Pattern to record: Available capacity falls sharply although visible folders are small.

Identify the storage layer

BitLocker is an encryption layer, not a file system. The NTFS-specific checks here apply only after the authorised volume is unlocked and its underlying format is confirmed; retain the recovery key before firmware or hardware changes. A configured shadow-copy or backup feature can retain data outside the visible folders; first identify the actual provider rather than assuming every NTFS volume has snapshots.

Protect data before repair

Never clear TPM or format the volume while recovery information is uncertain. Deleting snapshots can remove a recovery point.

Evidence to check on the protected copy

1. Confirm ownership and recovery credentials before testing metadata or hardware changes.
2. Enumerate supported snapshots and backup state before deleting anything.

Recovery and verification

If the checks support this cause, remove only confirmed unnecessary snapshots and correct backup behaviour. Verification should cover authorised unlock, restart, file access, backup and recovery-key documentation.

For an assessment of your encrypted Windows computer, contact AEPC in Burswood or call 027 908 8880. Provide the model and the conditions that reproduce this problem. Workshop visits are by appointment.