# Missing Hard Drive Space (windows 7)



## adium132 (May 1, 2010)

Hi all

Im running Windows 7 under Bootcamp on my iMac off a 30Gb Partition. Other than Anti Virus programs and very small 'utilities' I have no big programs running on the drive.

As time has worn on, my drive has become more and more congested, despite not installing any programs on it. I moved the pagefile off the drive to an external hard drive over a week ago now and the small space i gained has now been filled up again.

As shown in this screenshot: http://img535.imageshack.us/img535/6279/missingspace.jpg

According to Treesize, my files account for 16.8Gb of my 30Gb drive - why does Windows show that I have only 1.4Gb free? I have checked the "protected" folders that Treesize cant list, and all of them are empty

I have tried to search the net as best I can about this problem but cant find many thing where the missing space amounts for such a large amount of the drive. I have used CCleaner to delete all my temp files/etc and used the Windows Disk Cleanup utility to get rid of the initial installation files, none of this has helped at all however =(

Ive also seen some suggestions on using WinDirStat to diagnose the problem, the screenshot of that can be seen here http://img72.imageshack.us/img72/240/windirstat.jpg . Im not massively sure what im looking at in Windirstat, but it seems to me like it shows the same problem. My files only account for <16Gb disc space, hence 13Gb worth of space has just vanished off the disc (pretty harsh when its over 40% of the partition size).

Thanks in advance for any help you can offer, I hope im not being too stupid

Adam


----------



## adium132 (May 1, 2010)

As a further measure I have run a full CHKDSK (after restart) and defragged the drive to no avail (if anything the problem is now worse... 5.85Mb free... )

No problems were found either =/


----------



## Rich-M (May 3, 2006)

What you are trying to do is never going to work on 30 gb partition. Windows 7 without any programs is nearly 20 gb and system restore is probably taking the rest you can't figure out.


----------



## adium132 (May 1, 2010)

To clarify: Windows 7 is the only thing I have installed on this partition. Every other program is on my Mac Hard Drive apart from a select few utilities (most installed to fix this problem)

System restore and all "Protection" services are turned off, the System Volume Information folder is less than 300Mb... I have also checked System restore and only the newest restore point is active (which cannot be removed)


----------



## adium132 (May 1, 2010)

Sorry for self-posting in my own thread but i seem to have found the problem. For some reason the folder:

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Media 
Player\Art Cache\LocalMLS 

is over 16Gb in size packed with .jpgs - this came up after a virus scan i noticed spent an extreme amount of time on this folder. I do not understand why this folder would be filling up with temporary .jpgs as I dont even use Windows Media Player?

Any idea on how to stop this behaviour would be much appreciated? Also any idea how i can delete this folder, given it takes explorer over half an hour (and counting) to get into the NetworkService folder? Ive tried CMD prompt but it says the folder is being used by another program - i guess safe mode is the way to go??

Thanks again


----------



## jiml8 (Jul 3, 2005)

Windows Media Player talks on the internet when you don't know it is doing it, even when you aren't running it.

I don't know what it is doing, but I've blocked it, and in that directory I have only 3 jpegs, and those are all demos that came with the system.

Like you, I am running Win7 in a virtual machine, though I'm using Linux. I installed it about a month ago, and I'm still making sure it is secure, so I'm watching it closely. By "secure", I mean that I am ensuring that I have successfully stopped it from connecting to the net when I don't want it to - and I never want it to unless I tell it that it can.

If you install a third party firewall (I am using Online Armor) and configure the firewall to ask you whenever ANY program wants to talk on the net, you'll find wmp trying to get out there a lot of times. You'll also find a LOT of other Win7 things calling the mother ship.

You also might check the scheduled tasks, try to identify it there, and remove it from the schedule. However, there are a LOT of scheduled tasks by default and I for one am reluctant to change them too much because I don't want to break the OS. Gradually as I learn more about it and watch it in action, I'll start modifying those items. But for now, firewalling works quite adequately.

At this point in time, I am blocking the following URLs using my Linux iptables firewall (these are the rules in the script I run to do it):

sudo iptables -I FORWARD -s 172.16.187.0/24 -d activation.sls.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d sls.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d www.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d spynet2.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d spynettest.sls.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d content.windows.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d logging.windows.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d windows.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d www.msftncsi.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d msnhst.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d wwwco1vip.microsoft.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d 64.4.0.0/16 -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d 65.52.0.0/16 -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d cds90.sjc9.msecn.net -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d time.windows.com -p all -j DROP
sudo iptables -I FORWARD -s 172.16.187.0/24 -d cds39.sjc9.msecn.net.microsoft.com -p all -j DROP

All of these URLs - every one of them - was identified by monitoring the Win7 network connection to see who it was trying to contact. The only contact I am allowing is updates.microsoft.com, and once I'm sure the system is secure and stable I'll block that too.

I suggest you delete all those jpegs to recover your space, then go to work locking your virtual machine down so that you are in control of it, not it in control of you.

Another possibility - which you might want to investigate - is that some malignant third party has taken over your system and is using it as a repository for illegal images. I can't evaluate the likelihood of that from here, but it is something for you to consider.


----------



## jiml8 (Jul 3, 2005)

Rich-M said:


> What you are trying to do is never going to work on 30 gb partition. Windows 7 without any programs is nearly 20 gb and system restore is probably taking the rest you can't figure out.


I did a default install of Win7 Pro in a VMware 7 virtual machine, and I allowed VMware and Win7 to handle all the details.

VMware defined a 16 GB virtual disk, and Win7 needed 8 Gigs to install. Since then, I've added some office packages (MS Office, Open Office, and Wordperfect), some development tools, firefox, and some other miscellaneous stuff, and it still is taking only about 11 Gigs.


----------



## TerryNet (Mar 23, 2005)

I looked at my C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Media
Player\Art Cache\LocalMLS folder thanks to your post. Mine is only about 2.3 MB with 55 files. Near as I can tell those files, many are duplicates, are album art for albums containing songs I listened to 10 second previews on Amazon.com. That's, I assume, using a Windows Media plug-in to Firefox.


----------



## adium132 (May 1, 2010)

jiml8 said:


> I did a default install of Win7 Pro in a VMware 7 virtual machine, and I allowed VMware and Win7 to handle all the details.
> 
> VMware defined a 16 GB virtual disk, and Win7 needed 8 Gigs to install. Since then, I've added some office packages (MS Office, Open Office, and Wordperfect), some development tools, firefox, and some other miscellaneous stuff, and it still is taking only about 11 Gigs.


I agree Windows 7 takes up a fair amount of space, but I would never imagine it would take up anywhere near to 30Gb.

For anyone else having my problem, I would reccommend a program called Spacemonger (http://www.sixty-five.cc/sm/), it gives a really nice structured image of where your drives space is being used and which folders. it is also the only tool of its type that spotted this folder was causing a problem for me (treesize/WinDirStat etc missed it, I presume because it was a hidden folder?). In the end I only noticed it because i saw the Virus Checkers/Spyware utilities etc spent ages on the folder - which I couldn't understand.

Woke up this morning and theres another 2.3Gb of images in that folder. I do have a large music collection and it seems to just be making 1000s of duplicates of album art in the folder. Turning off the "Windows Media Player Network Sharing Service" has seemed to stop it... for now =)

Thanks for the help guys


----------



## antech (Feb 23, 2010)

SpaceSniffer is all I have used over the past two years!


----------



## antech (Feb 23, 2010)

The system volume information is also very large.
Sorry for the double post


----------

