Where did my disk space go ? [very long directory names, system directories, symbolink and other hard links ...], meet xdir.exe

gbordier — Tue, 03 Feb 2009 23:00:00 GMT

[EDIT : posted a statically linked version to remove dependency over VCRT 9.0]

Hi geeks,

The first thing I do when I receive a new Microsoft-issued laptop is : buy the largest hard disk I can find to replace the one that shipped with it.

But time goes ... and soon I wonder where all that disk space went.

The other day one of my customers called me with that stance : "Guillaume, I've got a LUN on my SAN with 350GB I cannot account for".

Where can there be content that is hidden from the system administrator himself ?

System Volume Information is a folder with SYSTEM only permissions (so administrators do not have access) that can contains many things from Single Instance storage data, recovery points, snapshots ...
very long (> 256 chars) directories are not displayed by either explorer or the command line because one needs to use the Unicode syntax when accessing those and for some reason our developpers did not.

To make the story short my customer had VSS shadow storage defined on that LUN for snapshot of a different LUN, so using vssadmin delete shadows or vssadmin delete shadowstorage got his content back.

But this incident convinced me to launch my could old C++ compiler to build a tool that deals with those kind of nightmares: meet XDIR.EXE

XDIR is a combination of DIRUSE.EXE (the close parent of DU from Windows 2000 resource kit), RD (remove directory from the nt shell), and dir.

BUT XDIR.EXE handles directories of any length, or permissions , it does try to follow symbolink links and you can use it to:

reclaim disk space : calculate the size of that particular directory and any subdirectory :
try XDIR c:\
read a very long (or any) directory :
try XDIR <your long directory> /DIR
delete a very long directory :
try XDIR <your long directory> /RMDIR

Options are :

/MIN:xxx[GB\|MB\|KB\|B]	Minimum size to report (default is 500 MB)
/LEV:nn	Number of directory levels to display, default is 2, 0 will display all directories
/FORCE	known to the user of FILEACL, this will let you use your SeBackupPrivilege and SeRestorePrivilege to bypass the NTDS permissions (you need to be backup operator obviously)

There are also a few other options that let you create an ANSI or UNICODE output file that came directly from FILEACL.

Let’s try this: where is there content that weight more than 500MB on my C drive ?

What are those 2 GB in my System Volume Information ?

Well, that seems like a bunch of restore points to me. Wait, I’m running Windows Server 2008 and restore points are not a server feature ! Where are those kids from ? ohh, maybe from my old Windows XP dual boot !

Let’s see

Files from last november? sounds like it’s the last time I booted my XP boot to flash my Windows Mobile, ok, let’s get rid of those (I’ll use the supported method of rebooting to XP and ask nicely that it delete those useless recovery points)

let’s use another example:

See that dir ?

Empty folder, big deal ?

why the heck, does xdir.exe think there is 1.167 GB in that dir ?

Well somebody twisted (me) has put 1 Gig into this stupidly long directory.

Side Note : it is just impossible to go there with explorer so what can I do ? :

Create a JUNCTION point
mklink /J e:\temp\mount "e:\temp\01234567890123456789012345678901234567890123456789\01234567890123456789012345678901234567890123456789\01234567890123456789……
Create a DIRECTORY SYMBOLIC LINK
mklink /D e:\temp\mount "e:\temp\01234567890123456789012345678901234567890123456789\01234567890123456789012345678901234567890123456789\01234567890123456789……
use the good old SUBST from DOS :)

if you just want to get rid of it use :

XDIR <your long directory> /RMDIR

like this:

add the /FORCE option if you do not have the rights on all folders (like with System Volume Information)

Guillaume

Guillaume Bordier's blog : XDIR long directories folder size

Where did my disk space go ? [very long directory names, system directories, symbolink and other hard links ...], meet xdir.exe