How to Find What Is Eating Your C: Drive in Windows: PeakInspector, WizTree and Built-in Tools
TL;DR
- Time to complete: 30–45 minutes (a full C: scan on a large drive can add 5–10 minutes)
- Difficulty: Basic — every command below runs from an elevated prompt, no scripting skills needed
- You will need: Windows 10 or Windows 11 with an administrator account; built-in Disk Cleanup (
cleanmgr), Settings → Storage, PowerShell,DISM; a third-party scanner — WizTree and PeakInspector. For versions, supported builds, licence terms and installer size of both third-party tools, check the vendor documentation — no verified version data is available in the source material for this guide.
Requirements and setup
Prepare the machine before scanning. A scan run without administrator rights silently skips protected system folders, which is exactly where the biggest blocks usually hide.
- Windows 10 or Windows 11, fully booted (not in Safe Mode).
- An account in the local Administrators group. Windows will show a User Account Control prompt — accept it.
- Enough free space for the scanners themselves; check the vendor documentation for installer size and requirements.
- One extra step: close large apps (Outlook, Docker, virtual machines). Open files are reported as "in use" and some cleanup targets stay locked.
What to do: open an elevated PowerShell (right-click Start → *Terminal (Admin)* or *Windows PowerShell (Admin)*) and record the current state of the drive.
Why: without a "before" number you cannot tell whether your cleanup actually worked.
Get-Volume -DriveLetter C | Format-List DriveLetter, FileSystemLabel, Size, SizeRemainingExample output (your numbers will differ):
DriveLetter : C
FileSystemLabel : Windows
Size : 511000000000
SizeRemaining : 41000000000How to check: the command returns a single block with Size and SizeRemaining. Write both numbers down — this is your baseline. If the command fails with Get-Volume : Access denied, you are not elevated.
Checklist before you continue:
- [ ] Elevated PowerShell session open
- [ ]
SizeandSizeRemainingfromGet-Volumerecorded - [ ] Third-party scanners downloaded from the vendor's official page only
- [ ] Large applications closed
Step 1. Build a baseline with built-in Windows tools
Built-in tools answer three questions: how much is free, which top-level folder is fat, and how much is consumed by shadow copies and the component store.
What to do: measure space with three commands.
Why: each one targets a different consumer — user files, System Restore snapshots, and the WinSxS component store (WinSxS is the folder where Windows keeps every version of system components so updates can be rolled back).
fsutil volume diskfree C:Expected output:
Total free bytes : 41000000000 (38.2 GB)vssadmin list shadowstorageExpected output contains a line such as Used Shadow Copy Storage space: 12.4 GB. Shadow copies are System Restore points and file-history snapshots; they count against C: but are invisible in File Explorer.
DISM /Online /Cleanup-Image /AnalyzeComponentStoreExpected output includes Actual Size of Component Store :, Number of Reclaimable Packages : and Component Store Cleanup Recommended : Yes|No.
For a folder-level view, run this PowerShell loop (it walks the disk file by file, so expect it to take several minutes):
Get-ChildItem C:\ -Directory -Force -ErrorAction SilentlyContinue | ForEach-Object {
$s = (Get-ChildItem $_.FullName -Recurse -File -Force -ErrorAction SilentlyContinue |
Measure-Object Length -Sum).Sum
[pscustomobject]@{ Folder = $_.FullName; GB = [math]::Round($s/1GB,2) }
} | Sort-Object GB -Descending | Select-Object -First 15Example output:
Folder GB
------ --
C:\Windows 28.41
C:\Users 19.07
C:\Program Files 11.52
C:\ProgramData 3.88Also list the hidden system files sitting in the root of C: — they never appear in Explorer with default settings:
dir C:\ /aYou will see entries such as hiberfil.sys, pagefile.sys and swapfile.sys with their sizes.
How to check: you now have three numbers — free space, shadow-copy usage, component-store size — that together should roughly explain the gap between "Size" and "SizeRemaining". If they do not, files are hiding somewhere the loop could not read (permissions, junctions), which is the case Step 2 solves.
Step 2. Run a deep scan with WizTree and PeakInspector
Third-party scanners index the whole volume in one pass instead of walking folder by folder, so they finish in seconds and see files that PowerShell's loop skips. The trade-off is that you must trust their numbers — verify them against the baseline from Step 1.
What to do: install both tools, run each as administrator, select the C: volume, start the scan, then sort the result by size and expand the top entry until you reach individual files.
Why: a sorted, drillable tree turns "C: is full" into "this specific folder on this specific path holds N GB", which is the only form of the problem you can act on.
Example: the scan finishes with a treemap in which one block dominates. Click it, and the file list shows something like C:\Windows\Installer or C:\Users\<your-name>\AppData\Local\Docker. Note the exact path and size — you will cross-check it in the table below.
Cross-check rule: compare the total scanned size reported by each tool with Get-Volume. Differences are normal and usually come from hard links (one file counted twice under two names), junction points, NTFS compression and files locked by the system. If one tool reports dramatically less than the other, it was not elevated.
For WizTree, confirm the current feature set, licence and Windows build support on the vendor page — the scanner's internals are not documented in our source material. For PeakInspector, the same applies: no verified data on its scan engine, licensing or supported builds is available here — check the vendor documentation before relying on its numbers.
Use the scan result to pick an action:
| What the scan shows | Why it grows | Safe action |
|---|---|---|
| `C:\Windows\WinSxS` dominates | Component store keeps backups of every update | `DISM /Online /Cleanup-Image /StartComponentCleanup` |
| `C:\Windows.old` present | Previous Windows installation left after an upgrade | Disk Cleanup → "Previous Windows installation(s)" |
| `hiberfil.sys` in the root | Hibernation file, sized from installed RAM | `powercfg /h off` (disables hibernation and Fast Startup) |
| `pagefile.sys` in the root | Paging file managed by Windows | System Properties → Advanced → Performance → Virtual memory |
| `AppData\Local\Temp` large | Installers and apps never clean up | Storage Sense or manual deletion |
How to check: the top three entries in the scanner's list together should account for most of the used space, and their total should be within a few GB of Size minus SizeRemaining from Step 1. If it is not, scroll to the bottom of the list and look for entries marked as junctions or links — they are duplicates, not real data.
Step 3. Reclaim space and verify the result
What to do: apply the cleanup actions from the table, one category at a time, and re-measure after each one.
Why: running one action at a time tells you which action produced which gain — and stops you from deleting something you cannot name.
Start with Windows-managed data:
DISM /Online /Cleanup-Image /StartComponentCleanup
powercfg /h offThen run Disk Cleanup with a pre-set profile so you control exactly what gets removed:
cleanmgr /sageset:1Tick the categories you recognise — Previous Windows installation(s), Windows Update Cleanup, Temporary files — close the window, then execute the saved profile:
cleanmgr /sagerun:1For ongoing hygiene, enable Storage Sense: Settings → System → Storage → Storage Sense → Turn on, then set *Delete files in my recycle bin* and *Delete files in my Downloads folder* to your preferred retention period.
If a recent Windows update is the reason C: shrank, the leftover payload and the post-update storage behaviour are covered in Windows 11 26H2: common issues after update and how to fix them.
How to check: re-run the baseline command and compare.
Get-Volume -DriveLetter C | Format-List SizeRemainingExample before/after:
Before: SizeRemaining : 41000000000 (~38 GB)
After: SizeRemaining : 78000000000 (~72 GB)Success looks like this: SizeRemaining increased, a fresh scan in WizTree or PeakInspector no longer shows the folder you targeted as a top-three entry, and DISM /Online /Cleanup-Image /AnalyzeComponentStore now reports Component Store Cleanup Recommended : No. If the number did not move, the files were locked — reboot and repeat the specific action.
Troubleshooting
Problem. The folder-size loop prints errors for system folders and their real size is missing.
- Error:
Access to the path 'C:\System Volume Information' is denied. - Cause: the PowerShell session is not elevated, or the folder is owned by SYSTEM and protected even for administrators.
- Solution: reopen the terminal as administrator and re-run the loop with error suppression, which keeps the run going past protected paths:
Get-ChildItem C:\ -Directory -Force -ErrorAction SilentlyContinue | ForEach-Object {
$s = (Get-ChildItem $_.FullName -Recurse -File -Force -ErrorAction SilentlyContinue |
Measure-Object Length -Sum).Sum
[pscustomobject]@{ Folder = $_.FullName; GB = [math]::Round($s/1GB,2) }
} | Sort-Object GB -Descending | Select-Object -First 15System Volume Information will still be under-reported — that is expected; use vssadmin list shadowstorage for its real size.
Problem. The scanner shows a multi-gigabyte pagefile.sys or hiberfil.sys, but deleting it fails.
- Error:
The process cannot access the file because it is being used by another process. - Cause: both files are held open by the kernel. They cannot be deleted as files at all — they must be switched off in the settings that create them.
- Solution: for hibernation run
powercfg /h offin an elevated prompt and reboot; the file disappears and hibernation plus Fast Startup stop working. For the paging file, open System Properties → Advanced → Performance → Settings → Advanced → Virtual memory → Change, untick *Automatically manage paging file size for all drives*, set C: to *No paging file* or a fixed size, then reboot.
Problem. Component-store cleanup aborts partway through.
- Error:
Error: 0x800f081f - Cause: the component store is missing source payload it needs to complete the operation, usually after an interrupted update.
- Solution: repair the store first, then retry the cleanup:
DISM /Online /Cleanup-Image /RestoreHealth
DISM /Online /Cleanup-Image /StartComponentCleanupIf RestoreHealth also fails, the repair may require an in-place upgrade from installation media — the media and upgrade procedure are described in How to Install Windows 11 26H2: Step-by-Step Guide with Official ISO. Confirm current DISM behaviour for your build against Microsoft's documentation before running a repair.
Summary and next steps
You measured C: with Get-Volume, vssadmin and DISM, located the real consumers with a WizTree/PeakInspector scan, then removed them category by category and confirmed the gain against your baseline. Next, schedule a monthly rescan and turn on Storage Sense so the drive does not silently fill again.
FAQ
Does WizTree delete files for me?
Treat any third-party scanner as read-only analysis and delete through Disk Cleanup, Settings → Storage or Explorer — that way every removal goes through a Windows mechanism that knows what the file is. Check the vendor documentation for what the current build does and does not offer.
Why do WizTree and File Explorer show different C: sizes?
Explorer reports allocated size and hides protected and system files, while a scanner reads the raw volume index. Hard links, junction points, NTFS compression and files locked by the system all produce legitimate differences.
Is it safe to delete the WinSxS folder?
No — never delete it manually. It contains the live system components, and removing it breaks Windows. The supported operation is DISM /Online /Cleanup-Image /StartComponentCleanup, which removes only superseded versions.
How often should I scan the drive?
Once a month, or immediately after a major Windows upgrade, when C:\Windows.old and update leftovers can add many gigabytes. Keep the Get-Volume baseline from each scan so you can spot a trend rather than a single number.
🤖 AI summary
- Updated: 2026-11-10
- Topics: что занимает место на диске C, как освободить место на диске C Windows 11, программа для анализа занятого места на диске, PeakInspector windows drive space finder
- Summary: Пошаговая инструкция: как просканировать диск, сравнить результаты с прошлым снимком, найти выросшие папки и безопасно освободить место без удаления системных файлов.
- Key facts:
- TL;DR Time to complete: 30–45 minutes (a full C: scan on a large drive can add 5–10 minutes) Difficulty: Basic — every command below runs from an elevated prompt, no scripting skills needed You will need: Windows 10 or Windows 11 with an administrator account; built-in Disk Cleanup ( cleanmgr ), Settings → Storage, PowerShell, DISM ; a third-party scanner — WizTree and PeakInspector.
- For versions, supported builds, licence terms and installer size of both third-party tools, check the vendor documentation — no verified version data is available in the source material for this guide.
- Requirements and setup Illustration: Requirements and setup Prepare the machine before scanning.
- A scan run without administrator rights silently skips protected system folders, which is exactly where the biggest blocks usually hide.
- Windows 10 or Windows 11, fully booted (not in Safe Mode).
- An account in the local Administrators group.