# How to Find What Is Eating Your C: Drive in Windows: PeakInspector, WizTree and Built-in Tools > AI Release · @ai_release1 · https://ai-release.org/guides/kak-nayti-chto-zanimaet-mesto-na-diske-c-v-windows-peak_en.html ## TL;DR - **Time to complete:** 30–45 minutes (a full C: scan on a large drive can add 5–10 minutes) - **Difficulty:** Basic — every command below runs from an elevated prompt, no scripting skills needed - **You will need:** Windows 10 or Windows 11 with an administrator account; built-in Disk Cleanup (`cleanmgr`), Settings → Storage, PowerShell, `DISM`; a third-party scanner — WizTree and PeakInspector. For versions, supported builds, licence terms and installer size of both third-party tools, **check the vendor documentation** — no verified version data is available in the source material for this guide. ## Requirements and setup ![Illustration: Requirements and setup](https://ai-release.org/guides/img/kak-nayti-chto-zanimaet-mesto-na-diske-c-v-windows-peak-en-1.jpg?v=1794300330) Prepare the machine before scanning. A scan run without administrator rights silently skips protected system folders, which is exactly where the biggest blocks usually hide. - Windows 10 or Windows 11, fully booted (not in Safe Mode). - An account in the local **Administrators** group. Windows will show a User Account Control prompt — accept it. - Enough free space for the scanners themselves; **check the vendor documentation** for installer size and requirements. - One extra step: close large apps (Outlook, Docker, virtual machines). Open files are reported as "in use" and some cleanup targets stay locked. **What to do:** open an elevated PowerShell (right-click Start → *Terminal (Admin)* or *Windows PowerShell (Admin)*) and record the current state of the drive. **Why:** without a "before" number you cannot tell whether your cleanup actually worked. ```powershell Get-Volume -DriveLetter C | Format-List DriveLetter, FileSystemLabel, Size, SizeRemaining ``` Example output (your numbers will differ): ``` DriveLetter : C FileSystemLabel : Windows Size : 511000000000 SizeRemaining : 41000000000 ``` **How to check:** the command returns a single block with `Size` and `SizeRemaining`. Write both numbers down — this is your baseline. If the command fails with `Get-Volume : Access denied`, you are not elevated. Checklist before you continue: - [ ] Elevated PowerShell session open - [ ] `Size` and `SizeRemaining` from `Get-Volume` recorded - [ ] Third-party scanners downloaded from the vendor's official page only - [ ] Large applications closed ## Step 1. Build a baseline with built-in Windows tools Built-in tools answer three questions: how much is free, which top-level folder is fat, and how much is consumed by shadow copies and the component store. **What to do:** measure space with three commands. **Why:** each one targets a different consumer — user files, System Restore snapshots, and the WinSxS component store (WinSxS is the folder where Windows keeps every version of system components so updates can be rolled back). ```cmd fsutil volume diskfree C: ``` Expected output: ``` Total free bytes : 41000000000 (38.2 GB) ``` ```cmd vssadmin list shadowstorage ``` Expected output contains a line such as `Used Shadow Copy Storage space: 12.4 GB`. Shadow copies are System Restore points and file-history snapshots; they count against C: but are invisible in File Explorer. ```cmd DISM /Online /Cleanup-Image /AnalyzeComponentStore ``` Expected output includes `Actual Size of Component Store :`, `Number of Reclaimable Packages :` and `Component Store Cleanup Recommended : Yes|No`. For a folder-level view, run this PowerShell loop (it walks the disk file by file, so expect it to take several minutes): ```powershell Get-ChildItem C:\ -Directory -Force -ErrorAction SilentlyContinue | ForEach-Object { $s = (Get-ChildItem $_.FullName -Recurse -File -Force -ErrorAction SilentlyContinue | Measure-Object Length -Sum).Sum [pscustomobject]@{ Folder = $_.FullName; GB = [math]::Round($s/1GB,2) } } | Sort-Object GB -Descending | Select-Object -First 15 ``` Example output: ``` Folder GB ------ -- C:\Windows 28.41 C:\Users 19.07 C:\Program Files 11.52 C:\ProgramData 3.88 ``` Also list the hidden system files sitting in the root of C: — they never appear in Explorer with default settings: ```cmd dir C:\ /a ``` You will see entries such as `hiberfil.sys`, `pagefile.sys` and `swapfile.sys` with their sizes. **How to check:** you now have three numbers — free space, shadow-copy usage, component-store size — that together should roughly explain the gap between "Size" and "SizeRemaining". If they do not, files are hiding somewhere the loop could not read (permissions, junctions), which is the case Step 2 solves. ## Step 2. Run a deep scan with WizTree and PeakInspector ![Illustration: Step 2. Run a deep scan with WizTree and PeakInspector](https://ai-release.org/guides/img/kak-nayti-chto-zanimaet-mesto-na-diske-c-v-windows-peak-en-2.jpg?v=1794300337) Third-party scanners index the whole volume in one pass instead of walking folder by folder, so they finish in seconds and see files that PowerShell's loop skips. The trade-off is that you must trust their numbers — verify them against the baseline from Step 1. **What to do:** install both tools, run each **as administrator**, select the C: volume, start the scan, then sort the result by size and expand the top entry until you reach individual files. **Why:** a sorted, drillable tree turns "C: is full" into "this specific folder on this specific path holds N GB", which is the only form of the problem you can act on. **Example:** the scan finishes with a treemap in which one block dominates. Click it, and the file list shows something like `C:\Windows\Installer` or `C:\Users\\AppData\Local\Docker`. Note the exact path and size — you will cross-check it in the table below. Cross-check rule: compare the total scanned size reported by each tool with `Get-Volume`. Differences are normal and usually come from hard links (one file counted twice under two names), junction points, NTFS compression and files locked by the system. If one tool reports dramatically less than the other, it was not elevated. For WizTree, confirm the current feature set, licence and Windows build support on the vendor page — the scanner's internals are not documented in our source material. For PeakInspector, the same applies: **no verified data on its scan engine, licensing or supported builds is available here — check the vendor documentation before relying on its numbers.** Use the scan result to pick an action: | What the scan shows | Why it grows | Safe action | |---|---|---| | `C:\Windows\WinSxS` dominates | Component store keeps backups of every update | `DISM /Online /Cleanup-Image /StartComponentCleanup` | | `C:\Windows.old` present | Previous Windows installation left after an upgrade | Disk Cleanup → "Previous Windows installation(s)" | | `hiberfil.sys` in the root | Hibernation file, sized from installed RAM | `powercfg /h off` (disables hibernation and Fast Startup) | | `pagefile.sys` in the root | Paging file managed by Windows | System Properties → Advanced → Performance → Virtual memory | | `AppData\Local\Temp` large | Installers and apps never clean up | Storage Sense or manual deletion | **How to check:** the top three entries in the scanner's list together should account for most of the used space, and their total should be within a few GB of `Size` minus `SizeRemaining` from Step 1. If it is not, scroll to the bottom of the list and look for entries marked as junctions or links — they are duplicates, not real data. ## Step 3. Reclaim space and verify the result ![Illustration: Step 3. Reclaim space and verify the result](https://ai-release.org/guides/img/kak-nayti-chto-zanimaet-mesto-na-diske-c-v-windows-peak-en-3.jpg?v=1794300341) **What to do:** apply the cleanup actions from the table, one category at a time, and re-measure after each one. **Why:** running one action at a time tells you which action produced which gain — and stops you from deleting something you cannot name. Start with Windows-managed data: ```cmd DISM /Online /Cleanup-Image /StartComponentCleanup powercfg /h off ``` Then run Disk Cleanup with a pre-set profile so you control exactly what gets removed: ```cmd cleanmgr /sageset:1 ``` Tick the categories you recognise — `Previous Windows installation(s)`, `Windows Update Cleanup`, `Temporary files` — close the window, then execute the saved profile: ```cmd cleanmgr /sagerun:1 ``` For ongoing hygiene, enable Storage Sense: **Settings → System → Storage → Storage Sense → Turn on**, then set *Delete files in my recycle bin* and *Delete files in my Downloads folder* to your preferred retention period. If a recent Windows update is the reason C: shrank, the leftover payload and the post-update storage behaviour are covered in [Windows 11 26H2: common issues after update and how to fix them](https://ai-release.org/guides/windows-11-26h2-chastye-problemy-posle-obnovleniya-i-ka.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide). **How to check:** re-run the baseline command and compare. ```powershell Get-Volume -DriveLetter C | Format-List SizeRemaining ``` Example before/after: ``` Before: SizeRemaining : 41000000000 (~38 GB) After: SizeRemaining : 78000000000 (~72 GB) ``` Success looks like this: `SizeRemaining` increased, a fresh scan in WizTree or PeakInspector no longer shows the folder you targeted as a top-three entry, and `DISM /Online /Cleanup-Image /AnalyzeComponentStore` now reports `Component Store Cleanup Recommended : No`. If the number did not move, the files were locked — reboot and repeat the specific action. ## Troubleshooting **Problem. The folder-size loop prints errors for system folders and their real size is missing.** - Error: `Access to the path 'C:\System Volume Information' is denied.` - Cause: the PowerShell session is not elevated, or the folder is owned by SYSTEM and protected even for administrators. - Solution: reopen the terminal as administrator and re-run the loop with error suppression, which keeps the run going past protected paths: ```powershell Get-ChildItem C:\ -Directory -Force -ErrorAction SilentlyContinue | ForEach-Object { $s = (Get-ChildItem $_.FullName -Recurse -File -Force -ErrorAction SilentlyContinue | Measure-Object Length -Sum).Sum [pscustomobject]@{ Folder = $_.FullName; GB = [math]::Round($s/1GB,2) } } | Sort-Object GB -Descending | Select-Object -First 15 ``` `System Volume Information` will still be under-reported — that is expected; use `vssadmin list shadowstorage` for its real size. **Problem. The scanner shows a multi-gigabyte `pagefile.sys` or `hiberfil.sys`, but deleting it fails.** - Error: `The process cannot access the file because it is being used by another process.` - Cause: both files are held open by the kernel. They cannot be deleted as files at all — they must be switched off in the settings that create them. - Solution: for hibernation run `powercfg /h off` in an elevated prompt and reboot; the file disappears and hibernation plus Fast Startup stop working. For the paging file, open **System Properties → Advanced → Performance → Settings → Advanced → Virtual memory → Change**, untick *Automatically manage paging file size for all drives*, set C: to *No paging file* or a fixed size, then reboot. **Problem. Component-store cleanup aborts partway through.** - Error: `Error: 0x800f081f` - Cause: the component store is missing source payload it needs to complete the operation, usually after an interrupted update. - Solution: repair the store first, then retry the cleanup: ```cmd DISM /Online /Cleanup-Image /RestoreHealth DISM /Online /Cleanup-Image /StartComponentCleanup ``` If `RestoreHealth` also fails, the repair may require an in-place upgrade from installation media — the media and upgrade procedure are described in [How to Install Windows 11 26H2: Step-by-Step Guide with Official ISO](https://ai-release.org/guides/kak-ustanovit-windows-11-26h2-poshagovaya-instruktsiya.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide). Confirm current DISM behaviour for your build against Microsoft's documentation before running a repair. ## Summary and next steps You measured C: with `Get-Volume`, `vssadmin` and `DISM`, located the real consumers with a WizTree/PeakInspector scan, then removed them category by category and confirmed the gain against your baseline. Next, schedule a monthly rescan and turn on Storage Sense so the drive does not silently fill again. ## FAQ **Does WizTree delete files for me?** Treat any third-party scanner as read-only analysis and delete through Disk Cleanup, Settings → Storage or Explorer — that way every removal goes through a Windows mechanism that knows what the file is. Check the vendor documentation for what the current build does and does not offer. **Why do WizTree and File Explorer show different C: sizes?** Explorer reports allocated size and hides protected and system files, while a scanner reads the raw volume index. Hard links, junction points, NTFS compression and files locked by the system all produce legitimate differences. **Is it safe to delete the WinSxS folder?** No — never delete it manually. It contains the live system components, and removing it breaks Windows. The supported operation is `DISM /Online /Cleanup-Image /StartComponentCleanup`, which removes only superseded versions. **How often should I scan the drive?** Once a month, or immediately after a major Windows upgrade, when `C:\Windows.old` and update leftovers can add many gigabytes. Keep the `Get-Volume` baseline from each scan so you can spot a trend rather than a single number.