Use a combination of visibility checks, permission analysis, and comparison tools:
- Show hidden and protected files first.
In File Explorer, open the volume, then go to Tools > Folder Options > View. Enable Show Hidden Files and Folders and clear Hide protected operating system files. This lets File Explorer and
dir /a /sinclude more content in totals for items that the current account can access. - Compare File Explorer with
dir /a /soutput. From Command Prompt, create a full listing such as:dir d: /a /s > c:\d-dir.txtThis helps identify whether the discrepancy is caused by items that are hidden or inaccessible to the current account. - Investigate permission-related gaps.
File Explorer and
dir /a /sonly report files and folders that the current account can access. If backup tools report more data than File Explorer, that usually means some folders are excluded by NTFS permissions. After locating inaccessible items, permissions can be reviewed or changed from the folder or file Properties > Security tab. - Be careful when using File Explorer to open protected folders. If Continue is selected on a folder that requires administrative access, Windows Explorer can add the user account to the folder ACL. That can change permissions unexpectedly and affect security audits or application behavior. To avoid altering permissions, use an elevated tool instead of File Explorer, such as Command Prompt, PowerShell, or Computer Management.
- Check whether the issue is really hidden or system-protected storage. Low-space or incorrect size reporting can occur when applications create large temporary files in hidden or system-protected folders. These files may not be reported accurately by standard File Explorer folder-size views.
- Use backup reporting to find inaccessible content.
A documented method is to generate
dir /a /soutput, then run ntbackup in Advanced Mode with a Detailed backup log for the whole volume, and compare the backup report with thediroutput. Because backup can access all files, this comparison can reveal folders that File Explorer does not count. - For effective access checks on file shares, avoid UNC paths in the affected scenario.
On Windows 8.1 and Windows Server 2012 R2, viewing effective access for a file or folder on a non-Microsoft SMB 3.0 server can fail with
0x80070057when using a UNC path. Mapping the share to a drive letter works around the issue and allows effective permissions to display. - Escalate when permissions or names are abnormal. If a folder has no Security tab, permissions cannot be reassigned, access returns Access is denied, or files have invalid or reserved names that cannot be renamed or deleted, the documented guidance is to contact Microsoft Support.
The supported causes in the documentation cover:
- hidden and protected operating system files not included in normal views
- NTFS permission restrictions
- File Explorer changing ACLs when Continue is used
- hidden temporary files consuming space
- effective access failures on certain UNC share scenarios
The context does not provide documented guidance for symbolic link analysis or NTFS metadata inspection beyond permissions and visibility behavior.
References:
- Locate and correct disk space problems on NTFS volumes
- When you select Continue for folder access in Windows Explorer, your user account is added to the ACL for the folder
- Drive C warns about low disk space but Windows Server shows available space
- "Code 0x80070057 The parameter is incorrect" error when you try to display a user's "effective access" to a file | Microsoft Support