files under a certain path. One possibility is that not all parts of the drive could be scanned due to access restrictions even if you run the app as administrator.
So what do I do to locate these files?
You may have compressed files. They should show up in a blue text color in explorer. In Treesize, the Allocated column shows the "Size on disk" that explorer properties shows.
That's not the problem here. The difference between size of files and allocated space is 200 MB as you can see on the screenshot. And even these count towards the files that I detect with my apps. Im looking for 2GB that are not detected by Treesize.
Have you accounted for the space occupied by the MFT?
https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table
https://learn.microsoft.com/en-us/sysinternals/downloads/ntfsinfo
Hi, thanks for helping!
MFT Information
MFT size : 588 MB (1% of drive)
MFT start cluster : 786432
MFT zone clusters : 10200640 - 10251872
MFT zone size : 200 MB (0% of drive)
MFT mirror start : 2
There still should be more than 1,5GB if we account for MFT. It still wouldn't explain why this happened just recently.
Run chkdsk and see if it detects any corruption. There will also be a summary at the end. See if those numbers add up.
Windows has scanned the file system and found no problems.
No further action is required.
981055487 KB total disk space.
525441036 KB in 402864 files.
210616 KB in 173054 indexes.
0 KB in bad sectors.
1149763 KB in use by the system.
65536 KB occupied by the log file.
454254072 KB available on disk.
4096 bytes in each allocation unit.
245263871 total allocation units on disk.
113563518 allocation units available on disk.
Total duration: 16.88 seconds (16885 ms).
Numbers dont add up beside total disk size. I have 3GB of free disk space at the moment, even apps can see more than that.
Windows has scanned the file system and found no problems.
No further action is required.
41943542 KB total disk space.
29769572 KB in 149306 files.
197880 KB in 101834 indexes.
0 KB in bad sectors.
714946 KB in use by the system.
65536 KB occupied by the log file.
11261144 KB available on disk.
I don't know what your issue is. I ran Windirstat on my Win11 laptop and it did not detect any unknown files.
If your main problem is "I'm out of disk space", then run cleanmgr and cleanup Windows Update, temp files, error reports, etc.
You can also get Windows to clean up the Winsxs versions. Be aware that once you do that, you won't be able to uninstall any Windows Updates.
Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
Use Treesize/Windirstat to examine which folders are using the most space and delete old log files, junk files, temp files, etc.
Add a second disk drive and move big data files, like SQL or Access databases to the other drive.
Two other things to keep in mind....
Small files get stored in the MFT.
Files may occupy more space on the disk than their size indicates because of the way that NTFS allocates the physical disk space.
Here's a file that uses 804 bytes but occupies 4k on disk due to the way that the file system allocates space. Keep that in mind when you are adding up numbers. The (4096 - 804) might be considered free space on the disk, but you can't use it for any file other that the one it's allocated to.
Thanks for trying to help, but I already either did what you suggest or know about your suggestions. Neither of them solves the original issue though. There is still 2GB of unknown files on my computer that weren't there couple weeks back and I need them gone.
Just for fun, open Powershell_ISE with "run as administrator" and see what folders this script can't access.
function Analyze($path) {
#$path
try {
$files = Get-ChildItem -Path $path -file -force -ErrorAction Stop | Where-Object Attributes -NotLike "*ReparsePoint*"
foreach ($f in $files) {
$script:count++
$script:size += $f.length
}
} catch {
"Unable to access $path"
}
try {
$folders = Get-ChildItem -Path $path -Directory -force -ErrorAction Stop | Where-Object Attributes -NotLike "*ReparsePoint*"
foreach ($f in $folders) {
Analyze $f.fullname
}
} catch {
#"Can't read subdirs: $path"
}
}
$count = 0
$size = 0
Analyze "C:\"
"Count = $count"
"Size = $size"
On Win11 it failed on these folders which is pretty much expected. See if you have any folders listed that you think you should be able to access.
Unable to access C:\ProgramData\Dell\SARemediation\SystemRepair\Snapshots
Unable to access C:\ProgramData\Microsoft\Windows\CapabilityAccessManager
Unable to access C:\ProgramData\Microsoft\Windows\SystemData
Unable to access C:\ProgramData\Microsoft\Windows Defender\DLPCache\SensitiveBuffer
Unable to access C:\Recovery
Unable to access C:\System Repair
Unable to access C:\System Volume Information
Unable to access C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc
Unable to access C:\Windows\System32\LogFiles\WMI\RtBackup
Unable to access C:\Windows\System32\WebThreatDefSvc
I checked this folder with both Windirstat and Treesize. It is locked down to the system account.
C:\>icacls "C:\ProgramData\Dell\SARemediation\SystemRepair\Snapshots"
C:\ProgramData\Dell\SARemediation\SystemRepair\Snapshots NT AUTHORITY\SYSTEM:(OI)(IO)(D,Rc,WDAC,WO,GA)
NT AUTHORITY\SYSTEM:(CI)(F)
Windirstat reports zero files.
But Treesize shows 2 files.
And explorer which is not running elevated cannot see anything under SARemediation.
So I think that I would trust Treesize's numbers.
Tresize indeed shows what's inside these folders. But there is still 3GB that it doesn't see. What's next?
This command will tell you more than you ever wanted to know about your C drive.
fsutil volume allocationReport c:
Ok I got it, you think this is it? It shows the right size 36,5GB at the end though, should it see that even without access to these folders? Maybe these folders don't have much in them?
$count = 0
$size = 0
Analyze "C:"
"Count = $count"
"Size = $size"
Unable to access C:\ProgramData\Microsoft\Windows\SystemData
Unable to access C:\ProgramData\Microsoft\Windows Defender\DLPCache\SensitiveBuffer
Unable to access C:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-1647706798-1568119417-422497993-1001\Syste
mAppData\Helium
Unable to access C:\System Volume Information
Unable to access C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc
Unable to access C:\Windows\System32\LogFiles\WMI\RtBackup
Count = 188855
Size = 36525121530
Treesize should show what is in those folders.