1

I have a 1TB HDD and I run it extremely close to full, all of the time (I've seen 120kb free before :P).

About an hour ago I had about 10GB free. Suddenly I noticed that I have 40GB free!

I am a power user, and I definitely haven't deleted anything. Moreover, I've actually been downloading.

So my question is: is there any way of seeing how this newly freed space came to be?

8
  • @DaveRook There're about 50 files in my Recycle Bin. Nothing's changed anyway. They're just the files I already knew about. I'm running Kaspersky AV - nothing's in Quarantine. Sep 26, 2013 at 7:30
  • So, do you have any idea what file(s) are missing by name? If so, could you try a search to see if they still exist (or not)
    – Dave
    Sep 26, 2013 at 7:34
  • @DaveRook No, no idea what files are missing. I think you hit the nail on the head with the first sentence of your answer... unfortunately! Sep 26, 2013 at 7:36
  • Also, I have 3 large shared folders but they're set to only allow reading, not writing. The only thing I was doing at the time was using Virtualbox. That said, before I started up the VM, my free space was ~10GB; and the VM I started was started from power down (not a hibernated VHD). After powering down that time, I noticed the free space. Sep 26, 2013 at 7:37
  • You may get lucky with a system restore (although it doesn't typically affect files? Or, if you are taking a back up?
    – Dave
    Sep 26, 2013 at 7:45

1 Answer 1

2

I don't think you can unless you have auditing on (or some software to track all changes).

I would check the Recycle bin to see if it is there. Also check your AV in case it has quarantined them (if applicable)

I would also run a SMART tool just to ensure the hard drive is behaving.

And run Chkdsk /f from the command prompt

This is how to turn on Auditing in Windows

To set up auditing, modify the group policy affecting the server containing the files. You need to navigate to Computer Config, Windows Settings, Security Settings, Local Polices, Audit Policy, and set the "Audit Object Access" setting to audit for Success and/or Failure.

Then, navigate the folder that you wish to audit, bring up its properties, then security. Click on "Advanced", and then the auditing tab. From here, you can add users or groups to audit for this folder, and define what actions to audit, E.g. Delete, Delete Sub Folders and Files, Modify Etc.

Any collected data will appear in Event Viewer, under security.

Source

OR

Enable file auditing in Windows to monitor events related to users accessing, modifying, and deleting sensitive files and folders on your network. To maximize the value of this type of auditing, enable auditing on a file server on which you have installed a LEM Agent, and only for the specific files and folders you want to monitor. If you enable auditing on all files or folders, or even a large number of them, you will create an unnecessary burden on your LEM appliance by telling Windows to log events you don't want or need to see.

Complete the two-part process below to first enable object auditing on your server, and then enable file auditing on the files and folders you want to audit. Provided Windows is logging the events and your server has a LEM Agent installed on it, your LEM Console will begin displaying the new file auditing alerts immediately.

To enable object auditing in Windows:

Open Administrative Tools > Local Security Policy.
Expand Local Policies and click Audit Policy in the left pane.
Select Audit object access in the right pane, and then click Action > Properties.
Select Success and Failure.
Click OK.
Close the Local Security Policy window.

To enable file auditing on a file or folder in Windows:

Locate the file or folder you want to audit in Windows Explorer.
Right-click the file or folder and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
If you are using Windows Server 2008, click Edit.
Click Add.
Enter the name of a user or group you want to audit for the selected file or folder, and click Check Names to validate your entry.

For example, enter Everyone. Click OK. Select Success and Failure next to Full control to audit everything for the selected file or folder. Optionally, clear Success and Failure for unwanted events, such as: Read attributes Read extended attributes Write extended attributes Read permissions Click OK in each window until you are back at the Windows Explorer window. Repeat these steps for all files or folders you want to audit.

Source

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .