Jump to content
  • 0

What constitutes "Other"?


Merwinsson

Question

I am managing a drive pool for a third party and am seeing something VERY odd.

WTF.thumb.png.8650a749518ff2038a01a822314b0dfb.png

This drive pool has more "Other" space than space used by drive pool files.

The PROBLEM is this:

WTF2.png.19a4fda2874a69e3a9c9accacde0b4b4.png

There's no data outside the pool folder (on both drives) other than Windows Sysvol info, and that just contains 3 small files about 20K, and the PoolPart folder holds about 213 GB.

What is happening here?  Where is this 400+ GB of "Other" files (per disk)?

Something is fishy!

Link to comment
Share on other sites

12 answers to this question

Recommended Posts

  • 0

Do you run server backup? Server backup can leave stuff in sysvolinfo, terribly annoying, but it tends to clear out when space becomes limited. There was a time that I was OCD enough to try and empty it all out but it is always a pain with first not having access rights (which infuriates me to no end, it's my own goddarn HDD!), then having to take ownership and even that failing. But generally, AFAIK, there is no need to worry.

Link to comment
Share on other sites

  • 0

** EDIT **

The stats are now correct after running the "re-measure" task.

 

------ Old Msg:

I'm seeing the same thing. All my data is inside the poolpart, shadow copies disabled, no system restore, emptied recycle bin... I know my actual data set size is about 1.1TB as you can see so it's reasonable to expect the drive to be used. However, why is it marked as "other"?

Note, I have Pool File Duplication set at 2x, no limitations or restrictions.

 

Monosnap+2018-01-04+11-58-04.jpg

Link to comment
Share on other sites

  • 0

I saw similar weirdity with my LocalPool which consists of SSD and two drives. The SSD also has 75% of it's space dedicated to CloudDrive (proportional) cache and when DrivePool is writing on the drive it almost looks as if it's eating space from the CloudDrive cache instead. Total space used by DrivePool/CloudDrive did not go up at all even though files were being written on it. At the same time. the CloudDrive size decreases the more files are written on the SSD until it's around the % I set to "write" on the cache settings.

I figured maybe the programs are somehow working in tandem and DrivePool is using up the space I've set for "write" on the prop. cache, idk, this didn't go away with balancing/re-measure but it finally sorted itself out as I changed the cache to fixed. I can see such feature being useful in some cases but it wasn't what I wanted.

Link to comment
Share on other sites

  • 0

I have a disturbing update regarding what actually happened to me.  Others may want to pay close attention to this.

As it turns out, in MY CASE, this OTHER crap was actually RANSOMWARE encrypting my files secretly.  YES, I'm not kidding.  Not long after my last post, the system in question rebooted mysteriously.  When it came back up and I logged in I was greeted with a YOUR FILES ARE ENCRYPTED message.  Merry Christmas!

All files on the drive pool had their names changed to random ASCII letters and numbers with the file extension ".lock", and the contents were encrypted.  Welcome to LockCrypt ransomware.  It was a complete loss as I was not able to pay the one bitcoin necessary to undo the hacking.  I did backup everything just in case the DOJ catches these criminals and posts a decryption tool.

But watch out.  Just because you have pool duplication on doesn't mean you're protected from this kind of attack at all.  Both drives/copies of data were encrypted AS WELL as a THIRD copy of the pool contents that was stored on an external usb drive.  And get this...the ransomware IS SMART ENOUGH to bring said external drive out of OFFLINE state to get at its contents.  YA, we were blown away.  We thought that having pool duplication AND an external drive for tertiary backups (brought online ONLY when backing up) was good enough protection.  WE WERE WRONG.  BE WARNED.  Ransomware is now smart enough to infect ANYTHING DIRECTLY ATTACHED to the machine.  Heck, it'll even infect stuff on network drives, if they are writable.

Luckily, financial and student data (this was a school) was stored in the cloud, so while this attack caused me great pain, absolutely critical data was unaffected.

This made me re-think what I'm doing with my personal drive pool at home.  At present it is ONLY duplicated.  Ransomware could sweep right in and ruin my day.  Now I'm pricing another enclosure and more disks for another pool to be used exclusively for a backup plan that includes a Full Backup with daily incrementals that roll back into the Full Backup once a month.  Even then, one must examine their files when rolling the incrementals into the Full backup to make sure they haven't been encrypted.

I have now put hackers above lawyers on my "most despised" list.

Link to comment
Share on other sites

  • 0
58 minutes ago, Merwinsson said:

As it turns out, in MY CASE, this OTHER crap was actually RANSOMWARE encrypting my files secretly.  YES, I'm not kidding.  Not long after my last post, the system in question rebooted mysteriously.  When it came back up and I logged in I was greeted with a YOUR FILES ARE ENCRYPTED message.  Merry Christmas!

On no! >:(

I'm very very sorry to hear that!  And that's ... pretty scary! 

And yes, duplication is redundancy. It protects you against drive failure.  But it doesn't protect against deletion, or modification. 

It's best to have backup *and* redundancy. 

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...