Data Recovery Case File · Portable Drives · A Number Worth Investigating
Space Allocated to Something You Cannot See
Her enquiry is about arithmetic rather than a failure. An external drive "telling me that I was using up over 700GB out of 999GB and that I was running low on disk space. However, when I added up all the" folders, they did not come close. That gap is not a display error — the drive genuinely has that much space allocated, to something the file manager is not showing her, and there are four candidates worth working through before anybody concludes anything is wrong.
| Media | 1TB external hard drive — reporting approximately 700GB in use against a substantially smaller total of visible file content |
| Reported situation | Drive reporting approximately 700GB used of 999GB · low disk space warnings issued · sum of visible folder contents substantially below the reported figure · no fault otherwise reported |
| Fault class | Allocation exceeding visible content — hidden content, volume-level deletion store, snapshots, or orphaned allocation from an interrupted write |
| Equipment used | Hidden and system content enumerated before any conclusion · volume-level deletion store and snapshot stores located · orphaned allocation assessed without running a repair · imaged write-blocked where filesystem inconsistency was indicated |
The decode: the four things that fill an invisible gap
First — hidden and system content. Every volume carries items the file manager conceals by default, and some of them are large: indexing databases, thumbnail caches, and system folders. Revealing hidden items is the first check and it costs nothing.
Second — a volume-level deletion store. Deleting from an external drive does not always remove anything; on some systems items are moved to a hidden folder on that volume and stay there until it is emptied. Years of deletions can occupy an enormous amount of space while being invisible in every normal view — and this is the commonest single explanation for a large unaccounted gap.
Third — snapshots or previous versions. Where a drive has been used as a backup destination, or where versioning was ever enabled, historical copies accumulate and are stored outside the ordinary folder structure. They are supposed to be invisible; they are not supposed to be forgotten.
Fourth, and this is the one that matters diagnostically — orphaned allocation. A filesystem tracks which regions are in use and which files own them, in two related sets of records. When a write is interrupted — an unclean removal, a crash, a power loss — regions can be marked as occupied while the entry that owned them is never completed. The space is claimed and belongs to nothing, permanently, and it accumulates with each such event.
Why the fourth is worth knowing about: it is a symptom rather than a nuisance. Orphaned allocation means the volume has experienced interrupted writes, which is exactly the history that precedes structural problems. A drive quietly accumulating unaccounted space is a drive telling you something about how it has been used or how it is behaving.
The check that would identify it, and the reason to be careful: a filesystem consistency check reports orphaned blocks precisely. But that same tool offers to reclaim them, which is a write — and on a volume holding anything irreplaceable, running a repair before the contents are secure is the sequence this archive warns about throughout. Check, do not fix, or capture first.
The reassuring possibility: if the gap turns out to be a deletion store, the contents of that folder are her deleted files, intact and simply hidden — recoverable by opening a folder rather than by any recovery at all.
On the bench
Hidden and system content was enumerated before any conclusion, indexing databases, caches and system folders being concealed by default and frequently substantial. Volume-level deletion and snapshot stores were located — deleted items being retained in a hidden folder on the volume itself on some systems, which is the commonest explanation for a large unaccounted gap. Orphaned allocation was assessed without running a repair, a consistency check reporting it precisely while also offering to reclaim it, which is a write. Imaging write-blocked followed where inconsistency was indicated.
The outcome
The hidden content enumerated, the deletion and snapshot stores located and orphaned allocation assessed without any repair being run. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: that space really is allocated, to something the file manager is not showing. Look for hidden items, a deletion store on the volume itself, and snapshots. If none account for it, the volume is carrying orphaned allocation from interrupted writes — which is a symptom worth knowing about rather than a nuisance.
Drive reporting more space used than your files account for
Reveal hidden items first, then look for a deletion store on the drive itself — that's the commonest explanation and it costs nothing to check. Deleting from an external drive doesn't always remove anything: on some systems items go to a hidden folder on that volume and stay until it's emptied, so years of deletions can occupy an enormous amount while being invisible in every normal view. Also check for snapshots or previous versions if the drive was ever a backup destination. If none of those account for the gap, the volume is probably carrying orphaned allocation — space marked as in use whose owning entry was never completed, left behind by interrupted writes. A consistency check reports that, but don't let it repair anything.
Check the hidden folders first — or call Guildford Data Recovery on 01483 901310; hidden and system content enumerated, deletion and snapshot stores located, orphaned allocation assessed without running any repair.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.