Solved Ghost files

kelper · May 4, 2025

File Explorer says that 72GB is used on my C: drive but Hasleo and Macrium both say there are only 55GB of files to backup. I know these programs ignore the page file and the hibernation file, but these make up only 4GB. I do not use System Restore.
I have done a 'repair install using Windows Update' and I have used Disk Clean-up to delete the Windows.old folder.
After a reboot File Explore now says 60GB.

I have checked for any old restore points and cleaned the component store.

There must be an easier way?

hsehestedt · May 4, 2025

I would have to wonder if there is space being used by VSS.

vssadmin list shadowstorage

kelper · May 4, 2025

There was but I cleaned that too and forgot to mention it. Any way the numbers now match for Macrium and File Explorer.

LittleFox2024 · May 4, 2025

There could be what are called alternate data streams.

Heres a Video from a YouTuber named ThioJoe who knows a lot about Windows. Not sure if this is the issue, but it might be worth a look.

hsehestedt · May 4, 2025

LittleFox2024 said:
There could be what are called alternate data streams.

Heres a Video from a YouTuber named ThioJoe who knows a lot about Windows. Not sure if this is the issue, but it might be worth a look.

That's an interesting thought. However, I have never seen any alt data streams that are more than a few bytes - although it is certainly possible for them to be bigger.

You ever download a file and when you look at the properties you see a checkbox to unblock the file? It is an alternate data stream that triggers that.

I have a batch file that scans every file and deletes alt data streams. Only takes a few seconds.

kelper · May 4, 2025

The Alternate Data Streams totalled 45Mb so I will ignore them.

kelper · May 4, 2025

To determine how many bytes are used by all alternate data streams (ADS) on your system, you can use Sysinternals’ streams.exe tool with a bit of scripting to tally the sizes.

Step-by-Step (using streams.exe)
Download streams.exe from Microsoft:

Streams - Sysinternals

Reveal NTFS alternate streams.

learn.microsoft.com

Open Command Prompt (as Administrator).

Run the following command to scan an entire drive (e.g., C:) and save the output:

streams -s C:\ > ads_report.txt

and then

Select-String -Path C:\ads_report.txt -Pattern ":\S+:\S+\s+\d+" | ForEach-Object {
if ($_ -match ":\S+:\S+\s+(\d+)$") { [int]$matches[1] }
} | Measure-Object -Sum

hsehestedt · May 4, 2025

kelper said:
The Alternate Data Streams totalled 45Mb so I will ignore them.

While that's not a lot in the scheme of things, that's more than I have ever seen on any of my machines. But then again, that's probably because I keep after them and clear out all the alternate data streams every now and then.

Solved Ghost files

kelper

Well-known member

My Computers

System One System Two

hsehestedt

Well-known member

My Computers

System One System Two

kelper

Well-known member

My Computers

System One System Two

LittleFox2024

Member

My Computer

System One

hsehestedt

Well-known member

My Computers

System One System Two

kelper

Well-known member

My Computers

System One System Two

kelper

Well-known member

Streams - Sysinternals

My Computers

System One System Two

hsehestedt

Well-known member

My Computers

System One System Two

Similar threads

Latest Support Threads

Latest Tutorials