locked
Hard drive is running out of space but where are the files? RRS feed

  • Question

  • I recently had a trojan back door on my server which was removed successfully however what they were doing on there is still a mystery to me. What has happened is all the space on my hard drive has dissappeard.

    I have a windows server 2003 standard edition.


    When i count all the files using file explorer I get a total of 29Gigs in use from Files.

    But when i run CHKDSK it says that it's using over 200 gigs. I can see all the hidden files and system files, but where did all the files go? How do i find them?


    Microsoft Windows [Version 5.2.3790]
    (C) Copyright 1985-2003 Microsoft Corp.

    C:\Documents and Settings\Administrator>chkdsk
    The type of the file system is NTFS.

    WARNING!  F parameter not specified.
    Running CHKDSK in read-only mode.

    CHKDSK is verifying files (stage 1 of 3)...
    202496 file records processed.
    File verification completed.
    792 large file records processed.
    0 bad file records processed.
    0 EA records processed.
    37 reparse records processed.
    CHKDSK is verifying indexes (stage 2 of 3)...
    755755 index entries processed.
    Index verification completed.
    5 unindexed files processed.
    CHKDSK is verifying security descriptors (stage 3 of 3)...
    202496 security descriptors processed.
    Security descriptor verification completed.
    13657 data files processed.
    CHKDSK is verifying Usn Journal...
    8767480 USN bytes processed.
    Usn Journal verification completed.

     244131771 KB total disk space.
     207022468 KB in 185875 files.
         77620 KB in 13658 indexes.
             0 KB in bad sectors.
        271203 KB in use by the system.
         36640 KB occupied by the log file.
      36760480 KB available on disk.

          4096 bytes in each allocation unit.
      61032942 total allocation units on disk.
       9190120 allocation units available on disk.

    C:\Documents and Settings\Administrator>
    Thursday, March 19, 2009 12:31 AM

Answers

  • chrisesimmons said:

    I recently had a trojan back door on my server which was removed successfully however what they were doing on there is still a mystery to me. What has happened is all the space on my hard drive has dissappeard.

    I have a windows server 2003 standard edition.


    When i count all the files using file explorer I get a total of 29Gigs in use from Files.

    But when i run CHKDSK it says that it's using over 200 gigs. I can see all the hidden files and system files, but where did all the files go? How do i find them?


    Microsoft Windows [Version 5.2.3790]
    (C) Copyright 1985-2003 Microsoft Corp.

    C:\Documents and Settings\Administrator>chkdsk
    The type of the file system is NTFS.

    WARNING!  F parameter not specified.
    Running CHKDSK in read-only mode.

    CHKDSK is verifying files (stage 1 of 3)...
    202496 file records processed.
    File verification completed.
    792 large file records processed.
    0 bad file records processed.
    0 EA records processed.
    37 reparse records processed.
    CHKDSK is verifying indexes (stage 2 of 3)...
    755755 index entries processed.
    Index verification completed.
    5 unindexed files processed.
    CHKDSK is verifying security descriptors (stage 3 of 3)...
    202496 security descriptors processed.
    Security descriptor verification completed.
    13657 data files processed.
    CHKDSK is verifying Usn Journal...
    8767480 USN bytes processed.
    Usn Journal verification completed.

     244131771 KB total disk space.
     207022468 KB in 185875 files.
         77620 KB in 13658 indexes.
             0 KB in bad sectors.
        271203 KB in use by the system.
         36640 KB occupied by the log file.
      36760480 KB available on disk.

          4096 bytes in each allocation unit.
      61032942 total allocation units on disk.
       9190120 allocation units available on disk.

    C:\Documents and Settings\Administrator>



    This forum is for Windows Home Server.  You should post your question in the Windows Server forums.  (Having said that, I would never even attempt to remove a trojan (or any other type of virus) and consider that computer safe.  The only way to make sure your server is completely secure is to wipe the OS and start over from scratch.)
    Thursday, March 19, 2009 1:11 AM
    Moderator