How to Find Hidden Files That Fill Up Your C Drive on Windows 11

Quick fix: Install WizTree (free), point it at C:, and let it scan the NTFS Master File Table — within 30 seconds you’ll have a sorted view of every file and folder by actual size, including the hidden ones Windows Explorer skips.

Your C: drive bar is red. Settings → Storage shows “System & reserved” consuming a huge chunk you can’t click into for details. File Explorer’s right-click Properties on C: reports 350 GB used, but adding up your visible folders only reaches 180 GB. Windows is hiding files — system files marked Protected, AppData under user profiles set to hidden by default, and metadata files (page file, hibernation file, system volume information) that aren’t in any folder browser.

What causes this

Windows hides files in three categories from default Explorer view: system files (anything in C:\Windows\System32, the page file, hibernation file), hidden files (files with the H attribute, including most of C:\Users\<you>\AppData), and protected operating system files (the most restrictive category, requiring an extra opt-in). On top of that, NTFS reserves space for system metadata (the MFT itself, USN journal, $LogFile) that doesn’t appear in any folder view.

To find what’s actually consuming space, you need either Explorer-level visibility into the hidden categories, or a tool that reads the NTFS Master File Table directly without going through the folder browsing API.

Method 1: Use WizTree (recommended for fast MFT scanning)

The fastest path to a complete view of disk usage.

1. Download WizTree from diskanalyzer.com (free for personal use).
2. Install and launch. Choose C: in the dropdown and click Scan.
3. WizTree reads the NTFS Master File Table directly — the scan completes in 5–30 seconds even on multi-terabyte drives.
4. Switch to the Tree View. The view sorts folders by total size, showing biggest first. Drill into the heavy folders to find the actual files.
5. Pay particular attention to:
   • C:\Users\<you>\AppData\Local — caches from browsers, Discord, Slack, Spotify
   • C:\Windows\WinSxS — component store (don’t delete directly; use DISM)
   • C:\Windows\SoftwareDistribution\Download — pending Windows Update cache
   • C:\ProgramData\Microsoft\Windows Defender\Definition Updates — old definitions
   • C:\hiberfil.sys — hibernation file (matches RAM size)
   • C:\pagefile.sys — virtual memory swap file
6. Use the File View tab to find individual oversized files — sort by Size column.

WizTree shows files Windows hides because it bypasses the file enumeration API entirely. You see everything.

Method 2: Enable hidden + system file visibility in Explorer

For built-in tools only. Slower than WizTree but doesn’t require downloading anything.

1. Open File Explorer.
2. Click the View menu in the toolbar, choose Show → Hidden items.
3. Click View → Show → File name extensions (helpful for identifying suspicious or oversized files).
4. To also see protected system files: click the three-dot menu in the toolbar → Options → View tab. Untick Hide protected operating system files (Recommended). Click Yes at the warning.
5. Navigate to C:\Users\<you>\AppData → Local and right-click empty space → Properties to see the folder’s total size.
6. Within Local, sort the size column to find heavy subfolders. Browser caches (Chrome, Edge), Discord, Microsoft Teams, and Slack are common culprits.

Re-tick the “Hide protected operating system files” option after you’re done — visible system files in everyday Explorer browsing are a risk for accidental deletion.

Method 3: Check the page file, hibernation file, and System Volume Information

Three large hidden files that often go unnoticed.

1. Open Terminal (Admin).
2. Check page file size: Get-CimInstance Win32_PageFileUsage | Format-List Name, AllocatedBaseSize. Returns size in MB.
3. Check hibernation file: powercfg /a shows hibernation status, and the file itself is at C:\hiberfil.sys. The size matches your installed RAM.
4. To shrink the hibernation file: powercfg /h /size 50 (50% of RAM). To remove it: powercfg /h off.
5. Check System Volume Information (restore points + shadow copies): vssadmin list shadowstorage. Allocated Space shows current usage.
6. Reduce shadow storage: vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=10GB (set a 10 GB cap; adjust as needed).
7. Reduce paging file: Settings → System → About → Advanced system settings → Performance Settings → Advanced → Virtual memory → Change. Set Custom size: Initial 2048 MB, Maximum 8192 MB.

These three together can free 20–40 GB on a 16 GB-RAM PC that’s never been tuned.

How to verify the fix worked

• Re-run WizTree after cleanup. The total used space should drop by the amount you freed.
• Open Settings → System → Storage. The breakdown should show smaller System & reserved if you reduced hibernation and shadow storage.
• Run Get-Volume C | Format-List Size, SizeRemaining in PowerShell to confirm byte-level free space.

If none of these work

If the sum of files WizTree shows still doesn’t match the “Used” figure on the C: drive, NTFS metadata is consuming the discrepancy — usually the MFT, USN journal, and $LogFile. These can grow oversized after years of heavy file churn. Run fsutil usn deletejournal /D C: (caution: requires Volume Shadow Copy disabled first) to clear the USN journal, or accept that 1–3% of drive space is unavoidable NTFS overhead. For drives showing major discrepancies (>10 GB), the issue may be NTFS corruption — run chkdsk C: /f /r from an elevated Command Prompt and let it scan on next boot. Persistent unaccounted space after CHKDSK indicates an actual filesystem-level fault that requires a backup-and-reformat to fully recover.

Bottom line: Hidden disk space is rarely mysterious — WizTree shows you exactly where it went, and the page file, hibernation file, and AppData caches together account for nearly all of it.