• Windows
  • Explorer

The folders add up to less than the drive says is used

Seven reasons Explorer and the drive disagree, from folders it silently skips to space that belongs to no folder at all.

7 min read

Select everything on C, look at the size, and it comes to 180 GB. Right click the drive and Windows says 240 GB in use. Sixty gigabytes have to be somewhere, and the gap is almost always made of the same few things.

The seven, roughly in order of size

Where it isWhy Explorer misses it
Other users' foldersYou cannot read them, so they are skipped silently
System Volume InformationAccess denied even as an administrator
pagefile.sys, hiberfil.sys, swapfile.sysHidden system files, gigabytes each
The Recycle Bin, per driveNot counted as a folder in the selection
The component storeHard links counted more than once, which inflates rather than hides
Cluster slackThousands of small files each rounding up
Alternate data streams and sparse filesReported differently from what they occupy

Counting it properly, once

# Elevated PowerShell. The top level of C, largest first.
Get-ChildItem C:\ -Force -Directory -EA SilentlyContinue | ForEach-Object {
  $s = (Get-ChildItem $_.FullName -Recurse -Force -File -EA SilentlyContinue |
        Measure-Object Length -Sum).Sum
  [PSCustomObject]@{ GB = [math]::Round($s/1GB,2); Path = $_.FullName }
} | Sort-Object GB -Descending | Select-Object -First 15

# The single files that belong to no folder
Get-Item C:\pagefile.sys, C:\hiberfil.sys, C:\swapfile.sys -Force -EA SilentlyContinue |
  Select-Object Name, @{n='GB';e={[math]::Round($_.Length/1GB,2)}}

Two things matter here. Elevated, so the walk is not silently short by whatever it could not open. And -Force, so hidden and system files are included, which is where several of the largest items are.

The snapshot problem, which is the usual answer

On a machine with System Protection on, tens of gigabytes can sit inside System Volume Information as shadow copies. Nothing you can open accounts for it, and vssadmin list shadowstorage from an elevated prompt is the only place the real figure appears.

The over-counting direction

The gap also runs the other way. A naive walk of C:\Windows\WinSxS reported 11,831 MB on a machine where the component store actually occupied 6.23 GB, because the store is built from hard links and the same bytes get counted once per name. Any tool that adds up file sizes does this, including the commands above.

So a folder total larger than expected is not automatically wasted space, and the difference between what a file reports and what it occupies has its own page: size against size on disk.

What to do about the remainder

  1. Empty the Recycle Bin on every drive, not just C. Each drive has its own.
  2. Check the page file and hibernation file against the memory in the machine.
  3. Read the shadow copy figure from an elevated prompt, and cap it rather than deleting it.
  4. Look in the other user profiles, if you are entitled to.
  5. Accept a few percent of unexplained space. Metadata, the journal and slack are real and are not recoverable.

If the total is still wrong after all of that, the starting point is what is actually filling the C drive, which works through the folders in the order they are usually large.

Common questions

Why does Windows say my drive is fuller than my files?

Because Explorer skips what it cannot read and hides system files. Other users' profiles, System Volume Information, the page file, the hibernation file and each drive's Recycle Bin are the usual difference.

How do I find hidden space on a Windows drive?

Run an elevated PowerShell walk of C with -Force, so hidden and system files are included, and read shadow copy usage separately with vssadmin list shadowstorage.

Can folder sizes be larger than the real usage?

Yes. WinSxS is built from hard links, so adding up file sizes counts the same bytes repeatedly. One machine measured 11,831 MB by walking the folder against 6.23 GB actually in use.

Is some unaccounted disk space normal?

A few percent is. File system metadata, the change journal and cluster slack occupy real space and are not something you can reclaim.

Read next