Low disk space in recovery drive E

Okay, sorry about acronyms.

Sounds like a nice laptop. Did somebody upgrade it for you to have two storage drives, your ssd and hdd?

Okay then I would not delete E:, HP likley put it there to get it off your Solid State Drive as it isn't very big. In some ways this is good this happened as you will run out of room of C: quick enough.

Do the audit and get and documents or pictures off E: that aren't on C: using the procedure I previously described (opening two file explorers and line them up side by side.)

When you are sure you have everything then you could delete a few of those duplicate directories to stop the warning message.

It is unfortunate but I guess HP and the stores think everyone does this for a living and will know how to set up a dual drive system, they don't.

Your machine has a SSD for the boot drive and your programs. It then has a larger, slower Hard Disk Drive for bulk storage of documents. This makes your machine boot fast and programs load quickly. The data speed is not that important, you read and load a file, work on it and save it again.

Having your boot on another drive allows for complete re-installs knowing your data is safe on another drive / partition.

Windows has facilities to move your data folders (libraries) to your data drive, in this case D:. As far as you the users are concerned they are in a library, lets say Documents, and you use them not really caring if they are on C: or D:. Of course you do need to know they are on D: but most if not all tasks you perform happen regardless. You open explorer, you click on documents, you find what you need.

Here is one tutorial on moving your Documents library from C: to D:.

http://How to Move Your Documents Fo... in Windows 10

There is a whole series, moving documents, pictures, music etc.

We are a little off topic. Let's get the E: resolved.

All of the files were empty except the one labeled "Recovery". I decided to give HP a chance at helping and clicked on "HP Support Official Site" https://www.support.hp.com." After a few clicks, got on "Chat" with someone named "Prabir" and turned remote control over to him (her?) by downloading "Log Mein.exe" He removed all but the "Recovery" file and stored them to a file called "Moved Files" on Drive C. At some point he indicated that it was complete and that he would then test to see if it was OK and that he would call me on the phone when it was complete. That's when things got interesting !
Here is what I think went on: I think a hacker somehow intercepted the connection and called me. The hacker with a very heavy Indian accent told me that I couldn't possibly be communicating with anybody at HP because it was Saturday and HP would be closed. He told me to find the "Off" switch on my router and turn it off. I think that was a "fool's errand" to occupy me while I tried to find the non-existent "Off" switch while he tried to figure out how to get into my computer because there is no "Off" switch on a router. He then started telling me what keys to press on my computer in order to stop the hacker pretending to be from HP. I think he was trying to prevent Windows Defender from keeping him out of my computer. At that point, I turned off my computer and hung up the phone. I never did get a call back from HP and, when I went back on my computer, I saw a "notification" from Windows (the little square at the bottom right of my screen) and was notified that Windows Defender had intercepted a virus called "wanna cry", had quarantined it and would delete it. Then the phone rang again and a woman with a very dark and ominous sounding voice told me that my Windows license had expired and "blah, blah, blah".... (I'm pretty sure you know the rest of that Phishing line.) I, of course, hung up on her.
Anyway, I'm no longer getting the "running low on space" message and my Recovery Drive (E) has 1.42 GB free of 11.6 GB. My Drive E is completely empty except for the file called "Recovery". I tried opening it to see what was in there and all I can get is a message telling me not to mess with it. I have three questions:
(1) Is it possible to know, when you click on something called "HP Support Official Site", that you are actually connecting to an HP site?
(2) Does my Recovery Drive (E) look right with absolutely nothing on it but a file called "Recovery"?
(3) And, is there a way for me to get a look at what is in that file called "Recovery"?
I'm wondering whether that hacker succeeded in putting a virus in there !!!! I don't think I'm paranoid but I wasn't born yesterday !

Any links on the net can be disguised to look 'official'. Always type in an address like HP.com and you will usually see a circled i, click and it will tell you not to give passwords because it is not a secure site. Just because someone says they work for a company, doesn't necessarily mean they do. Don't be gullible...

Hard to answer all those questions without seeing it.

If you had a link in an HP product that said HP support then you were likely connected to the HP site. I agree with DM, a site on the net can show anything and take you anywhere.

Where did you get this link for HP Support to start this off.

E: likley has more files and for clarity I think you are looking at a folder called recovery, not file. To look inside folder please ensure you have file manager set to see hidden files.

If e: still has a drive letter, which it sounds like it does, then if you right click on folder there should be a Scan with Defender option in the context menu.

Wanna Cry is ransomware, they encrypt your files and demand pieces of Bitcoin. The nice ones unlock your data, the bad ones F_off leaving you stuck. Sometimes they come back for a second helping. Thank god it was blocked. Defender is turning into a quite a product.

So lets figure out where you got this link. Normally I tell my clients if you've let someone into your machine that you can't confirm the only way out with 100% certainty is a rebuild. I would check out the logmeIn product and either uninstall it or ensure it is set so only you can initiate a connection. I don't use product but lots of remote products have two options, you initiate or a remote can initiate.

Concerns me on timing of events. This all sounds connected. Maybe they were running good cop, bad cop routine on your.

Enjoy the skiing.