>>106104784
I wouldn't be surprised with all the stuff taking that many space. Take into account:
>pagefile (which along with physical RAM serves as virtual memory) and hiberfil (OS state suspended to disk when going to Sleep/Hibernation mode; also needed for Fast Startup)
>System Restore points in "System Volume Information" (they're Shadow Copy snapshots under the hood) - can be cleaned in sysdm.cpl (or launch SystemPropertiesProtection.exe in Run window)
>OEM customizations (USMT.ppkg) in the Recovery\Customizations folder to apply after doing a push-button system reset - you're probably running an OEM installation of Windows?
>driver packages (past and current) in Windows\System32\DriverStore - use PnPUtil (online) or DISM (offline) to clean older packages (use DriverStoreExplorer for a neat GUI)
>past Windows Updates (and other Component-Based Servicing packages) in Windows\WinSxS (past packages no longer utilized are supposed to be cleaned up each month by a scheduled task - which basically runs a DISM servicing command for component cleanup)
>MSI-based installer package cache in Windows\Installer
And (obviously) programs that you have installed (normally in Program Files) along with their data and configuration (stored in user profile's AppData if user-scope, or ProgramData if system-wide) and populated registry hives - system-wide (HKLM) and user-scope (HKCU). You should also consider crashdumps (be it from a program crash or a BSoD), user profiles (including the aforementioned AppData subfolder and other user-specific ones) and temporary files (user-scope in %TEMP% or system-wide in Windows\Temp). Certain NTFS metafiles are capable of being bloated up too (some anon ended up with gigabytes of Transactional NTFS metadata in $TxF.)
Run Windows' maintenance tools first (start with CleanMgr), then use BCUninstaller to uninstall programs you no longer use (and clean their leftovers), and use BleachBit with Winapp2 cleaners for cleaning junk files.
4chan Search
2 results for "1a0021d5a9d17918a8513c06e1ad06c0"
>>105581364
>If these are your backup drives and you don't need them you can disable them in the device manager (from driver settings).
Or just make them offline - be it Disk Management or diskpart.
>>105581851
Good to know, thanks. This does seem useful. You seem to know your NT-fu.
I believe I used FSUtil recently, to strip off and turn off 8.3 names from the system drive just before restarting from the WinPE when the first-stage setup finished. Could've sworn it was already off by default in NT 10, but I guess the schneegans kraut was actually right.
Speaking about krauts, I recently stumbled upon a link someone at MDL shared. Some crazy/near-schizo Sicherheitsforscher stuff - but can't fundamentally disagree with the lack of strict separation between a regular user and an administrator-type one. Wondering what's your take on it.
https://skanthak.hier-im-netz.de/ten.html (don't be surprised if Defender goes apeshit - guy seems to preload the EICAR test file in the HTML for lulz).
>If these are your backup drives and you don't need them you can disable them in the device manager (from driver settings).
Or just make them offline - be it Disk Management or diskpart.
>>105581851
Good to know, thanks. This does seem useful. You seem to know your NT-fu.
I believe I used FSUtil recently, to strip off and turn off 8.3 names from the system drive just before restarting from the WinPE when the first-stage setup finished. Could've sworn it was already off by default in NT 10, but I guess the schneegans kraut was actually right.
Speaking about krauts, I recently stumbled upon a link someone at MDL shared. Some crazy/near-schizo Sicherheitsforscher stuff - but can't fundamentally disagree with the lack of strict separation between a regular user and an administrator-type one. Wondering what's your take on it.
https://skanthak.hier-im-netz.de/ten.html (don't be surprised if Defender goes apeshit - guy seems to preload the EICAR test file in the HTML for lulz).