The 500GB System File That Eats Your Hard Drive

Something on your Windows 10 drive is consuming hundreds of gigabytes and the normal tools cannot find it. This guide identifies every known culprit — from hibernation files and shadow copies to runaway backups and the Windows component store — and tells you exactly what is safe to delete, what to leave alone, and what the commands actually do.

Known culprits for a mysteriously full Windows 10 drive — most are safe to address

100%

Of VSS shadow copy storage when limit is set to UNBOUNDED — a common cause of 200GB+ loss

0min

Time to find the exact offending file — WizTree scans a 1TB drive in under 10 seconds

221GB

Space recovered by one reader who found their VSS limit was set to UNBOUNDED — this is real

Introduction

Before You Delete Anything — Run a Disk Scanner First

The worst thing you can do with a mysterious large file on a Windows 10 system is start deleting things at random. Some of what Windows hides is deletable without consequence. Some of it is deletable but costs you something useful — like your ability to hibernate, or your system restore points. And some of it is absolutely not deletable without breaking Windows entirely. The difference between those categories is the entire point of this guide.

The reason the standard Windows disk cleanup tool and antivirus scans cannot find your file is that many of the largest space consumers on Windows 10 are intentionally hidden system files and protected directories that normal tools are designed to leave alone. They are not malware. They are not corruption. They are features — hibernation support, system restore capability, Windows update infrastructure — that Windows has allowed to grow without any visible warning or user notification.

Step one, before anything else, is to install a proper disk scanning tool that can see these hidden files and show you exactly what is using your space. The two best free options are WizTree (fastest — scans a 1TB drive in under 10 seconds using the NTFS Master File Table directly) and WinDirStat (slower but produces a treemap visualisation that makes large files visually obvious). Run either one as Administrator — without administrator access, protected system files will not appear in the scan and you will get the same incomplete picture the built-in tools give you.

ℹ Start Here — Before Reading Further

Download WizTree (free): wiztree.en.lo4d.com — select "Run as Administrator" when you launch it. Point it at your C: drive. Sort by size descending. The largest item at the top is your culprit. Identify the file or folder name, then use this guide to understand what it is and what to do about it.

If WizTree shows nothing unusual in the top 20 items but space is still missing, the culprit is almost certainly VSS shadow copies hidden inside the System Volume Information folder — which even WizTree may not display at full size without certain permissions. The diagnostic command for this is in Phase 3 of this guide.

Figure 1 — The seven main culprits for unexplained large files on Windows 10, typical sizes, and deletability

VSS shadow copies with an UNBOUNDED storage limit are the most common cause of 200GB+ unexplained space loss — your antivirus will never flag this because it is a Windows feature, not malware

The Seven Culprits

Meet the Seven Hidden Files That Are Probably Eating Your Drive

Before diving into the diagnostic and fix steps, here is a plain-language account of each known culprit — what it is, why it grows so large, and what category of risk applies to removing it.

Main Suspecthiberfil.sys

Created by Windows to support the Hibernate power option. When you hibernate, your entire RAM is copied into this file so Windows can restore your session after a full power-off. The file is exactly the size of your installed RAM. 16GB RAM = 16GB file. 64GB RAM = 64GB file. It sits hidden on the root of C: and is invisible even when "show hidden files" is enabled — you need "show protected operating system files" turned on to see it.

Typical size: equal to your RAM (16–128GB)✓ Safe to remove if you never use Hibernate

Main SuspectSystem Volume Information (VSS)

The hidden folder that stores all System Restore points and Volume Shadow Copies. Windows creates a snapshot of your drive every time you install an update, install software, or manually create a restore point. If the maximum storage limit for shadow copies is set to UNBOUNDED (which happens when some backup software is installed and then removed), this folder expands to fill your entire drive. Real-world reports: 200GB, 350GB, 500GB. The folder is locked behind system permissions which is why WizTree may show it as smaller than it is.

Typical size: 10GB to 500GB+ if limit is UNBOUNDED⚠ Reduceable — but you lose restore points

Common Culpritpagefile.sys

Windows virtual memory — when your RAM fills up, Windows uses this file on disk as overflow. By default, Windows manages the size automatically and may set it to 1.5× your RAM. On a machine with 32GB RAM, this can be a 48GB file. On a machine with 64GB RAM, this can be nearly 100GB. The pagefile itself is not a problem — but it can be right-sized down significantly without harming anything if your system has plenty of RAM.

Typical size: 4GB to 96GB depending on RAM⚠ Right-size it — do not delete it entirely

Common CulpritC:\Windows\WinSxS

The Windows component store. Every time Windows installs an update, it keeps the old version of the component here so you can roll back if the update causes problems. On a long-running Windows installation with many updates, this folder appears enormous in File Explorer — but much of that is an illusion caused by hard links (the same file counted multiple times in different locations). The safe way to reduce it is DISM. The unsafe way is to delete files manually, which will break Windows Update and potentially make the system unbootable.

Apparent size: 15–40GB (real disk use: often 6–12GB)⚠ DISM cleanup only — NEVER delete manually

Easy WinC:\Windows.old

Created automatically when Windows performs a major version upgrade (e.g. from Windows 10 1903 to Windows 10 21H2, or from Windows 10 to Windows 11). Windows keeps your old installation here for 10 days in case you want to roll back. After 10 days Windows can delete it automatically, but it does not always do so. If you can see this folder and your system has been running fine since the upgrade, it is completely safe to delete via Disk Cleanup.

Typical size: 10–30GB✓ Safe to delete via Disk Cleanup — not manually

Sneaky CulpritC:\Windows\Installer

Windows keeps installer packages (.msi and .msp files) here so that installed programs can be repaired, updated, or uninstalled without needing the original installation disc. Over years of software installations and updates, this folder can grow to hundreds of gigabytes — particularly through .msp patch files from software that has been uninstalled but left its patch cache behind (orphaned patches). These orphaned files are safe to move, but must not be deleted blindly. Use PatchCleaner to identify orphaned files safely.

Typical size: 5–200GB if heavily orphaned⚠ Use PatchCleaner — not manual deletion

Figure 2 — Diagnostic decision tree: how to identify your specific culprit in order of likelihood

Work through this diagnostic in order — the most common culprits are at the top. Most 500GB mystery files are VSS shadow copies with an UNBOUNDED limit.

Phase 1 — Find It

Phase 1: Make Hidden Files Visible and Use WizTree to Find the Culprit

Windows hides the largest system files behind two separate visibility layers: the normal "show hidden files" toggle only shows regular hidden files; protected system files require a separate setting. You need both turned on, and you need a scanning tool that runs as Administrator — otherwise you will never see what is actually using your space.

1

File Explorer → View → Options → View tab

Enable visibility of protected system files in File Explorer

Open File Explorer. Click the View menu at the top, then click Options at the far right. Go to the View tab. Under Advanced settings, find Hidden files and folders and select Show hidden files, folders, and drives. Scroll down and uncheck Hide protected operating system files (Recommended). Windows will show a warning — click Yes. Click Apply, then OK. Now navigate to your C: drive root — you will see hiberfil.sys and pagefile.sys if they exist.

2

Install WizTree (free) and run it as Administrator

Download WizTree from the official site. After installing, right-click the WizTree icon and select Run as administrator. This is critical — without administrator rights, WizTree cannot read the Master File Table entries for protected system files and will give you an incomplete result. Select your C: drive and click Scan. The scan completes in seconds (even on a 1TB drive) because it reads the NTFS Master File Table directly rather than walking the directory tree. Click the Allocated Size column header to sort from largest to smallest. The item at the top is your biggest space user.

Note on System Volume Information: Even WizTree running as Administrator may show this folder as smaller than it actually is, because VSS shadow copies are protected by the system at kernel level. The vssadmin list shadowstorage command in Phase 3 gives you the accurate VSS size.

3

Note the top 5 files and folders by size before doing anything else

Write down or screenshot the top 5 items from WizTree — file path and size. You need this information to pick the right fix in the steps below. If you see hiberfil.sys at 32GB or more, that is your primary fix target. If you see Windows.old, that is an easy win. If WizTree shows that C:\Windows takes up 400GB and you can see WinSxS is very large, you need the DISM and VSS commands in Phase 3. If the space discrepancy is between what WizTree reports as used and what Windows reports as used, the missing space is almost certainly VSS shadow copies hidden in System Volume Information.

Phase 2 — Easy Fixes

Phase 2: Safe Deletions — Work Through These in Order

These are the fixes with the clearest benefit-to-risk ratio. Do them first. In many cases, one of these alone will recover 20–60GB of space in under five minutes.

1

Command Prompt (Admin) → type command → press Enter

Fix: hiberfil.sys — disable hibernation if you do not use it

If you never use the Hibernate option (most desktop users never do), this file is wasting space equal to your entire RAM. Disabling hibernation deletes the file immediately and recovers all of that space. Open Command Prompt as administrator (type cmd in the Start search, right-click, select Run as administrator). Type the command below and press Enter. The hiberfil.sys file is deleted immediately — no restart required.

Command Prompt — Disable hibernation and delete hiberfil.syspowercfg.exe -h off
:: The file is deleted immediately. To re-enable hibernation later:
:: powercfg.exe -h on

⚠ Before You Disable Hibernation

Laptops: Hibernation saves your open session when the battery dies. If you use your laptop on battery and sometimes let it run down, keep hibernation enabled. Desktop computers and laptops that are always plugged in can safely disable it.

Fast Startup: Disabling hibernation also disables Windows Fast Startup (which uses a partial hibernate to speed up boot). On SSD systems the difference in boot time is negligible. On HDD systems you may notice slightly slower boot times after disabling hibernation.

2

Start → type "Disk Cleanup" → Run as administrator → Clean up system files

Fix: Windows.old and Windows Update cleanup via Disk Cleanup

Click Start and type Disk Cleanup. Right-click it and select Run as administrator — without admin rights, the system file categories will not appear. Select your C: drive, click OK, then click Clean up system files (the button at the bottom of the dialog). This re-runs the scan with elevated access and shows additional categories. Check all of the following if they appear: Windows Update Cleanup, Previous Windows installation(s) (this is Windows.old), Temporary files, System error memory dump files, Delivery Optimization Files, and Temporary Internet Files. Click OK, then Delete Files. This is the safest cleanup method Windows provides — it will not touch anything it does not know is safe to remove.

3

Settings → System → Storage → Temporary files

Fix: Use Storage Sense for a second-pass cleanup

Open Settings → System → Storage → Temporary files. This shows a breakdown of temporary file categories with sizes. Select the categories you want to remove — including Downloads folder if it is safe to clear, Recycle Bin, Thumbnails, and Temporary files. Click Remove files. This is complementary to Disk Cleanup and sometimes catches items the older tool misses. While you are in the Storage settings, also check Apps & features — sort installed applications by size and look for anything unexpectedly large or no longer needed.

Phase 3 — The Hard One

Phase 3: The Most Common Cause of 200–500GB Loss — VSS Shadow Copies with No Size Limit

If the easy fixes above did not recover the space you expected, the culprit is almost certainly Volume Shadow Copy Service (VSS) shadow copies inside the System Volume Information folder — and specifically a scenario where the maximum allowed storage for shadow copies has been set to UNBOUNDED. This means Windows has no ceiling on how much disk space shadow copies can consume, and over time — particularly after years of Windows updates and installed software — the shadow copy database has grown to fill hundreds of gigabytes.

This is the scenario responsible for the 221GB recovery and 500GB recoveries documented in the community reports at the top of this article. Your antivirus will not flag this. Disk Cleanup will not fully address it. The only way to check it and fix it is via the vssadmin command-line tool.

Figure 3 — How VSS shadow copies silently grow to fill your drive when the limit is UNBOUNDED

The UNBOUNDED limit scenario is often caused by backup software (Acronis, Macrium, Veeam) that changes the VSS limit and is then uninstalled without resetting the limit

1

Check what VSS is actually using on your drive

Open Command Prompt as administrator. Run the command below. The output shows the current shadow copy storage usage and — critically — the maximum allowed size. If it shows Maximum Shadow Copy Storage space: UNBOUNDED, you have found your culprit. If it shows a specific percentage (like 10% or 15%) and the usage is near that limit, the limit is working but may need adjustment.

Command Prompt (Admin) — Check VSS shadow copy storage usagevssadmin list shadowstorage

:: Example output showing the UNBOUNDED problem:
:: Shadow Copy Storage volume: (C:)\Device\HarddiskVolumeShadowCopy1
:: Used Shadow Copy Storage space: 420 GB (87%)
:: Allocated Shadow Copy Storage space: 450 GB (93%)
:: Maximum Shadow Copy Storage space: UNBOUNDED (100%) ← THIS IS THE PROBLEM

2

Set the VSS limit to a sensible maximum and delete excess shadow copies

Run the first command to set a reasonable maximum (10% of your drive is appropriate for most home systems — enough for a few restore points but not enough to consume hundreds of GB). Then use Disk Cleanup to remove old shadow copies down to the most recent one. Note: this will delete your System Restore history beyond the most recent restore point. If your system is running well and you do not need to roll back to an old state, this is completely safe.

Command Prompt (Admin) — Fix: Set VSS storage limit to 10% and reclaim space:: Step 1: Set the VSS maximum storage to 10% of the drive vssadmin resize shadowstorage /on=C: /for=C: /maxsize=10%

:: Alternatively, set a fixed GB limit (e.g. 15GB):
vssadmin resize shadowstorage /on=C: /for=C: /maxsize=15GB

:: Step 2: List all existing shadow copies to see how many there are vssadmin list shadows

:: Step 3: Delete all but the most recent shadow copy :: SAFER: Do this via Disk Cleanup GUI (see below) rather than vssadmin delete :: GUI method: Disk Cleanup → Clean up system files → More Options tab :: → System Restore and Shadow Copies → Clean up → Delete

⚠ Important — What You Lose When You Delete Shadow Copies

Deleting shadow copies removes your System Restore history. You will lose the ability to roll Windows back to previous restore points. The most recent restore point is kept if you use the Disk Cleanup GUI method. If your system is stable and working correctly, losing restore history is not a problem. If you are currently troubleshooting a system issue, keep at least one restore point before deleting the others.

Reducing the VSS limit from UNBOUNDED to 10% will cause Windows to automatically delete the oldest shadow copies to bring the total storage used within the new limit. The space is reclaimed gradually — check available space again after restarting.

Phase 4 — Component Store and Installer Cache

Phase 4: WinSxS and the Windows Installer Folder

If you have completed Phases 1–3 and still have unexplained space consumption, the remaining culprits are the Windows component store (WinSxS) and the Windows Installer cache. Both require specific tools — manual deletion of files from either location will break Windows in ways that are very difficult to repair.

Cleaning WinSxS safely with DISM

Never delete files from C:\Windows\WinSxS manually. The folder is larger than it appears in File Explorer because Windows counts hard-linked files multiple times — the actual disk use is often 40–60% less than the reported size. The safe way to reduce it is DISM (Deployment Image Servicing and Management), which identifies and removes components that are no longer needed while leaving the ones required for updates and rollbacks intact.

Command Prompt (Admin) — Clean WinSxS component store safely with DISM:: Step 1: Analyse the component store — tells you how much space can be reclaimed DISM /Online /Cleanup-Image /AnalyzeComponentStore

:: Step 2: Run the cleanup (safe — removes components no longer needed for updates) DISM /Online /Cleanup-Image /StartComponentCleanup

:: Optional Step 3: Deeper cleanup — removes ability to uninstall old updates :: Only use this if your system is stable and you are certain you will not roll back updates :: This operation is IRREVERSIBLE DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase

:: Each command takes 10-30 minutes. Do not close the window. :: "The operation completed successfully" means it worked.

Cleaning the Windows Installer cache safely with PatchCleaner

The C:\Windows\Installer folder holds .msi and .msp installer files that Windows keeps so installed programs can be repaired, updated, and uninstalled without the original media. On systems with years of software installations, this folder can balloon to 200GB or more — primarily from .msp patch files left behind by software that has been uninstalled but did not clean up its patch cache.

Do not delete files from this folder directly. Use PatchCleaner (free download from homedev.com.au), which compares the contents of the Installer folder against your installed programs database and identifies which files are genuinely orphaned versus which ones are still needed. Critically, PatchCleaner defaults to moving orphaned files to another location rather than deleting them immediately — this lets you test your system for a week or two before permanently committing to the deletion. If nothing breaks in that period, delete the moved files.

Phase 5 — Page File

Phase 5: Right-Sizing the Page File

The page file (pagefile.sys) is Windows virtual memory — overflow storage used when your physical RAM fills up. By default, Windows manages the size automatically and often sets it very large: 1.5× to 3× your installed RAM. On a machine with 32GB RAM, this can consume 48–96GB of storage. On a machine with 64GB RAM, over 100GB.

The page file should not be deleted entirely — Windows uses it for crash dumps and some applications explicitly require it. But it can be right-sized. If your machine has 16GB or more of RAM and you rarely run memory-intensive workloads (video editing, virtual machines, large databases), a page file of 4–8GB is sufficient and will recover significant space compared to the Windows default.

1

Start → right-click This PC → Properties → Advanced system settings → Performance Settings → Advanced → Virtual Memory → Change

Open the Virtual Memory settings

Right-click This PC on your desktop (or in File Explorer) and select Properties. Click Advanced system settings on the left. In the System Properties window, click the Advanced tab. Under the Performance section, click Settings. In the Performance Options window, click the Advanced tab. Under Virtual memory, click Change.

2

Set a custom size instead of Windows-managed

Uncheck Automatically manage paging file size for all drives. Select your C: drive. Select Custom size. Set both Initial size and Maximum size to 4096 MB (4GB) if you have 16GB+ RAM, or 8192 MB (8GB) if you have 8GB RAM. Click Set, then OK. Restart your computer for the new page file size to take effect. The old pagefile.sys file is replaced with the new smaller one on restart.

Do not set it to zero (no page file). Removing the page file entirely can cause applications to crash with "insufficient memory" errors even when physical RAM is available, and disables Windows memory dump files which you need to diagnose crashes.

What If It Is Actually Malware?

Is It Actually Malware? How to Tell

The scenario described in this article — a massive file that standard antivirus does not detect — is almost always a legitimate Windows system file or bloated feature rather than malware. Real malware that consumes hundreds of gigabytes of disk space is extremely unusual because malware that obvious would trigger immediate investigation (as it did here) and most malware wants to stay invisible precisely by not consuming noticeable resources.

That said, there are some malware types that do occupy large amounts of storage — particularly cryptomining malware (which downloads large datasets), botnet malware (which stores data for exfiltration), and ransomware (which may encrypt and re-save files, temporarily doubling their disk footprint during the encryption process).

If WizTree identifies a very large file or folder in an unusual location — not in C:\Windows, C:\Program Files, or C:\Users — that you do not recognize and that is not one of the named system files in this guide, treat it with suspicion. The specific indicators to look for:

A large folder in a deeply nested, randomly-named subdirectory of C:\Users\[name]\AppData\Roaming or C:\Users\[name]\AppData\Local\Temp
A large .vhd or .vhdx file outside of expected locations (WSL virtual disk files are normal in C:\Users\[name]\AppData\Local\Packages; similar files outside this location are suspicious)
A large file with a randomised name (like a3f7c2d.sys) in the root of C:
Disk space that disappears and reappears — this can indicate active encryption in progress

If you find something suspicious, do not delete it directly. Run Windows Defender Offline Scan (which scans before Windows loads, catching malware that hides in the running OS) and also upload the suspicious file to VirusTotal (virustotal.com) which scans it against 70+ antivirus engines simultaneously.

Figure 4 — Expected space recovery from each fix, ordered from highest to lowest impact

Start with VSS shadow copy check (vssadmin list shadowstorage) — if the limit is UNBOUNDED, this alone may recover hundreds of gigabytes

Key Takeaways

✓Always use WizTree (run as Administrator) to identify the culprit before deleting anything. It scans a 1TB drive in under 10 seconds and shows protected system files that Windows Explorer hides.

✓The most common cause of 200–500GB unexplained disk loss on Windows 10 is VSS shadow copies with the storage limit set to UNBOUNDED. Run vssadmin list shadowstorage to check — if it says UNBOUNDED, you found your culprit.

✓hiberfil.sys equals your RAM size. On a machine with 64GB RAM, this is a 64GB hidden file. Disable hibernation with powercfg.exe -h off if you never use the Hibernate option. Desktop users almost never need it.

✓Never manually delete files from C:\Windows\WinSxS. Use DISM with /StartComponentCleanup. Manual deletion can break Windows Update and potentially make the system unbootable.

✓Never manually delete files from C:\Windows\Installer. Use PatchCleaner to identify orphaned files. Move them to another location first; delete permanently only after confirming your software still works for a week.

✓For Windows.old: always delete it via Disk Cleanup (with admin rights), not by deleting the folder directly. The Disk Cleanup method ensures Windows properly cleans up the associated registry entries and boot records.

✓A 500GB mystery file is almost never malware. The file sizes involved and the fact that standard tools cannot identify it points to a Windows system feature (shadow copies, hibernation, update cache) rather than malicious software.

✓After fixing the space issue, set your VSS limit to 10% permanently to prevent it from growing back: vssadmin resize shadowstorage /on=C: /for=C: /maxsize=10%

Frequently Asked Questions

My antivirus ran a full scan and found nothing — does that mean the large file is definitely not malware?

Not with 100% certainty, but it is a strong indicator. If WizTree identifies the large file as one of the known Windows system files covered in this guide (hiberfil.sys, pagefile.sys, System Volume Information, WinSxS, Windows.old, Windows\Installer), it is definitively not malware — these are legitimate Windows components regardless of their size. If WizTree finds a large file in an unusual location with an unrecognised name, upload it to virustotal.com and run Windows Defender Offline Scan for a second opinion beyond your installed antivirus.

Will setting the VSS limit to 10% immediately free up the space?

Not immediately. Setting the new limit tells Windows the maximum it can use going forward. Windows will then gradually delete the oldest shadow copies to bring usage within the new limit — this happens in the background and may take a restart or two to fully reclaim the space. To reclaim it immediately, use Disk Cleanup → Clean up system files → More Options tab → System Restore and Shadow Copies → Clean up. This deletes all but the most recent shadow copy right away.

Is it safe to completely disable the page file if I have 32GB of RAM?

Technically possible but not recommended. Even with 32GB of RAM, removing the page file entirely can cause certain applications to crash when they request more memory than is available (some applications calculate available memory including the page file). Windows also writes crash dump files (useful for diagnosing BSODs) to the page file location. A better approach is to set a fixed custom size of 4–8GB — this recovers most of the space while maintaining compatibility and crash dump capability.

Can I move hiberfil.sys or pagefile.sys to a different drive?

The page file can be moved to a secondary drive. Open Virtual Memory settings (Phase 5 above), select the C: drive and choose "No paging file", then select your secondary drive and set a custom size. The hibernation file (hiberfil.sys) cannot be moved — it must live on the system (C:) drive because the BIOS needs to access it before Windows loads during the resume from hibernation process. If your C: drive is very small, the practical solution for hiberfil.sys is to disable hibernation rather than move the file.

What caused the VSS limit to be set to UNBOUNDED in the first place?

The most common cause is third-party backup software. Acronis True Image, Macrium Reflect, Veeam Agent, and similar tools often modify the VSS storage limit to UNBOUNDED when they install (so they can take large snapshots without hitting a size limit). When these tools are uninstalled, they do not always reset the VSS limit back to the Windows default. The result is a Windows system where the VSS limit remains UNBOUNDED long after the backup software is gone, allowing shadow copies to grow without constraint indefinitely.

After I delete the shadow copies, will System Restore still work?

Yes, but only for new restore points created after the cleanup. Deleting shadow copies removes the historical restore points — you cannot roll back to a point before the cleanup. Windows will continue creating new restore points automatically (on updates and software installs) as long as System Protection is enabled. The new restore points will accumulate within the new storage limit you set (e.g. 10%), which will keep the VSS folder at a manageable size going forward.

FAVORITE Azure Engineering, AI & Real-World Fixes

Search This Blog