General discussion

Locked

Low Disk Space

By omar9981 ·
I keep getting a low disk space warning on a 116 GB partition. When examining the drive it says 116 GB are used but the total sum of all files and folders on the drive isn't even 10 GB. I have checked for viruses and spyware but to no avail. If anyone has had this problem before and knows how to fix it please let me know. Thanks.

This conversation is currently closed to new comments.

19 total posts (Page 2 of 2)   Prev   01 | 02
Thread display: Collapse - | Expand +

All Comments

Collapse -

by irctrix In reply to Low Disk Space

What operating system are u using? What type of connection are u on on the internet and how often are you online? If you are on a fast connection and online all the time your macine might have been rooted (hacked with a program setup on it giving someone access to your system through ftp) This also will not be picked up by any virus protection nor any malware scanners. Also the program is hidden and run as soon as you boot up or log onto the internet. There are ways of removing this if this is what it is knowing what operating system you are running.

Collapse -

by omar9981 In reply to
Collapse -

by softcorp.us In reply to Low Disk Space

Round 3... :-)

This is darn peculiar. Some other thoughts and suggested actions:

1. NTFS CORRUPTION
==================
The problem could be caused by NTFS volume corruption. This might be correctable by running CHKDSK.
1.1 Have you run CHKDSK C: /F on the volume yet?
1.2 Suggested Action: Backup your data. Then, run CHKDSK C: /F to fix any problems on the volume. Because C: is your boot volume, CHKDSK will ask/require you to reboot so it can run during Windows XP startup.
1.3 Suggested Action: Run CHKDSK /L to see how large the log file is. It should be 64MB.

2. NTFS ALTERNATE DATA STREAMS
==============================
Windows Explorer says the 116GB volume is at or nearly full but only reports 10 GB of files. This could be explained by an extreme number of NTFS Alternate Data Streams. This kind of data is not counted by Windows Explorer or the DIR command. You should never have that much space taken up by this kind of data. But, you currently have a paradox and I'm offering this up as one possible explanation.

I have written a program (scSTREAMS) that enumerates and accumulates the space occupied by NTFS Alternate Data Streams. It is available for free download at the following URL:

http://www.softcorp.us/scstreams

2.1 Suggested Action: Download scSTREAMS and run it on your C: drive. Report back the statistics is computes. This program operates read-only and cannot damage anything. Command examples:

To see command options:

scSTREAMS /?

Search c and accumulate alternate stream space for all files:

scSTREAMS c /s /so

Please let me know if this helps.

Best Regards,

-----Steve Jackson

CEO
Software Corporation (Softcorp)
http://www.softcorp.us/softclock
Live time of day in cities around the world

Collapse -

by omar9981 In reply to

ok.. first of all I had a problem with chkdisk. wouldn't let me run it for some reason. obviously I couldn't run it with window running so I used a boot disk only to keep getting 'invalid drive selection' (or something along that line) every time I tried.. tried several differenet switches on several different drives with no luck.. I have run scandisk of course but I didn't come up with any errors and nothing changed. I've also tried defragging although it said it didn't need it. (think I already mentioned that)
however running scSTREAMS I got this information for my h: drive (the drive that is having the issue) 1,420 directories searched, 23,702 files found <10,457,944,6** bytes>, 1419 directories found, 6 alt data streams <104 bytes>, 56 open errors. This doesn't seem to far off from the data I'm getting from most of my other partitions other than the open errors count is slightly higher.
I'm still lost and still nothing has changed on the drive usage report.
Thank you for sticking with me on this though. I really appreciate it.
Jonathan

Collapse -

by irctrix In reply to Low Disk Space

Yea XP machines are the most rooted i have seen. And for what i see in your question thats what i think might have happened.

Check your system folders for a folder that looks out of place if there is one there maybe say a folder called dap you have been hacked and your machine is being used by someone else for something on the net.

Collapse -

by omar9981 In reply to

I don't usually keep a close eye on my system folders so I really wouldn't know if anything has changed. Looks the same as I'm used to and there is no dap folders or files on my entire computer. Any other folders or files to look for that might be evidence of a hacker?

Collapse -

by irctrix In reply to Low Disk Space

Best i can offer to find out if it is truly a hacked problem is do a search on your system for tar.exe and see if u get a match in any of your system folders. If you do get a match in a system folder most likely a sub folder of system32 you have been rooted and they are using your computer

Collapse -

by omar9981 In reply to

Thank you for the suggestion but I have no such file on my computer. I kind of wish I had found it so I knew what the problem was. Thanks again.

Collapse -

by softcorp.us In reply to

Hello Jonathan,

CHKDSK
======
Not being able to run CHKDSK is a big red flag and a solid piece of information. I think you should focus on getting CHKDSK to run. If it were my HDD and I had your problem and was unable to run CHKDSK, I would reformat, reinstall Windows XP and all my apps. This is a strong indication that something is wrong with your NTFS file system.

Question 1: When you said you had a problem running CHKDSK, what was the problem? Please be as specific and include as much detail as you can.

It is normal that you cannot run CHKDSK on your boot volume. You should not need to try to boot from a separate system to run CHKDSK. CHKDSK handles this by asking if you want to run it during the next Windows startup. You reply "Y" when asked by CHKDSK, and then restart Windows.

Question 2: Did you get this question from CHKDSK?

Question 3: Why is your Windows XP boot volume letter "h"? Odd problem. Odd boot volume. Just a correlation.

-----Steve Jackson

CEO/CSA
Software Corporation (Softcorp)
http://www.softcorp.us/softclock
Live time of day in cities around the world

Back to Desktop Forum
19 total posts (Page 2 of 2)   Prev   01 | 02

Related Discussions

Related Forums