Disapperaing hard disk space...

Seems like a virus or rootkit, but… I am having an issue with a server with disk space disappearing into nowhere. On the data partition (drive D) of the SBS 2003 server, every day ~1GB of disk space gets eaten up. This even happens on the weekends when no one is on the office using the system. Also, I cannot find any files or folders that are increasing in size. Out of 193GB, drive D now has 70GB remaining. However, when I do a folder-by-folder audit, only 9.5GB is used on drive D (unhiding all files first). I have even tried tools like DiskTective and TreeSize to find where the space is but with no new finds, they both report 9.5GB in files but only 70GB out of 193GB available on disk. The paging file is stored on drive C, Exchange badmail is not growing in size… I'm lost for an explanation. The only other thing that I noted is that the AutoProtect setting of Symantec Endpoint Protection on the server reports a malfunction. However, a full system scan reveals nothing. Last weekend I disconnected the DSL modem from the network and the space stabilized / stopped decreasing for that time period. So it looks like whatever is happening is somehow Internet related. I have run many AV programs, rootkit detectors, malware detectors, and the like - all with no hits. First, I would like to find what is using my drive space but cannot find any related files. Does anyone know of software to perform a more comprehensive audit? Then, I need to find whatever is eating the space and stop it. I do not know where to look next. Ideas? Thanks!

Hello and

Generally we don't offer assistance for malware removal on servers.

You have been unable to find anything malware related in your scans so this may well not be related to any malware.

I suggest you start a thread in our NETWORKING forum and let our expert tech gurus guide you.

I will close this topic and If malware IS discovered the techs will request you start a new topic back in this forum
In the meantime the techs will want answers to these questions:

Do you have automatic backups set on the machine?

Do you have a disk image .iso system for automatic or incremental backups?
Something like Acronis or Norton Ghost?
either could be gobbling large chunks of space.
If so, you "should" be backing up the images to an external HD.

How about any other backup solutions?

Are other machines in the network using the server as a destination for their own workstation backup solution. (sending .iso image of the remote machine to the central server)

Thanks all for the help. I did find and address the symptoms, but not the cause… yet. It turned out that the System Volume Information folder on the drive was filling with files (all with the same GUID name) at the rate of about 1.2GB per day. These files write themselves out at about the same time daily and I can see them growing throughout the day too. So, I am guessing that you are on the right track with backup/imaging being the culprit. However, nothing of this type is running. To bandaid the problem, I executed a commend on the folder (vssadmin) that allows a limit to be placed on maximum size. At least the growth is under control for the moment until I find the issue. I appreciate the time! Thank you

Hi Keoni

I will move this topic to our NETWORKING forum and let our expert techs offer some assistance.

They may well have more answers for you

CB

Hello, I was not able to reply in the malware forum. I wish to state that i am not a malware expert and if this is a malware issue I may not advise you. (you would not want my advise)
I feel that the issue is in fact with the back up software.
Here http://windirstat.info/ is a website that can help find where the space has gone.
Check the page file size.
But it sounds like there is another partition. This would not show up in a scan as the scans look in the logical drive, not the physical drive.
The user needs to look in disc managment for all of the logical drives.
Also (and most important) In SERVER MANAGMENT the user needs to use MONITORING AND REPORTING managment component to look for changes made to a partition, changes made to the page file, anything related to the back up software, and any remote log ons or unusual internet activity.
The easy fix would be to take a snapshot (ghost, Acronis true image) and than format the drive and restore the image.
If there is something in the registry that is running a program on a hidden partition there will be an error messege that the program can not be found. This would give a clue.
I believe that the back up software has malfunctioned and is doing complete back ups on a hidden partition.

Thanks all for the help. I did find and address the symptoms, but not the cause… yet. It turned out that the System Volume Information folder on the drive was filling with files (all with the same GUID name) at the rate of about 1.2GB per day. These files write themselves out at about the same time daily and I can see them growing throughout the day too. So, I am guessing that you are on the right track with backup/imaging being the culprit. However, nothing of this type is running.

To bandaid the problem, I executed a commend on the folder (vssadmin) that allows a limit to be placed on maximum size. At least the growth is under control for the moment until I find the issue.

I appreciate the time!

Thank you

This indicates an issue with shadow copy . The only way to turn shadow copy off is to turn off system restore (not a great idea)
You can try to reset shadow copy by turning system restore on and off. You can regain disc space this way as well as the number of restore points increases disc space usage.
If, big if, you have a mirrored raid you may be able to turn off system restore permanently, but I really do not recommend this.