Loosing Disk Space

Something is eating up the space on my small C drive (30GB partition out of a 1TB Raid 5 array). I can loose 2GB in a day or two. When I run Disk Cleanup, there's usually very little to recover on the main tab. When I select 'System Restore and Shadow Copies' I get most of it back only to have it disappear again in a few days. My paging files are on a separate non-RAID drive and I've set all work areas pointers I could find to the D drive. When I look at sysinternals process explorer, the two largest IO writers (to any drive) by far are mozybackup and lsass.exe. I'm pretty sure I've set all the work files for Mozy to the D drive. I also noticed that lsass.exe in constantly doing IO writes. Any help would be appreciated. Also any recommendations for a tool to look more closely at what is writing to my C drive would be great

Curt