Windows 2019: can't figure out why my drive is full

Solution 1:

You could try WizTree (wiztreefree.com), which is similar to WinDirStat but it bypasses the filesystem driver and reads the MFT directly if run as an administrator. It will show space taken by alternate data streams, metadata files ($MFT, $Secure, $BadClus, etc.), and directories you don't have access to. It doesn't appear to show space allocated for directory indexes, and it may miss some other things, but I wouldn't be surprised if the culprit does show up.

Solution 2:

I couldn't edit my comment any longer so I post it as an answer.

I've met once such an incident: It was due to Alternate Data Streams, a feature of NTFS for classic MacOS compatibility in shared folders. Unfortunately this ill-fated feature can be used for malicious purposes. In simple terms, it can be used to fill up your disk but the reserved space cannot be located, as in your case. If you want to check on this, I suggest MS sysinternals tool, streams.

Just beware that there are used in some legitimate cases, for example MS SQL server prior to 2014 uses them.

---

Solution 3:

The default permissions on C:\System Volume Information are NT AUTHORITY\SYSTEM:(OI)(CI)F. This means that even when you Run as Administrator you can't normally see files in it. You can use e.g. psexec to launch an application under the Local System account, which will then allow WinDirStat et. al. to display everything, or you can use it to add Administrators to the ACL. In particular, if you are using Previous Versions then the volume shadow copies are stored within this directory, and these can get quite large.