Huge hidden file in system drive

[Malcul]

I made an image backup of my system drive to another separate drive (E:\). Since then, although there is a "WindowsImageBackup" folder on E:\ there is also a huge hidden file on C:\, my system drive. 71GB of a 100GB drive!!
It is so large there is little room left to install anything else. How can I delete a 'hidden' file? Is it part of the WindowsImageBackup? Will it go if I delete the "WindowsImageBackup" folder?
I'm so cheesed off with it I'm thinking about re-installing, and I only did so 10 days ago. Something must be wrong as I cannot even restore to the point before the image backup.
The little niggles with Windows 7 are beginning to mount up!

 

[Minotar]

Before deleting it have a look whats inside it.

Go to MYComputer>Organize (top left)>Folder and Search Options>View>CLick Show Hidden files ,folders, or drives.

Then have a look at the file.

What back up software are you using?
There could have been an option to set how much storage you allow it to use and this could be the result.

 

[Bare Foot Kid]

Hello Malcul, welcome to Seven Forums!



You may have a better experience using an image program like the one discussed in this tutorial at the link below and be sure to post back with any further questions you may have and to keep us informed.


Imaging with free Macrium

 

[Malcul]

Cannot see it even after following your instructions.
I used windows' own create a system image from the backup and restore your files part of the system and security section of the control panel. There was opportunity to select place but not size (Which didn't surprise me as it would depend on c:\ size, would it not?)

 

[Malcul]

Further to my previous post here is a screenshot of what WinDirStat is showing me.

The yellow area is the culprit, no name, 'unknown' is how WindirStat calls it.
What, why and how: did it appear, and can I get rid of it without re-installing.

 

[Bare Foot Kid]

Obviously you are not a casual user, have you run evilware scans, to be sure?


Malwarebytes Free Virus Scanner

 

[mjf]

It's curious. WindowsImageBackup is an explicitly named folder as you know. It does keep some small information in System Volume Information.

You may want to try "Partition Wizard" of all things. It has a "partition Explorer" which let's you explore all sorts of places. Failing that try "Search Everything".

 

[Bill2]

Do you use hibernation? Might be the hiberfil.sys. Open the command prompt as admin, then type the followinh:

powercfg -h off

Hit Enter. This'll disable hibernation and also delete the hiberfil.

 

[Orbital Shark]

Before deleting it have a look whats inside it.

Go to MYComputer>Organize (top left)>Folder and Search Options>View>CLick Show Hidden files ,folders, or drives.

Then have a look at the file.

What back up software are you using?
There could have been an option to set how much storage you allow it to use and this could be the result.

A screen cap of your root drive (C would also prove helpful after applying the above tip.

 

[mjf]

Unfortunately I don't think "Show Hidden files ,folders, or drives" gives you easy access to everything.

 

[HammerHead]

Shadow Copy?

Could it be shadow copies?

 

[fafhrd]

The obvious place to check is $Recycle.bin, and RECYCLER, just in case the recycle bin for all users has not been emptied yet, the next place is the $quota file, and virus quarantine files. The browser cache and safe browser bloom are also hidey holes where big files lurk, depending on which browsers are used, they are found in different places.

Very large files are found by defragmenters I recommend Puran defrag for a quick analysis

Puran Defrag Trial and Free Edition Download

Also Easy Clean by Toniarts has a disk usage pie chart which fairly clearly shows where large files are hiding

ToniArts EasyCleaner - Free software downloads and software reviews - CNET Download.com

 

[cyclic]

No, to see everything you also need to 'show system files' , then you can view everything on the drive.

 

[fafhrd]

No, to see everything you also need to 'show system files' , then you can view everything on the drive.

That's not always true - there are files and folders that are superhidden.

Look in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Yesterday I would have told you that you can see even more hidden stuff if you create a new value called:

SuperDuperHidden

and give it a DWORD value of 1,

But I have since realized it would be foolish to give that advice today

 

[Layback Bear]

Clean the $Recycle.bin and see if the yellow goes away.

 

[Malcul]

I gave up and reinstalled. Problem solved. Maybe I had a virus. who knows ... and now I,m rid of it who cares.
I have had enough 'mishaps' to have made things easy for myself to be able to reinstall quite easily, without having lost anything.
I really do wish my mobile broadband dongle would work with linux, I'll be dead and buried before I can rid myself of Mycrapsoft.
Thanks anyway guys for the ideas, Cheers!

 

[techirlo]

Microsoft VirtualStore

I know this post is closed, but I just had a similar problem and eventually discovered that the cause was the VirtualStore, it may have been the same problem you were having.

Basically, when programs are run with non-administrative priveleges and they try to save files to protected Windows folders in Windows Vista/7 (such as C:\ or C:\Program Files\) they are instead placed inside the 'VirtualStore' folder for that user. This means the files are instead hidden in something like C:\users\[your username]\appdata\local\virtualstore\program files\[your program that created the file]\, usually without any indication to the user that this has occured.

So, while your program might have seemingly saved a big file to C:\file.ext as you requested, it's actually been hidden under your user path above by your OS, and the OS has created a junction point on the C drive named C:\file.ext which points to the real file.
Ideally you're able to delete or move the junction-point file and it will take the real file and the junction point with it, but if it's been created under another username, or if you're not running the delte (or move) command with administrative permission it may not work so simply.
I recommend WinDirStat to track down the weird files, and then searching for them under C:\users\[your username]\appdata\local\virtualstore\ - do a search for VirtualStore and junction points for more info.

Hope that essay helps someone!