NTFS file statistics go awry

Look at the reasons why an NTFS disk can fill -- or appear to fill -- too quickly and how you can try to determine the root of the problem.

Please let us know how useful you find this tip by rating it below. Do you have a useful Windows tip, timesaver or workaround to share? Submit it to our tip contest and you could win a prize!


In part one I discussed how compromised systems and corrupted disks can be two possible causes of an NTFS disk that fills too quickly. But there are other factors that can also have this result.

You can check for the problems discussed below from Internet Explorer or from the command line.

  • Hard Links, Volume Mount Points and Directory Junction Points. These don't actually fill disks; they just make it look that way. A hard link is a directory entry for a file. All files have at least one, but NTFS allows multiple hard links to the same file. As a result, you can have several hard links, each reported with the file size, pointing to the same file.

    Volume mount points and directory junction points are constructs that point to files or folders on another volume. This is useful for sophisticated file management, but again it produces inaccurate statistics with the dir /s command or Internet Explorer.

  • Master File Table Expansion. The Master File Table is the basic record of disk structure under NTFS. It starts out at about 16K and every time a file or folder is added to the disk, it adds a 1K record called a File Record Segment (FRS) to the MFT. Since an NTFS disk can hold a great many files and folders, the MFT can take up a substantial portion of the disk.

    The problem with the Master File Table is that deleting files just leaves unused space in the MFT. The FRS is marked as available for use but the total size of the Master File Table doesn't shrink. If you have deleted a lot of small files, this can eat up a significant amount of storage space. This is compounded by the fact that the defragmenter that comes with Windows will not touch the MFT.

    However, the Windows defragmenter will tell you how large and how fragmented the MFT is. If necessary, you can use a third-party defragmenter to shrink the MFT.

  • Invalid file names. If a file name doesn't follow proper NTFS naming conventions, it may not be reported in the file statistics. The most common example of this is a file name with leading or trailing spaces. These are legal under NTFS, but Win32 doesn't handle them reliably.
  • There are several other problems that can cause inaccurate file statistics in NTFS. Microsoft covers these issues in Knowledge Base article, How to Locate and Correct Disk Space Problems on NTFS Volumes.


    Rick Cook has been writing about mass storage since the days when the term meant an 80 K floppy disk. The computers he learned on used ferrite cores and magnetic drums. For the last 20 years he has been a freelance writer specializing in storage and other computer issues.
    This was first published in July 2005

    Dig deeper on Windows File Management

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    -ADS BY GOOGLE

    SearchServerVirtualization

    SearchCloudComputing

    SearchExchange

    SearchSQLServer

    SearchWinIT

    SearchEnterpriseDesktop

    SearchVirtualDesktop

    Close