Issue :
One of the Windows 2008R2 server in our environment showed wrong disk space on drive v:\
Observation :
Capacity of the drive V:\ was 660 Gig in size and utilized space was 440 Gig
While exploring the drive , i could see only 180 Gig of contents stored on the drive .
Hence, I have Installed windirstat and searched for the utilization .
180 Gig occupied by the db files
110 gig of pagefile.sys file occupied drive v:\
180 +110 = 290 Gig . Still 150 Gig is missing
Findings :
I checked the event viewer and found that , some of the files were recently deleted on drive V:\
(Event id :4660) which is the root cause of this issue
Files stored in one or more blocks on the hard drive, approximately 4097 bytes long. Sometimes an error happens and an allocated block is no longer needed but is not freed on the disk. So, it becomes an orphan - not allocated to a file.
chkdsk utility have the ability to pick up the strays and make them available for reuse.
So, I ran chkdsk utility (Read only mode ) on drive v:\ to verify the disk health .
chkdsk result reported some corrupted files and orphaned blocks on the drive . \
Resolution :
Ran chkdsk utility with "F" switch and rebooted the server .
Boooooooooooooooooom ...... I could see 370 gig free space on drive v:\ .
Server 2012R2 reporting incorrect disk space consumed/available on physical C: drive, massive Unknown space taken up in Windirstat
If you use windirstat >> You have to press F7 to see the hidden space
One of the Windows 2008R2 server in our environment showed wrong disk space on drive v:\
Observation :
Capacity of the drive V:\ was 660 Gig in size and utilized space was 440 Gig
While exploring the drive , i could see only 180 Gig of contents stored on the drive .
Hence, I have Installed windirstat and searched for the utilization .
180 Gig occupied by the db files
110 gig of pagefile.sys file occupied drive v:\
180 +110 = 290 Gig . Still 150 Gig is missing
Findings :
I checked the event viewer and found that , some of the files were recently deleted on drive V:\
(Event id :4660) which is the root cause of this issue
Files stored in one or more blocks on the hard drive, approximately 4097 bytes long. Sometimes an error happens and an allocated block is no longer needed but is not freed on the disk. So, it becomes an orphan - not allocated to a file.
chkdsk utility have the ability to pick up the strays and make them available for reuse.
So, I ran chkdsk utility (Read only mode ) on drive v:\ to verify the disk health .
chkdsk result reported some corrupted files and orphaned blocks on the drive . \
Resolution :
Ran chkdsk utility with "F" switch and rebooted the server .
Boooooooooooooooooom ...... I could see 370 gig free space on drive v:\ .
Other Scenarios
Server 2012R2 reporting incorrect disk space consumed/available on physical C: drive, massive Unknown space taken up in Windirstat
If you use windirstat >> You have to press F7 to see the hidden space
This is because of MFT (Master File Table) usually happens due to poorly written applications .. Check if there is any buggy application installed on the server , if yes , you have to remove it from C:\ (thru uninstalation ) ..
visit here for detailed information on MFT
you can use NTFSInfo from Windows Sysinternals (Microsoft):
NTFSInfo is a little applet that shows you information about NTFS volumes. Its dump includes the size of a drive's allocation units, where key NTFS files are located, and the sizes of the NTFS metadata files on the volume.
Example output:
> ntfsinfo c:
NtfsInfo v1.2 - NTFS Information Dump
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
Volume Size
-----------
Volume size : 460241 MB
Total sectors : 942575615
Total clusters : 117821951
Free clusters : 15025676
Free space : 58694 MB (12% of drive)
Allocation Size
----------------
Bytes per sector : 512
Bytes per cluster : 4096
Bytes per MFT record : 0
Clusters per MFT record: 0
MFT Information
---------------
MFT size : 833 MB (0% of drive)
MFT start cluster : 786432
MFT zone clusters : 90400352 - 90451584
MFT zone size : 200 MB (0% of drive)
MFT mirror start : 2
Meta-Data files
---------------
fsutil fsinfo ntfsinfo c:
In the output, look for the Mft Valid Data Length line. The value is hexadecimal; you can convert it to decimal using the Windows calculator or by simply running it (starting with 0x) in PowerShell as a command. That gives you the number of bytes, which when divided by 10242 = 1048576 gives you the MFT size in MiB.
It's even a tiny bit more precise than the value reported by Sysinternals' ntfsinfo. fsutil gives me 0x000000006c280000 = 1730.5 MiB, while the ntfsinfo tool reports 1730.
If you're on Windows 10, you can get the same info for any file with a different mode of the fsutiltool:
fsutil volume filelayout c:\$mft
Check the Size row under the ::$DATA stream.
