Hard disk constantly running (writing?) and disk space disappearing

akbmcf1 · Oct 26, 2010

Hi peeps and thanks in advance for any help you can give me! My laptop is doing my head in thanks to its new-found ability to chew up free disk space on my C:/ drive. Not sure if this problem has been on-going for a few weeks or something, but it's come to a head now!! A few bits of info that might be handy: Vista Home Premium 32bit, laptop is about three years old, 160GB HDD partitioned into a C: and a D: (both with approx 70GB total space according to Properties).

The story goes like this:

1) Got low disk space warning pop up (something like 300MB left!) - thought that this was entirely plausible since my wife keeps taking videos of our little baby on her camera and saving them on the lappy!
2) Decided to move some User folders from the C: to the D: and in the process moved about 5GB which then freed up several gig of space on the C: drive. Then I noticed that this was consistently dropping and the HDD light was flickering all the time, even when the laptop was not in use.
3) Updated and ran all the following programs: AVG 2011 Free, CCleaner, CWShredder, Malwarbytes - and nothing untoward reported.
4) Booted into safe mode and ran the programs again and still nothing reported.
5) Accessed VSS records via a command prompt and this was set to UNBOUNDED maximum capacity and showing as 16GB in use on disk, so revised this down to 12GB (a cautious approach, I admit!) and freed up a bit more space but this again is slowly being reduced.
6) Ran WinDirStat and this is showing that the C: drive is 54.8GB in use - when I right-click the C: drive in Explorer and go to Properties, Explorer says that 65.2GB is in use (and this figure is increasing). Interestingly, when I select all the directories and files in C: (and all hidden files and folders are shown, by the way), this totals 52.4GB.

Any suggestions would be gratefully received - I was almost hoping it was malware as at least it'd be an answer to the mystery, but so far it's not looking like it unless you people can suggest something I have missed?

Many thanks,
Andrew

richc46 · Oct 26, 2010

Andrew
First, lets find out what is on the drive
JDiskReport or my preference
http://download.cnet.com/WinDirStat/3000-2248_4-10614593.html

This link may help and give information.
http://www.mydigitallife.info/2008/02/26/how-to-fix-shrinking-disk-space-in-vista/

Scan with your antivirus
Scan with malwarebytes. Did you update, when you ran your report?

Space is probably being taken by restore points, Did you check for that possiblity?

akbmcf1 · Oct 26, 2010

richc46 said:
Andrew
First, lets find out what is on the drive
JDiskReport or my preference
WinDirStat - Free software downloads and software reviews - CNET Download.com

This link may help and give information.
How to Fix Shrinking Disk Space in Vista » My Digital Life

Scan with your antivirus
Scan with malwarebytes. Did you update, when you ran your report?

Space is probably being taken by restore points, Did you check for that possiblity?

Hi Rich,

Taking one point at a time:

Have already run WinDirStat and am getting a disparity between its report on disk space used and the Properties for C: drive. What specific info would you like to know, and can I post WinDirStat info up onto the thread?

Antivirus scans (Up-to-date AVG, plus downloaded, updated and ran Avira and Avast) and up-to-date Malwarebytes scan aren't reporting any viruses or malware. Have also run an up-to-date Spybot search and that only threw up about four tracking cookies that it easily dealt with.

Ran through clearing out several suggestions from that MyDigitalLife link (thanks for that, btw!) and also noticed that for some reason my copy of Ad-Aware was using a lot of system resources, so uninstalled that and free space jumped from 5.4GB to 13.4GB - go figure... Anyway, as I type, it has already reduced down to 12.0GB. Ay caramba!

Not sure how to check for the space used for system restore points - I have previously run the vssadmin list shadowstorage command from a command prompt and revised the max size down to 12GB from UNBOUNDED - does this include the System Restore info within it?

Don't know if it is of help at all, but I also have run the Reliability and Performance Monitor that is in Vista and notice on the Resource Overview window that there is constant write activity to C:\$Logfile (NTFS Volume Log) which is currently running at about 500,000B/min but at times since I started the R&P Monitor has been way higher than that. Other locations that see pretty consistent write activity include C:\$Mft and C:\pagefile.sys (as I typed that, this pagefile.sys one jumped to 14,839,808B/min write activity....) Am wondering if this could provide some indication of the issue I am experiencing?

Whatever extra info you need, please ask and I will do my best to supply it. Really appreciate your help so far! :-)

niemiro · Oct 26, 2010

I'm thinking a dying hard disk is possible, but before we go there, can you please run your computer in Safe Mode, and see if disk space is still dropping? Because you have a possible infection, Safe Mode should ONLY be access via F8 (Advanced Boot Options)

Richard

akbmcf1 · Oct 26, 2010

niemiro said:
I'm thinking a dying hard disk is possible, but before we go there, can you please run your computer in Safe Mode, and see if disk space is still dropping? Because you have a possible infection, Safe Mode should ONLY be access via F8 (Advanced Boot Options)

Richard

Nooooooo, not a dying hard disk.....not got the cash to replace at the mo! ;-)

Am using the machine all through the day today, so will reboot into safe mode via the F8 option this evening before I go to bed and leave it overnight with no programs running and see what happens to the free space then.

I have run up-to-date scans in safe mode using both Malwarebytes and antivirus programs and nothing has been found. Are there any other programs that you would recommend me trying? Have also run Spybot, CCleaner, CWShredder, RogueRemover when Windows has been running normally and found nothing - would it be worth running these in safe mode for a belt-and-braces approach?

Thanks for your help!

richc46 · Oct 26, 2010

Lets see if we can track it down. Use clean boot. If after boot space taken is less, follow the instructions.
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

I am still leaning toward restore points and other backup.

The above opinion seems to agree with one of our best, Brink, in another thread
http://www.vistax64.com/vista-file-...-can-i-delete-volume-shadow-copy-c-drive.html

akbmcf1 · Oct 27, 2010

Just a quick update:

To be absolutely sure on the virus/adware/spayware/malware front, last night I updated all the following programs to the latest definitions and then ran full scans with the laptop booted into Safe Mode from the F8 option on boot up:

RogueRemover
Malwarebytes Anti-Malware
Ccleaner
CWShredder
Spybot S&D
AVG 2011 Free
Avast
Avira

No problems detected from any of them. All the while, the disk space is still decreasing, although it seems to be slower than it was. When I booted into Safe Mode, C:\ > Properties reported 11.7GB (12,646,703,104 bytes) of free space - after all the scans and then leaving the computer to idle overnight, it was down to 11.6GB (12,473,602,048 bytes). Shut down the laptop and rebooted normally this morning and it was immediately at 11.4GB (12,276,436,992 bytes) and after Windows Update downloaded an automatic update, now the C:\ is down to 9.12GB (9,795,186,688 bytes) of free space.

Plan this evening is to do the clean boot procedure as suggested by richc46 in the above post.

Couple of quick questions

1) Would restore points etc contribute to the continually decreasing space? Surely it should only create a restore point (presumably using up some free disk space at that point) periodically, but this seems almost continual.

2) I've been wary of cleaning out the restore points using the advanced options of disk cleanup just in case there was a virus or malware and I inadvertently cleared out restore points from before the infection. Is this an overcautious approach or jsut sensible? (You can tell I'm a bit of a hoarder by nature, can't you? "I won't bin it, just in case I need it in the future....!")

Thanks again for everyone's help - rep will be added :-)

Lorien · Oct 27, 2010

First, you shouldn't have AVG, Avast and Avira installed at the same time - this can cause problems. Choose one and use the appropriate removal tool to uninstall the others: http://www.raymond.cc/blog/archives/2009/05/05/comprehensive-list-of-uninstallers-or-removal-tools-for-antivirus-software/. The others you listed can stay installed at the same time as the one you choose.

I have my system setup to create restore points every day and before any new installation, so they can build up quickly. Here's how to change the automatic restore point settings: http://www.vistax64.com/tutorials/1...-change-automatic-restore-point-schedule.html. Here's how to change how much space is used by system restore points: http://www.vistax64.com/tutorials/76227-system-restore-disk-space.html. Here's how to change whether or not a restore point is created with a new application installation: http://www.vistax64.com/tutorials/185433-system-restore-point-disable-application-install.html. Here's how to change whether or not a restore point is created with a new driver installation: http://www.vistax64.com/tutorials/172391-system-restore-point-disable-device-driver-install.html.

If you do indeed have Vista Home Premium, then you do not have Shadow Copy as a feature - so you can ignore anything concerning Shadow copies.

If you've checked with all those different products and found no infections, it is unlikely you have an infection on your system (possible - yes, but not likely). I wouldn't worry about deleting or reducing the space allocated to restore points - but then again, I use the maximum space myself as I have enough room on my hard drive and like having the options (it's a trade-off). System restore is almost never a solution to an infection anyway - there are better and safer and more certain methods.

I recommend you download Process Explorer Process Explorer to see what is really running on your system. Maybe something is occurring the background that is taking up space. Even you posting here and surfing the web takes up space with temporary internet files and such (until you clean them up).

Otherwise, proceed with Richard's suggestion and see what happens.

I hope this helps.

Good luck!

akbmcf1 · Oct 27, 2010

Lorien said:
First, you shouldn't have AVG, Avast and Avira installed at the same time - this can cause problems. Choose one and use the appropriate removal tool to uninstall the others: http://www.raymond.cc/blog/archives/2009/05/05/comprehensive-list-of-uninstallers-or-removal-tools-for-antivirus-software/. The others you listed can stay installed at the same time as the one you choose.

Thanks for the advice - I don't always have all three installed at the same time. Usually I just use AVG (as I have done for several years) but when this problem reared its head, I downloaded the others jsut in case they picked up something AVG did not. Seeing as none of them are picking up any problems, I will be uninstalling the ones that aren't required and running just the one anti-virus program as is good practice. Thanks for the reminder though!

Lorien said:
If you do indeed have Vista Home Premium, then you do not have Shadow Copy as a feature - so you can ignore anything concerning Shadow copies.

Weird. I definitely have VHP, and when I run the vssadmin list shadowstorage from an elevated command prompt it shows that there is allocated space for shadow storage. As I previously posted, this was set to a maximum size of unbounded with 16GB currently in use - I have now capped it at 12GB for the time being.

Lorien said:
I recommend you download Process Explorer Process Explorer to see what is really running on your system. Maybe something is occurring the background that is taking up space. Even you posting here and surfing the web takes up space with temporary internet files and such (until you clean them up).

Already have Process Explorer installed from when I had a problem last year with continual DPCs slowing the system. Have had it up and running for the past couple of days and there doesn't seem to be any process that is out of the ordinary (at least not to the extent of my Vista knowledge). It did throw up that a service connected to Lavasoft's Ad-Aware program was running and couldn't be killed, but I have completely uninstalled that since and the problem of decreasing hard disk space continues.

I have also tried seeing if the in-built Reliability and Performance Monitor throws up anything, but my experience with this is more limited. I posted my observations of this utility tool yesterday:

akbmcf1 said:
Don't know if it is of help at all, but I also have run the Reliability and Performance Monitor that is in Vista and notice on the Resource Overview window that there is constant write activity to C:\$Logfile (NTFS Volume Log) which is currently running at about 500,000B/min but at times since I started the R&P Monitor has been way higher than that. Other locations that see pretty consistent write activity include C:\$Mft and C:\pagefile.sys (as I typed that, this pagefile.sys one jumped to 14,839,808B/min write activity....) Am wondering if this could provide some indication of the issue I am experiencing?

Love Vista · Oct 27, 2010

What programs do you have running in the background?

akbmcf1 · Oct 27, 2010

Love Vista said:
What programs do you have running in the background?

Through the day as I'm working, all kinds of things. But overnight when it was in safe mode, it would have just been the Windows services needed to get the system to boot up I guess.

ripbox · Oct 27, 2010

TBH it sounds like a similar problem i have come across before now though thats not so say it is the same

the problem im familiar with lies in AVG its self.... AVG can sometimes lose its self in a random looping effect, an un-install is the only fix and unless you get every single part of it cleared - deleted ie. registry .dll ect, when you reinstall it, it will just return
Id recommend Avast as a replacement.... i can not say this is 100% the problem and fix but worth a try in any case

good luck

Lorien · Oct 27, 2010

You don't have Shadow Copies - shadowservice is a bit different and relates to System Restore in general. See Security & Safety - Windows Vista features - Microsoft Windows for confirmation that Shadow Copies is not included with VHP. In fact, because of this I generally recommend Shadow Explorer http://www.howtogeek.com/howto/windows-vista/recover-files-with-shadow-copies-on-any-version-of-windows-vista/ for people with Home versions, but that WILL take up more space (even if it may be useful one day).

The pagefile.sys is what the system uses to supplement RAM for memory. It is a set size and may grow or shrink as you do things - but it will not just keep growing beyond the set maximum. It can be adjusted, but I recommend it be set to 1.5 times the amount of RAM you have installed. I'm fairly certain this is not the cause of decreasing space. Log files will do that depending on what you have set to log - Performance Logs can take up a lot of space quickly (especially if you select a wide range of things to track). There are also many other types of logs that the system can keep and these too add up - but they can be useful if you have problems so again it's a trade-off (especially in Event Viewer).

Here's some information about $MFT in Vista and some articles on how to configure how it uses space and such. http://support.microsoft.com/kb/961095. For the most part, it's probably best to leave this alone, but as long as you follow the guidelines and don't go overboard reducing it, you can see if modifications will help (though I sincerely doubt this is the cause unless you are doing a great deal of installing and that doesn't seem to be the case).

As far as AVG goes, it is possible that it may be contributing to the problem (but I don't know this for certain) - I'm not all that familiar with that program - just enough to know that I believe there are better options that are also free. While Avast is a superior product and worthy of consideration, IMHO, I personally recommend Microsoft Security Essentials http://www.microsoft.com/security_essentials/. Not only does it use less resources than most of the good alternatives, but it works well and updates automatically through Windows Update without needing a separate update process running or scheduled (or done manually). And there's very good support available for it.

I hope this helps.

Good luck!

akbmcf1 · Oct 27, 2010

Lorien said:
You don't have Shadow Copies - shadowservice is a bit different and relates to System Restore. See Security & Safety - Windows Vista features - Microsoft Windows for confirmation that Shadow Copies is not included with VHP.

The pagefile.sys is what the system uses to supplement RAM for memory. It is a set size and may grow or shrink as you do things - but it will not just keep growing beyond the set maximum. I'm fairly certain this is not the cause of decreasing space. Log files will do that depending on what you have set to log - Performance Logs can take up a lot of space quickly (especially if you select a wide range of things to track).

I'm always learning - thanks for the clarification!

Not sure on the Performance Logs front - would these have had to be initiated by a user, or could the system/programs create performance logs on their own?

Lorien · Oct 27, 2010

I'm not certain what the defaults are for Performance reporting - I'll get back to you on that. Also, relook at my prior post as I've revised it and added quite a bit you may find helpful.

Take care!

EDIT: I believe some Resource Monitoring is done and logged automatically - but it is minimal and much goes to Event Viewer for storage. The rest needs to be set by the user. This isn't taking up enough space or happening enough to be causing the levels of change you're talking about. This isn't the "cause."

akbmcf1 · Oct 27, 2010

Lorien said:
EDIT: I believe some Resource Monitoring is done and logged automatically - but it is minimal and much goes to Event Viewer for storage. The rest needs to be set by the user. This isn't taking up enough space or happening enough to be causing the levels of change you're talking about. This isn't the "cause."

Once again, thanks for the extra research. After seeming to be pretty stable throughout the afternoon, the free space has taken a dive again - now down to 8.21GB - so think I will be investigating the clean boot procedure this evening/night. Will also remove some of those anti-virus programs I think, seeing as I am pretty sure there isn't a virus causing it.

Will let you all know how I get on in due course :-)

Lorien · Oct 27, 2010

You may at some point also want to try Process Monitor Process Monitor. if set to log activity, it WILL take up space (perhaps quite a bit), but it may also show us what else is happening that is taking up disk space over the time of the monitoring. If on today, it may have shown what was happening when the space dropped so much and given us something to target.

Anyway, since it does take up space itself (which can be recovered by turning off the monitor and deleting the logs), I thought it might be something to consider after the clean boot test - maybe in a few days or whenever. We can't do much but guess and test until we find the culprit doing this. It's probably something natural that we just haven't considered - but seeing a report of exactly what processes were running when it occurred could give us the clue we need. Anyway, just another option to keep in the back of your mind (and another good tool for the toolbox).

BTW, thank you kindly for the rep and the kind words - they are much appreciated - though to be honest I'll get more satisfaction if we can get to the bottom of this and identify the cause. It may be something we can't or shouldn't do anything about or it may be something we can modify to help keep things more stable - we can't yet tell until we know why it is happening.

Good luck and keep us informed.

akbmcf1 · Nov 8, 2010

Just a quick post to say that a) I've not forgotten you all! and b) the problem hasn't resolved itself miraculously. I've just been so busy the past week or so that I haven't had time to carry on with the clean boot et al.

By way of a general update, I had managed to get the C: drive back to about 8GB of free space, then one day last week it was suddenly reporting about 19GB of free space! :: bangs head against wall ::

Anyway, this newly found 19GB of free space is still decreasing steadily - now down to 12.3GB - so will carry on with your suggestions and see what turns up.

Can anyone give advice on how to use Process Monitor to log activity? Think that might be worth a shot too. :-)

Many thanks,
Andrew

Lorien · Nov 8, 2010

Hi Andrew,

The following article may assist with setting up and using Process Monitor: How to Use Process Monitor to Track Events and Generate a Log File - The Winhelponline Blog.

The download itself says to read the program's help file and then just "play with it."

I hope this helps.

Good luck!

Hard disk constantly running (writing?) and disk space disappearing

My Computer

My Computer

My Computer

Banned

My Computer

My Computer

My Computer

My Computer

Account Suspended

My Computer

My Computer

Banned

My Computer

My Computer

Nerd

My Computer

Account Suspended

My Computer

My Computer

Account Suspended

My Computer

My Computer

Account Suspended

My Computer

My Computer

Account Suspended

My Computer