Tech Support > Computer Hardware > Desktops > Finding REALLY hidden files?
Finding REALLY hidden files?
Posted by Don Stauffer in Minnesota on October 6th, 2007


My wife frequently comes up with this problem. Her working ( D )
drive is almost full. She has a project she is still working on, so
does not want to format disk. She cleans up all the old files she
(and I) can find from old projects. On her drive (a 500 GB unit) the
properties function of WE shows over 450 GB used, but looking in the
various folders we can only account for 200 GB. The remaining 250 GB
is completely hidden. This is AFTER defrag. I have checked the
options in the folder properties dialog, and we do NOT have "hide
hidden files" enabled.

How can we "see" these mysterious files so we can clean them out?

BTW, this is a Windows XP setup.

Posted by Richard Crowley on October 6th, 2007


"Don Stauffer in Minnesota" wrote ...
Are you really *DELETING* the files, or are you just "deleting"
them (i.e. putting them into the "recycle bin"). To really, truly
*DELETE* a file, you must use the shift key and then hit [Delete]
Otherwise the file will just be moved to the "recycle bin" and STILL
TAKES UP THE SAME DISK SPACE.

Check the "Recycle Bin" on the drive and clean it out. I just
*DELETE* the Recycle Bin folder completely instead of fooling
around "emptying" the containers.

Posted by Richard Crowley on October 6th, 2007


"/Tx2" wrote ...
Deleting the "Recycle Bin" icon on the desktop is not the
same as deleting the hard drive folder. I just ignore the
"Recycle Bin" icon. It is of no practical use to me. YMMV

I just deleted the folder on my C: drive and it worked just
fine. Do you have full administrative rights for the login
account you are using?

Posted by Psygnosis - Silent Running on October 6th, 2007


"Richard Crowley" <rcrowley@xp7rt.net> wrote in message
news:13gfco9ifdpg65@corp.supernews.com...

To actually delete the file instead of moving it to the trash hold down the
SHIFT key when you hit the delete key or when choosing delete from the
context sensitive menu (right click menu). I do this with very large files
or things I know I will not want back or that I know I have a current CD
backup of. You can also right click on the trash can and go to properties
and turn down the amount of space it uses or tell Windows to just delete the
files and not use the trash can.

Psygnosis


Posted by Richard Crowley on October 6th, 2007


"/Tx2" wrote ...
Shouldn't have anything to do with it.
Of course, there is a "recycle bin" in each partition,
so you will have to empty/delete them all.


Posted by RF on October 6th, 2007


Richard Crowley wrote:

I didn't see any mention of the OS you are using.

I use Win2K on NTFS and it has various security settings for all files
and folders. Sometimes I cannot delete a file or folder, in which case I
rt-click on it and choose properties. Select the Security tab and click
the add button. Search for your login name and give yourself full
permissions and ownership of the file/folder.

Then you may be able to delete. If not, just logoff and then back on and
you should be able to kill that pesky thing.

HTH

RF


Posted by Steven Andrade on October 7th, 2007


On Sat, 06 Oct 2007 22:13:03 GMT, RF <RF@Den.con> wrote:


By "working drive" do you mean the one that has the OS and the folder Program
Files on it?

There are billions of files in Program Files and many more in Documents and
Settings. After Microsoft decided multi-users is common (hah!) they moved the
regular My Documents into documents and Setings and have a set of folders for
each account on the machine

Posted by Hunt on October 7th, 2007


In article <13gfco9ifdpg65@corp.supernews.com>, rcrowley@xp7rt.net says...
As Richard states, chances are good that the extra space is in Recycle Bin. I
always just clean out that folder - have never tried to Delete it.

Another place to check - do you have Norton SystemWorks, or similar. Norton
will keep a ton of files, even if you Delete them from Recycle Bin. Others
might, as well. I use SystemWorks, but do not use their Recycle Bin, ever.
Check to see what you might have, that would also do a "recycle" sort of save.

Hunt


Posted by ushere on October 7th, 2007


another thought is if it's a 'manufacturers' pc, it might have a hidden
ghost of the system drive as backup...

leslie

Posted by Hunt on October 7th, 2007


In article <Ks1Oi.6547$H22.5661@news-server.bigpond.net.au>,
removethis.leslie.wand@gmail.com says...
Another good possibility. Hope the OP finds what and where the space is going
to.

Hunt


Posted by Don Stauffer in Minnesota on October 8th, 2007


On Oct 6, 11:08 am, "Richard Crowley" <rcrow...@xp7rt.net> wrote:
Yes, this is after emptying the recycle.


Posted by Richard Crowley on October 8th, 2007


"RF" wrote ...
The original question stated that the OP is using Win XP.

Yes, some files are held open by Windows itself.
There is also a method for marking files to delete upon
the next boot, but shouldn't have to resort to this for simple
disk cleanup of user files.



Posted by xeaglecrest@att.net on October 8th, 2007


Don Stauffer in Minnesota wrote:
Do a search by file size (1 GB or larger) and see if a bunch of stuff
shows up that you
thought was deleted.

Posted by Martin Heffels on October 11th, 2007


On Mon, 08 Oct 2007 20:48:53 GMT, xeaglecrest@att.net wrote:

Hopping on board a bit late here, and can't see the whole thread, so maybe
this has been suggested: make sure you got the latest version of your BIOS
installed. There used to be problems with BIOS'S causing large disksizes to
be read incorrectly.
Further, searh for "*.tmp" and "~*.*" to find temporary-files which might
not have been deleted. Another one is, if you render a lot while checking
your material, all the older renders are kept on your hard-disk.
Cleaning-out your render-queue helps as well (but you will loose your
renders).

cheers

-martin-
--
Official website "Jonah's Quid" http://www.jonahsquids.co.uk

Posted by Gene E. Bloch on October 11th, 2007


On 10/11/2007, Martin Heffels posted this:
And here's another thought to add to this thread:

The disk storage for a file is allocated in fixed size units called
allocation units or clusters (there may be other names I'm unaware of).
Any left-over space in the last cluster of a file is lost, in that it
will never be used for any other data. Basically, you could say that
when measured (allocated) in clusters, the file size is always rounded
up.

This means that if the cluster is 32KB and the file length is 12 times
32 KB plus one byte, the allocated space is 13 clusters, and 32767
bytes of the 13th cluster are not used.

In some info displays, e.g. file properties in Windows Explorer, the
file size is reported like this:

Size: 223 bytes (223 bytes)
Size on disk: 4.00 KB (4,096 bytes)

The above is copied and pasted from the right-click properties box for
one of my files chosen at random (I'm using NTFS).

The size on disk is not normally diplayed in the regular Explorer
window.

OK, last step: imagine that you have a large cluster size (typical in
FAT32) and a thousand small files, each one wasting 31 KB. The reported
total file size is 1,000 KB; the actual space used is 32,000 KB.

I have no idea if this applies to the OP's situation; typically the
wastage averages out to not too much.

Oh yes - I believe there are free downloadable utilities that will
compute the wastage for a specific partition. IIRC, "wastage" is more
normally called "slack", if you care to Google for such a program.

--
Gene E. Bloch (Gino)
letters617blochg3251
(replace the numbers by "at" and "dotcom")



Posted by Frank on October 11th, 2007


On Thu, 11 Oct 2007 11:12:01 -0700, in 'rec.video.desktop',
in article <Re: Finding REALLY hidden files?>,
Gene E. Bloch <spamfree@nobody.invalid> wrote:


Not to be picky, but slack space is slightly different than the space
lost due to space being allocated in terms of clusters.

Virtually all hard disk drives use, at the physical level, a sector
size of 512 bytes (newer standards with larger sector sizes have been
proposed, but aren't yet in common use). Because of this, the drive
itself always reads and writes data in terms of sectors. So, if you
have a file whose length isn't an exact multiple of 512 bytes, that
wasted space within that last, partially used, sector of the file is
called slack space.

Example: a file that is one byte in length will still consume 512
bytes (one sector) on disk, even if the cluster size happens to also
be 512 bytes. In that case, the slack space is 511 bytes.

That's the worse case scenario, of course. A file which is 511 bytes
in length would only have slack space of one byte.

Slack space has nothing to do with space wasted due to having a large
number of small files on a partition that's been defined as having a
large cluster size (allocation unit size). I have seen partitions with
many thousands, even tens of thousands, of small files, where the
cluster size was 32 kB, thus causing a *lot* of wasted space on the
partition. This is an example of where it would have been more
efficient, from a space utilization viewpoint, of using a small, say 4
kB, cluster size when creating the partition.

There are programs on the market which, for security reasons, can
erase (write over) slack space at the end of files so that that data
can't be recovered. Sometimes interesting things can be found in slack
space.

--
Frank, Independent Consultant, New York, NY
[Please remove 'nojunkmail.' from address to reply via e-mail.]
Read Frank's thoughts on HDV at http://www.humanvalues.net/hdv/
(also covers AVCHD and XDCAM EX).

Posted by Gene E. Bloch on October 11th, 2007


On 10/11/2007, Frank posted this:
However, the programs I have run that report the space wasted due to
unfilled clusters always called the space in question "slack space".

Also think of this: if the cluster size is 32 KB (and under FAT32 I
*have* had drives with clusters that big) and you create a file of
length one byte, it is not just the 511 bytes in the first sector that
are lost to further use, it is also the 512 bytes in each of the other
63 physical sectors, for a total wastage of 32767 bytes. For wastage,
I'm *far* more interested in that number than in the 511. I'm also
*far* more interested in erasing all 32767 bytes when I care about
security holes...

That is true in the Windows and DOS file systems I have used. If there
is a file system that will assign the unused sectors of a cluster to
other files, I have never experienced it, although I suspect some of
the disk-compression schemes of the bad old days might have done that.
(Hmm - I seem to have forgotten the name of the compression software
that I used for a while back then.) Even so, whatever happened
internally, the API always presented normal clusters to the software.

--
Gene E. Bloch (Gino)
letters617blochg3251
(replace the numbers by "at" and "dotcom")



Posted by Frank on October 12th, 2007


On Thu, 11 Oct 2007 16:43:25 -0700, in 'rec.video.desktop',
in article <Re: Finding REALLY hidden files?>,
Gene E. Bloch <spamfree@nobody.invalid> wrote:

Yes, there are programs that do this. I don't have a major problem
with programs doing that, especially when they're not taking into
account the wasted bytes within the last sector of most files.

Also, most regular users seem unaware of the 512 byte sector size and
what that potentially means in terms of what gets written to disk when
they save a file. It usually means that whatever happened to be in the
buffer prior to the current write operation is what will end up in
those last few bytes of the sector. Even if we assume an average of
256 bytes unused in that last sector, 256 bytes can hold multiple file
names, e-mail addresses, a Web or FTP URL, even a small GIF image file
.... things that might be difficult to explain under certain
circumstances.

Any decent sector editor program will allow you to view this data.

Correct.

Of course, but we have nothing to hide.

NTFS is a bit different from FAT file systems in that under NTFS small
files are stored directly within the MFT (Master File Table) for
improved access times. Keeping the metadata and the filedata (data
set) close together speeds up access.

DoubleSpace and DriveSpace were two commonly used Microsoft
compression schemes, as was Stacker from Stac Electronics. There were
others as well, but I never used any of them, not being willing to
suffer the performance penalty due to compression/decompression of the
data, not to mention the implications involved in moving compressed
drives from one system to another - where the target system for the
move might not be equipped with the compression software.

Yes, for it would have been confusing, at least to the average user,
if it didn't.

--
Frank, Independent Consultant, New York, NY
[Please remove 'nojunkmail.' from address to reply via e-mail.]
Read Frank's thoughts on HDV at http://www.humanvalues.net/hdv/
(also covers AVCHD and XDCAM EX).

Posted by Don Stauffer in Minnesota on October 15th, 2007


On Oct 6, 9:19 pm, no...@hunt.com (Hunt) wrote:
Ah!! Yes, we have been using Norton. We are about to switch anyway.
Many of the big video files were "too big for the recycle bin," Norton
told us. It said that if we deleted it it would be gone and
unrecoverable. So we assumed it was really gone!

So how do we erase these bigger files so they are really gone (without
reformating drive)?



Similar Posts