.

Swollen Folders

<<

Constantine

User avatar

Newbie
Newbie

Posts: 7

Joined: Thu Sep 05, 2013 11:15 am

Post Thu Sep 05, 2013 11:29 am

Swollen Folders

Hello!

I have a very strange problem with my FreeAgent GoFlex 500 GB external HDD, only about the half of it is actually occupied, 200-250 GB, but Windows says no more than 10 GB are available. And so says Linux. But when I checked it with my pal's Mac, it showed the adequate picture, about 50% free disk space.

It all happened last Spring, I got into a really weird situation on-line, I thought my computer was hacked or infected. I was unwise enough to have the external drive connected once in a while when being on the Internet. And at some point I noticed I ran out of space dramatically. I couldn't detect any suspicious / unknown folders. They just all (or some of them) had swollen to about twice its normal size. I tend to think a couple files might have been deleted but the rest appear to be OK.

The disk itself is still 465 GB as it should. I thought about buying another HDD, but I need to figure it all out and find the cause, so it never happens to me again.

Unfortunately, I had very little time trying it on Mac after the accident, it would have been right to check the exact sizes of folders and some files as to compare later.

I deleted some files and noticed that more space was freed. E.g. 5 GB instead of 1.5 GB. But the trick never worked again. So I have to put up with a few GB which is not OK. :smileysad:

The drive has been tested for viruses by numerous antivirus progs, no problem. SeaTools short tests are OK.

I have never run backup apps on it. That is, to my best knowledge.

Posting this at SeaGate forums wasn't helpful.

Could you help me out, please?


THANK YOU! :smileyhappy:
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Thu Sep 05, 2013 11:58 am

Re: Swollen Folders

What file system are you using? If it's NTFS, try running a tool that checks for alternate data streams.
The day you stop learning is the day you start becoming obsolete.
<<

Constantine

User avatar

Newbie
Newbie

Posts: 7

Joined: Thu Sep 05, 2013 11:15 am

Post Thu Sep 05, 2013 12:08 pm

Re: Swollen Folders

Yes, NTFS. Do you mean the likes of Stream Armor?

I'll give it a try, thank you!
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Thu Sep 05, 2013 12:39 pm

Re: Swollen Folders

I'm not familiar with that particular tool, but it looks like that's what it does.
The day you stop learning is the day you start becoming obsolete.
<<

Constantine

User avatar

Newbie
Newbie

Posts: 7

Joined: Thu Sep 05, 2013 11:15 am

Post Thu Sep 05, 2013 3:01 pm

Re: Swollen Folders

I've run the test, 2 suspicious, 4 need analysis on the internal HDD (temporary internet files + user app data), nothing unknown on the external drive. Problem not solved.

Which made me thinking, there might be some opposite to ADS kind of threat when the folder / file size or rather the perception / estimation of it is altered. A mask of sorts or a meta swell which blocks the space and prevents from normal operation.

I have to add that the new folders on that external HDD I currently create, copy or delete, and their content, appear completely normal.

Any more thoughts or guesses? ??? ???
<<

Constantine

User avatar

Newbie
Newbie

Posts: 7

Joined: Thu Sep 05, 2013 11:15 am

Post Thu Sep 05, 2013 10:47 pm

Re: Swollen Folders

Could it be a system / hardware failure?

Anyway, how to solve this case?
<<

m0wgli

User avatar

Sr. Member
Sr. Member

Posts: 308

Joined: Fri Jul 20, 2012 3:34 pm

Post Fri Sep 06, 2013 2:59 pm

Re: Swollen Folders

Is reformatting the disk an option?
Security + | OSWP | eCPPT (Silver & Gold) | CSTA
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Fri Sep 06, 2013 5:14 pm

Re: Swollen Folders

Yea, I'd just move anything important to another location and format. It could be a problem with the filesystem that isn't related to anything malicious at all.
The day you stop learning is the day you start becoming obsolete.
<<

Constantine

User avatar

Newbie
Newbie

Posts: 7

Joined: Thu Sep 05, 2013 11:15 am

Post Sat Sep 07, 2013 2:31 am

Re: Swollen Folders

Thanks for your input!

Obviously, I did make copies of anything I personally created. But overall it's about 450 GB which means I'd have to buy yet another external HDD. But the worst is it's 250 GB went 450. So, I'd still have to operate the 'swollen' version on any Windows or Linux based PC. The files do not get smaller when I transfer them to my PC. So ..

I think I may try files vs folders transfering comparison. There may be some difference, who knows. Unfortunately, the major folders are about 100 GB each, and I've run out of space on my machine. :'(

BTW, could you guys enlighten me as to whether Macs are capable of fully fledged operation of Windows formatted HDDs, or it is just about reading?

I wish I had a Mac by my hand to see what's changed. I could try HDD->Mac->PC->newly formatted HDD.

Mine is Seagate FreeAgent GoFlex 500 GB.

I heard Western Digital is either Windows or Mac, and not both. Do I get it right?
<<

UKSecurityGuy

User avatar

Jr. Member
Jr. Member

Posts: 88

Joined: Wed Mar 27, 2013 10:51 am

Post Mon Sep 09, 2013 11:21 am

Re: Swollen Folders

This is one of those *off the top of my head* answers but:

When moving files (typically photos) from Macs to Windows/Linux machines, I've noticed duplicate files occationally get created. I'm not sure if this is the Mac creating files for itself and the ones for compatability with other OS's, but it takes up twice as much room as normal.

Have a look to see which files are taking up the space, and if there are duplicate versions of those files around.

"TreeSize Free" should be able to pin down where the space is being used on the device.
<<

Constantine

User avatar

Newbie
Newbie

Posts: 7

Joined: Thu Sep 05, 2013 11:15 am

Post Mon Sep 09, 2013 3:35 pm

Re: Swollen Folders

Thank you for the advice!

I'm gonna try this utility.

BTW, here is some solution for Mac-PC sharing headache.

http://howto.cnet.com/8301-11310_39-574 ... s-and-mac/

Are WS & SeaGate still the preferred choice in under $100 range?

Is there any principal difference between the two from a user perspective?

Would I be able to read and copy on either?
<<

Eleven

User avatar

Full Member
Full Member

Posts: 121

Joined: Thu Nov 10, 2011 6:47 pm

Post Wed Nov 27, 2013 11:43 am

Re: Swollen Folders

Have you tried running chkdisk?
<<

Constantine

User avatar

Newbie
Newbie

Posts: 7

Joined: Thu Sep 05, 2013 11:15 am

Post Fri Nov 29, 2013 10:20 am

Re: Swollen Folders

Eleven wrote:Have you tried running chkdisk?


for errors?

Seems to be OK

Return to Incident Response

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software