Re: PSA: Windows shadow storage can silently consume all free disk space

Maria Sophia wrote:
> I checked all the normal places to clean up disk space. Anything I deleted
> kept the disk below limits for only a few minutes. Then the disk filled up
> again. I looked in all the usual spaces for the usual culprits (which I cal
> list separately in a followup article so others also know where to look).

While this PSA describes a Windows shadow-storage setting that can quietly 
consume remaining disk space & how to correct it with a single command, 
below is a list of the classic places to check for storage hogs (AFAIK).

These are ranked (by me) by likelihood & impact (risk for mass deletion):

Impact = how large it can get (which can be safely deleted, IMHO)
Risk   = how dangerous it is to delete or modify (low, medium, high, IMHO)

HIGH IMPACT (can consume tens or hundreds of GB)
Windows Installer cache (MSI/MSP) [H]
  C:\Windows\Installer

Windows Search index database [M]
  C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb

DriverStore (FileRepository) [H]
  C:\Windows\System32\DriverStore\FileRepository

Hyper-V virtual disks [L]
  %PUBLIC%\Documents\Hyper-V\Virtual Hard Disks

Docker / WSL2 virtual disks [L]
  %LOCALAPPDATA%\Docker
  %LOCALAPPDATA%\Packages\CanonicalGroupLimited*

VirtualBox VMs [L]
  %USERPROFILE%\VirtualBox VMs

VMware VMs [L]
  %USERPROFILE%\Documents\Virtual Machines

Paging file (pagefile.sys) [H]
  C:\pagefile.sys

System memory dump (MEMORY.DMP) [L]
  C:\Windows\MEMORY.DMP

MEDIUM IMPACT (can grow large)
Windows Update working folder [M]
  C:\Windows\SoftwareDistribution

Windows Installer rollback backups [M]
  C:\Windows\Installer\$PatchCache$
  C:\Windows\Installer\*.rbs
  C:\Windows\Installer\*.rbf

System Restore snapshots [M]
  C:\System Volume Information

Windows Event Logs [M]
  C:\Windows\System32\winevt\Logs

Hibernation file (hiberfil.sys) [H]
  C:\hiberfil.sys

LOW IMPACT (common, small, safe to delete)
User temp files [L]
  %temp%

System temp files [L]
  C:\Windows\Temp

Extra temp folders [L]
  %LOCALAPPDATA%\Temp
  C:\Temp

Crash dumps (apps and services) [L]
  %LOCALAPPDATA%\CrashDumps
  C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps

Windows Error Reporting [L]
  %LOCALAPPDATA%\Microsoft\Windows\WER
  %PROGRAMDATA%\Microsoft\Windows\WER

Browser caches [L]
  %LOCALAPPDATA%\Microsoft\Edge\User Data
  %LOCALAPPDATA%\Google\Chrome\User Data
  %APPDATA%\Mozilla\Firefox\Profiles

Windows Update download cache [L]
  C:\Windows\SoftwareDistribution\Download

Delivery Optimization cache [L]
  C:\Windows\SoftwareDistribution\DeliveryOptimization

Microsoft Store / UWP data [L]
  %LOCALAPPDATA%\Packages

Package Cache (VS, .NET, etc.) [L]
  C:\ProgramData\Package Cache

CBS and DISM logs [L]
  C:\Windows\Logs\CBS
  C:\Windows\Logs\DISM

Application logs [L]
  C:\ProgramData\*\Logs
  %LOCALAPPDATA%\*appname*\Logs

Windows.old (rollback) [L]
  C:\Windows.old

Setup logs [L]
  C:\Windows\Panther
  C:\Windows\inf\setupapi.dev.log

WPR traces [L]
  %LOCALAPPDATA%\Microsoft\Windows\WPR

Reliability Monitor [L]
  C:\ProgramData\Microsoft\RAC\PublishedData

Media Player thumbnails [L]
  %LOCALAPPDATA%\Microsoft\Media Player

Old .etl logs [L]
  C:\Windows\System32\LogFiles\WMI
  C:\Windows\System32\LogFiles\NetSetup

Delivery Optimization logs [L]
  C:\ProgramData\Microsoft\Windows\DeliveryOptimization

Windows Defender history [L]
  C:\ProgramData\Microsoft\Windows Defender

Prefetch [L]
  C:\Windows\Prefetch

Crashpad dumps [L]
  %LOCALAPPDATA%\Crashpad

Large app caches (Adobe, Unity, Steam) [L]
  %APPDATA%\Adobe
  %LOCALAPPDATA%\Unity
  %LOCALAPPDATA%\Steam
  %PROGRAMDATA%\Steam

Shader caches [L]
  %LOCALAPPDATA%\Steam\htmlcache
  %LOCALAPPDATA%\NVIDIA\DXCache
  %LOCALAPPDATA%\NVIDIA\GLCache

Driver installer caches [L]
  C:\NVIDIA
  C:\AMD
  C:\Intel

Useful commands

Disk Cleanup:
  cleanmgr

Remove superseded updates:
  dism /online /cleanup-image /startcomponentcleanup

Show largest folders under C:  
  powershell -c "gci C:\ -Directory | sort length -desc | ft name,length"

Show largest files on the entire drive  
  powershell -c "gci C:\ -Recurse -File -ea SilentlyContinue | sort length
-desc | select -first 20 | ft length,fullname -auto"

Show largest folders under a specific path  
  powershell -c "gci 'C:\path' -Directory | % { $_.FullName; gci
$_.FullName -Recurse -File | measure length -sum }"

Check shadow storage usage  
  vssadmin list shadowstorage /for=C:

Resize shadow storage to a sane limit  
  vssadmin resize shadowstorage /for=C: /on=C: /maxsize=5GB

Show disk usage by folder (PowerShell 5+)  
  powershell -c "gci C:\ -Directory | % { '{0,10:N2} GB  {1}' -f ((gci
$_.FullName -Recurse -File | measure length -sum).sum/1GB), $_.FullName }"

Show Windows Update download cache size  
  powershell -c "(gci C:\Windows\SoftwareDistribution\Download -Recurse
-File | measure length -sum).sum/1GB"

Clear Windows Update download cache  
  net stop wuauserv & net stop bits & rd /s /q
C:\Windows\SoftwareDistribution\Download & net start wuauserv & net start
bits

Show size of the Windows Search index  
  powershell -c "(gci
'C:\ProgramData\Microsoft\Search\Data\Applications\Windows' -Recurse -File
| measure length -sum).sum/1GB"

Show size of DriverStore  
  powershell -c "(gci C:\Windows\System32\DriverStore\FileRepository
-Recurse -File | measure length -sum).sum/1GB"

Show size of pagefile and hibernation file  
  dir C:\pagefile.sys  
  dir C:\hiberfil.sys

Show size of MEMORY.DMP  
  dir C:\Windows\MEMORY.DMP

Show size of Windows.edb  
  dir
"C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb"

Show size of System Volume Information (admin only)  
  dir "C:\System Volume Information"

Show size of event logs  
  powershell -c "gci C:\Windows\System32\winevt\Logs | sort length -desc |
select -first 20 | ft name,length"

Show size of CBS.log  
  dir C:\Windows\Logs\CBS\CBS.log

Show size of DISM logs  
  dir C:\Windows\Logs\DISM

Show size of Windows.old  
  dir C:\Windows.old

Show size of a folder (quick)  
  powershell -c "(gci 'C:\path' -Recurse -File | measure length
-sum).sum/1GB"

Confirm whether something is currently exploding in size
 Win+R > resmon > Disk > [sort by] Total (B/sec)
 Look for something like... 
  SearchIndexer.exe > Windows.edb corruption
  svchost.exe (netsvcs) > Windows Update stuck
  OneDrive.exe > sync loop
  MsMpEng.exe > Defender logs
  chrome.exe > runaway cache
  System > pagefile or memory dump
  TiWorker.exe > update cleanup
  vmwp.exe > Hyper-V checkpoint explosion
  vmmem > WSL2 disk expanding
  etc.

In addition, I've written system-specific scripts, which check my own
system (since I employ a highly-organized structure) for size hogs.
-- 
These are learned by experience, & hence I would want others to benefit.