More free drive space *after* a crash?

Discussion in 'other software & services' started by ErinLine, Aug 9, 2007.

Thread Status:
Not open for further replies.
  1. ErinLine

    ErinLine Registered Member

    Joined:
    Jul 26, 2007
    Posts:
    20
    Does anyone know why I'd suddenly see my HDD's free space increase after a crash?

    I'm sort of obsessive about the amount of free space on my drive(s) :) As such, I noticed that after a win32k.sys BSOD crash last night, my drive (in two partitions) now had an increased amount of space on it - some 5GB or so spread across the C and D partitions (3.8GB increase on the C drive and a 1.3GB increase on D). This means that when in Windows Explorer, in the status bar across the bottom of the screen (or even in the Properties window of each partition) where I used to see e.g. 20GB free I now see 24GB free, just as a result of this crash. File counts from before and after the crash seem consistent though.

    I'm reasonably certain (but not 100% of course) that I didn't suffer any data loss and suspect that it has something to do with Windows Recycle Bin reserved disk space, but I just don't know enough about it to make that call.

    Quick details: drive is healthy, not failing; OS is Win XP sp2 fully patched, all hardware is in perfect condition. No event viewer errors that suggest any type of data loss or failure. Also I have not run chkdsk on the drive yet and wonder if the "free space" will disappear after I run it.

    Thanks!
     
  2. ErinLine

    ErinLine Registered Member

    Joined:
    Jul 26, 2007
    Posts:
    20
    Addendum - The timestamp on the System Volume Information on both partitions matches the restart time after the crash last night. Could something in those directories have changed to cause the free space increase? I don't know enough about it to even guess.

    I also should add that the system is virus free.

    Thanks.
     
  3. Espresso

    Espresso Registered Member

    Joined:
    Aug 1, 2006
    Posts:
    975
    Internet Explorer cache is often deleted after a crash if you are running IE at the time. Sometimes restore points are deleted as well (stored in System Volume Information) which would explain any large changes in free space. There are some drive/file info files in Sys Vol Inf that are updated often including at boot so that would explain the timestamp match.

    Windows recycle bin "reserved space" isn't counted in free space calculations unless there are actually deleted files in there.
     
  4. ErinLine

    ErinLine Registered Member

    Joined:
    Jul 26, 2007
    Posts:
    20
    Espresso thank you so much for your reply. Maybe you can help me further?

    I can account for IE files from before and after the crash and can exclude those from the reasons. With respect to restore points, I don't use them. I can also verify that the size of the restore directory did not change from before and after the crash (the timestamp on the directory did change though, for the first time since XP was installed on this drive, and that's over two years ago).

    Finally, with respect to the Sys Vol and the timestamp, I should note that the stamp has not changed since the crash and that it hadn't changed in weeks prior to the crash.

    The mystery of all this extra space that just suddenly appeared still gets me :( Should I actually be worried about lost files or am I still safe there? Any other help would be greatly appreciated! And thank you again for your reply!
     
  5. Espresso

    Espresso Registered Member

    Joined:
    Aug 1, 2006
    Posts:
    975
    Do you have security settings changed on the System Volume Information folder? Normally, I don't think you can even check the size of that folder so it will always say 0KB. I give myself read permission so I can access the files in the restore points.

    By timestamp, do you mean creation date or modified date? The properties page only shows creation date so you would have to view in details mode to see the modified/access dates.

    If you haven't already, run chkdsk and see if it finds any errors.
     
  6. ErinLine

    ErinLine Registered Member

    Joined:
    Jul 26, 2007
    Posts:
    20
    Espresso, hey. Thanks for your continued help. My reply is late because I had all these things planned to try with the drive but never got to do them :( I still have a chkdsk planned for the drive but haven't run one yet (large drives take a bit of time and I want to be here to watch this one run).

    I haven't changed the security settings for Sys Vol, I'm going solely by the timestamp (i.e. modified date) on the directory. It changed on the evening of the crash and hasn't changed since. Furthermore it hadn't changed for some time before the crash.

    I thought of a question I wanted to ask you - is it possible that the drive space for both partitions had become "corrupted" or misrepresented or whatever at some point long before the crash, and that the crash actually "reset" the space?

    I'm still worried about file loss on both partitions. Should I be or is it likely to be something else?

    Thanks!
     
  7. Espresso

    Espresso Registered Member

    Joined:
    Aug 1, 2006
    Posts:
    975
    It doesn't take that long for a basic chkdsk which is all you need to see if there are any serious problems. Using the /r option will scan the disk for bad blocks and take a while but that's unlikely to be an issue.

    I recommend that you give yourself read permissions on the sys vol info folders to see what's in there and double check that System Restore isn't running. If the drives are large, then the default allotment for restore points would be a few gigs on each drive.
     
  8. ErinLine

    ErinLine Registered Member

    Joined:
    Jul 26, 2007
    Posts:
    20
    Thanks again for the help. Here's what I know so far:

    chkdsk found nothing and didn't need to correct any size issues.

    File lists from "snapshots" taken four days before the crash and immediately after the crash compare okay, meaning there doesn't appear to be any data loss. What I can't see in my directory snapshots are the System Volume directories (because they are hidden). Is it possible that I lost 4GB in that directory (or that something was adjusted) on my C drive partition and another 1GB or so in SysVol on my D Drive partition?

    I wish I knew more about what this meant, but I don't :( I can tell you that I gained more space on the smaller partition, the C Drive (where I picked up 4GB). Also, System Restore seems turned on by default though as I mentioned before I never use it.

    I'm going to leave this issue alone after your next reply so that I don't keep coming back to it and asking more questions.

    Thanks!
     
  9. Espresso

    Espresso Registered Member

    Joined:
    Aug 1, 2006
    Posts:
    975
    If System restore is turned on then your system is creating restore points (regardless if you use it or not) and that's likely where your newfound gigabytes came from. When your system crashed, your change log may have become corrupted and the restore service deleted all of your restore points, giving you a few extra gigabytes of space.

    You can set the amount of disk space used by SR in the system control panel. I usually turn it off on all of my drives except the system drive where I allot 1.3GB for restore points.

    If you have no plans on using System Restore (I find it very useful so I recommend it) then turn it off in the control panel. It will save you a little disk space and give you a slight performance boost but it's one less system protection to fall back on.
     
  10. ErinLine

    ErinLine Registered Member

    Joined:
    Jul 26, 2007
    Posts:
    20
    Thank you. Your last post helped tremendously, no kidding. Knowing that restore points are created is very helpful in explaining where the space might come from. I'm also taking your advice and leaving SR on only on the system drive (C Drive in my case).

    If you can believe it I had the same crash last night and it behaved in exactly the same manor as the previous one mentioned in this thread. The crash is due to an issue with copying large amounts of data from one SATA drive to another - that much I now know. Large copies cause some sort of controller issue and the result is that the machine just bombs out. The details are unimportant though. What is important is that upon reboot I have:

    1) an "sr" error message in my event viewer (same as before)
    2) The timestamps on all SysVol directories and the System Restore dir have changed (just as they changed before)
    3) An incredible amount of free space is now available (just as before)

    The sr error message mentions an error with "_filelst.cfg" fwiw; and I did read about problems with crashes and change.logs in the SysVol directory. I know from doing research on System Restore that it does NOT have an effect on your personal files, only system files. I'm also 99.9% certain that no file loss occurred and am now convinced that any free space showing available is a result of something that happened in the closed SysVol directory. However, I don't think I need to worry about it so long as chkdsk keeps showing as okay (and it is).

    Would you say this is a fair assessment?

    Thanks so much man! It feels good to understand these things!
     
  11. Espresso

    Espresso Registered Member

    Joined:
    Aug 1, 2006
    Posts:
    975
    Yes, it would appear that this mystery is solved.

    As for the crashes, I was getting similar freezing/crashes from copying files to/from SATA drives a while ago and it was actually two problems - a sloppy fitting SATA cable and a flaky ULI SATA driver. I got a new cable with metal clips and used the default windows driver and I haven't had any problems since.
     
  12. ErinLine

    ErinLine Registered Member

    Joined:
    Jul 26, 2007
    Posts:
    20
    Espresso thank you again for your time, patience, and assistance! I really do appreciate it!
     
Loading...
Thread Status:
Not open for further replies.