MORE INFORMATION
The following information can help you to optimize, repair,
or gain a better understanding of how your NTFS volumes use disk space.
Cluster Size Is Too Large
Only files and folders that include internal NTFS metafiles like
the Master File Table (MFT), folder indexes, and others can consume disk space.
These files and folders consume all the file space allocation by using
multiples of a cluster. A cluster is a collection of contiguous sectors. The
cluster size is determined by the partition size when the volume is formatted.
For additional information about clusters, click the
following article number to view the article in the Microsoft Knowledge Base:
140365
Default Cluster Size for FAT and
NTFS
When a file is created, it consumes a minimum of a
single cluster of disk space, depending on the initial file size. When data is
later added to a file, NTFS increases the file's allocation in multiples of the
cluster size.
To determine the current cluster size and volume
statistics, run a read-only
chkdsk command from a command prompt. To do so, follow these steps :
- Click Start, click Run,
type cmd, and then click OK.
- At the command prompt, type the following command:where d: is the letter of the drive
that you want to check.
- Click OK.
- View the resulting output. For example:
4096543 KB total disk space. <--- Total formatted disk capacity.
2906360 KB in 19901 files. <--- Space used by user file data.
6344 KB in 1301 indexes. <--- Space used by NTFS indexes.
0 KB in bad sectors. <--- Space lost to bad sectors.
49379 KB in use by the system. <--- Includes MFT and other NTFS metafiles.
22544 KB occupied by the log file. <--- NTFS Log file - (Can be adjusted using chkdsk /L:size)
1134460 KB available on disk. <--- Available FREE disk space
4096 bytes in each allocation unit. <--- Cluster Size. (4K)
1024135 total allocation units on disk. <--- Total Clusters on disk.
283615 allocation units available on disk. <--- Available free clusters.
Note: Multiply each value that the output reports in kilobytes (KB) by
1024 to determine accurate byte counts. For example: 2906360 x 1024 =
2,976,112,640 bytes.
You can use this information to determine how your disk space
is being used and the default cluster size. To determine whether this is the
optimal cluster size, you must determine the wasted space on your disk. To do
so, follow these steps:
- Click Start, click My
Computer, and then double-click the drive letter (for example, D) of
the volume in question to open the volume and display the folders and files
that the root contains.
- Click any file or folder, and then click Select
All on the Edit menu.
- With all the files and folders selected, right-click any
file or folder, click Properties, and then click the
General tab.
The General tab
displays the total number of files and folders on the whole volume and provides
two file size statistics: SIZE and SIZE ON
DISK.
If you are not using NTFS compression for any files or folders
contained on the volume, the difference between SIZE and SIZE ON DISK may
represent some wasted space because the cluster size is larger than necessary.
You may want to use a smaller cluster size so that the SIZE ON DISK value is as
close to the SIZE value as possible. An large difference between the SIZE ON
DISK and the SIZE value indicates that the default cluster size is too large
for the average file size that you are storing on the volume.
You can
only change the cluster size you are using by reformatting the volume. To do
this, back up the volume, and then format the volume by using the
format command and the
/a switch to specify the appropriate allocation. For example:
(This example uses a 2-KB cluster size).
Note: Alternately, you can enable NTFS compression to regain space
that you lost because of an incorrect cluster size. However, this may result in
decreased performance.
Back to
TopFile Attributes or NTFS Permissions
Both Windows Explorer and the directory list command
dir /a /s display the total file and folder statistics for only those files
and folders that you have permissions to access. By default, Files hidden files
and protected operating system files are excluded. This behavior may cause
Windows Explorer or the
dir command to display inaccurate file and folder totals and size
statistics.
To include these types of files in the overall statistics,
change Folder Options. To do so, follow these steps :
- Click Start, click My
Computer, and then double-click the drive letter (for example:
D) of the volume. This opens the volume and displays the
folders and files that the root contains.
- On the Tools menu, click Folder
Options, and then click the View tab.
- Select the Show Hidden Files and Folders
check box, and then click to clear the Hide protected operating system
files check box.
- Click Yes when you receive the warning
message, and then click the Apply button.
This change permits Windows Explorer and the
dir /a /s command to total all the files and folders that the volume
contains that the user has permissions to access.
To determine the
folders and files that you cannot access, follow these steps:
- At the command prompt, create a text file from the output
of the dir /a /s command.
For example: At the command prompt, type the
following command: dir
d: /a /s >c:\d-dir.txt
- Start the Backup or Restore Wizard. To do so:
- Click Start, click
Run, type ntbackup, and then click
OK.
- Click Advanced Mode.
- Click Options on the
Tools menu, click the Backup Log tab, click
Detailed, and then click OK.
- In the Backup Utility, click the Backup
tab, and then select the check box for the whole volume that is affected (for
example: D:), and then click Start Backup.
- After the backup is complete, open the backup report and
compare folder for folder the NTBackup log output with the d-dir.txt output that you saved in step 1.
Because backup can access all the files, its report may contain
folders and files that Windows Explorer and the
dir command do not display. You may find it easier to use the
NTBackup interface to locate the volume without backing up the volume when you
want to search for large files or folders that you cannot access by using
Windows Explorer.
After you locate the files that you do not have
access to, you can add or change permissions by using the
Security tab while you view the properties of the file or
folder in Windows Explorer. By default, you cannot access the System Volume
Information folder. You must add the correct permissions to include the folder
in the
dir /a
/s command.
Note: You may notice folders or files that do not have a
Security tab. Or, you may not be able to re-assign permissions
to the affected folders and files. You may receive the following error message
when you try to access them:
D:\folder_name\ is not
accessible
Access is denied
If you have any such folders,
contact Microsoft Product Support Services for additional help. To do so, visit
the following Microsoft Web site:
Back to TopInvalid File Names
Folders or files that contain invalid or reserved file names may
also be excluded from file and folder statistics. Folders or files that contain
leading or trailing spaces are valid in NTFS, but they are not valid from a
Win32 subsystem point of view. Therefore, neither Windows Explorer nor a
command prompt can reliably work with them.
For additional
information, click the following article number to view the article in the
Microsoft Knowledge Base:
120716
How to Remove Files with Reserved Names in Windows NT
You may not be able to rename or delete these
files or folders. When you try to do so, you may receive one of the following
error messages:
Error renaming file or
folder
Cannot rename file: Cannot read from the source file or disk.
-or-
Error deleting file or folder
Cannot delete file: Cannot read from the source file or disk.
If you have folders or files that you cannot delete or rename,
contact Microsoft Product Support Services. To do so, visit the following
Microsoft Web site:
Back to TopNTFS Master File Table (MFT) Expansion
When an NTFS volume is created and formatted, NTFS metafiles are
created. One of these metafiles is named the Master File Table (MFT). It is
very small when it is created (approximately 16 KB), but it grows as files and
folders are created on the volume. When a file is created, it is entered in the
MFT as a File Record Segment (FRS). The FRS is always 1024 bytes (1 KB). As
files are added to the volume, the MFT grows. However, when files are deleted,
the associated FRSs are marked as free for reuse, but the total FRSs and
associated MFT allocation remains. That is why you do not regain the space used
by the MFT after you delete a large number of files, .
To see exactly
how large the MFT is, you can use the built-in defragmenter to analyze the
volume. The resulting report provides detailed information about the size and
number of fragments in the MFT.
For example:
Master File Table (MFT) fragmentation
Total MFT size = 26,203 KB
MFT record count = 21,444
Percent MFT in use = 81 %
Total MFT fragments = 4
However, for more complete information about how much space (overhead)
the whole NTFS is using, run the
chkdsk.exe command, and then view the output for the following line:
In use by system.
Currently, only third-party defragmenters consolidate unused MFT FRS
records and reclaim unused MFT allocated space.
Back to TopAlternate Data Streams
NTFS permits files and folders to contain alternate data streams.
With this feature, you can associate multiple data allocations with a single
file or folder. The use of alternate data streams on files and folders has the
following limitations:
- Windows Explorer and the dir command do not report the data in alternate data streams as part
of the file size or volume statistics. Instead, they show only the total bytes
for the primary data stream.
- The output from chkdsk accurately reports the space that a user's data files use,
including alternate data streams.
- Disk quotas accurately track and report all data stream
allocations that are part of a user's data files.
- NTBackup records the number of bytes backed up in the
backup log report. However it does not show which files contain alternate data
streams. It also does not show accurate file sizes for files that include data
in alternate streams.
Back to TopNTFS File System Corruption
In very rare circumstances, the NTFS Metafiles $MFT or $BITMAP may
become corrupted and result in lost disk space. You can identify and fix this
issue by running the
chkdsk /f command against the volume. Toward the end of
chkdsk, you receive the following message if you must adjust the
$BITMAP:Correcting errors in the master file table's
(MFT) BITMAP attribute. CHKDSK discovered free space marked as allocated in the
volume bitmap. Windows has made corrections to the file
system.
Back to TopOther NTFS Features That May Cause File Allocation Confusion
NTFS also supports hard links and reparse points that permit you
to create volume mount points and directory junctions. These additional NTFS
features may cause confusion when you try to determine how much space a
physical volume is consuming.
A
hard link is a directory entry for a file regardless of where the file data
is located on that volume. Every file has at least one hard link. On NTFS
volumes, each file can have multiple hard links, and therefore a single file
can appear in many folders (or even in the same folder with different names).
Because all the links refer to the same file, programs can open any of the
links and modify the file. A file is deleted from the file system only after
all the links to it are deleted. After you create a hard link, programs can use
it like any other file name.
Note: Windows Explorer and a command prompt show all linked files as
being the same size, even though they all share the same data and do not
actually use that amount of disk space.
Volume mount points and
directory junctions permit an empty folder on an NTFS volume to point to the
root or subfolder on another volume. Windows Explorer and a
dir /s command follow the reparse point, count any files and folders on
the destination volume, and then include them in the host volume's statistics.
This may mislead you to believe that more space is being used on the host
volume than what is actually being used. For additional
information, click the following article number to view the article in the
Microsoft Knowledge Base:
205524
How to Create and Manipulate NTFS Junction Points
In summary, you can use
chkdsk output, NTBackup GUI or backup logs, and the viewing of disk
quotas to determine how disk space is being used on a volume. However, Windows
Explorer and the
dir command have some limitations and drawbacks when used for this
purpose.
Back to
Top