Article ID: 303079 - View products that this article applies to.
This article was previously published under Q303079
NoticeThis article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center
(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fwin2000)is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy
The NTFS file system supports many volume and file-level features that may lead to what appears to be lost or misreported free disk space. This behavior may be apparent when an NTFS volume suddenly becomes very full for no reason, and yet an administrator cannot find the cause or locate the offending folders and files. This sometimes occurs because of malicious or unauthorized access to an NTFS volume on which very large files or a high quantity of small files are secretly copied, which then have their NTFS permissions removed or restricted. This behavior may also occur after a system malfunction or power outage occurs, causing volume corruption.
This article discusses how to check an NTFS file systems disk space allocation to discover offending files and directories or check for volume corruption. This article is intended for Windows 2000-and-later operating systems that support some advanced storage features and troubleshooting methods; however Windows NT users may also find this article useful. The following is a short list of reasons why the disk space allocation of an NTFS volume may appear to be misreported:
Please use the following information to help optimize, repair, or gain a better understanding of how disk space is used on your NTFS volume or volumes.
Cluster size is too largeDisk space can be consumed only by files and directories that include internal NTFS metafiles like the Master File Table (MFT), directory indexes, and so forth. All file space allocation is consumed by using multiples of a cluster. A cluster is a collection of contiguous sectors. The cluster size is determined at the time the volume is formatted, and is further determined by the partition size. For more information about clusters, click the following article number to view the article in the Microsoft Knowledge Base:
140365When a file is first created, it consumes a minimum of a single cluster of disk space, depending on the initial file size. When data is later added to a file, NTFS increases the file's allocation in multiples of the cluster size.
(http://support.microsoft.com/kb/140365/ )Default cluster size for FAT and NTFS
To determine the current cluster size and volume statistics, run a read-only chkdsk command from a command prompt, as follows
IE: Chkdsk D:and then view the resulting output. For example:
NOTE: Multiply each value that is reported in kilobytes (KB) by 1024 to determine accurate byte counts. For example: 2906360 x 1024 = 2,976,112,640 bytes.
4096543 KB total disk space. <--- Total formatted disk capacity. 2906360 KB in 19901 files. <--- Space used by user file data. 6344 KB in 1301 indexes. <--- Space used by NTFS indexes. 0 KB in bad sectors. <--- Space lost to bad sectors. 49379 KB in use by the system. <--- Includes MFT and other NTFS metafiles. 22544 KB occupied by the log file. <--- NTFS Log file - (Can be adjusted using chkdsk /L:size) 1134460 KB available on disk. <--- Available FREE disk space 4096 bytes in each allocation unit. <--- Cluster Size. (4K) 1024135 total allocation units on disk. <--- Total Clusters on disk. 283615 allocation units available on disk. <--- Available free clusters.
By using this output, you can determine how your disk space is being used, along with the default cluster size. To see if this is the optimal cluster size, determine the amount of wasted space by following these steps:
IE: format D: /a:2048(This example uses a 2-KB cluster size).
NOTE: Alternately, you can enable NTFS compression to regain space lost because of an incorrect cluster size; however, this may result in a slight decrease in performance.
File attributes or NTFS permissionsBoth Windows Explorer and the following directory list command
DIR /A /Swill total file and directory statistics for only those files and directories that you have permissions to access. Files always excluded by default include all hidden files and protected operating system files. This behavior may result in inaccurate file and folder totals and size statistics to be displayed by Windows Explorer or DIR command outputs. To include these types of files in the overall statistics, change Folder Options by following these steps:
To determine which directories and files cannot be accessed, follow these steps:
After you locate files that you don't have access to, you should be able to add or change permissions by using the Security tab while you view the properties of the file or directory in Windows Explorer. By default, you will not have access to the System Volume Information directory. You will need to add the appropriate permissions for the directory to be included in the DIR /A /S command.
NOTE: You may run across directories or files that have no security tab, or find that you cannot re-assign permissions to the affected folders and files. You may receive the following error message while you try to access them:
If you have any such directories, contact Product Support Services for additional assistance at the following Microsoft Web site:
D:\directory_name\ is not accessible
Access is denied
Invalid file namesDirectories or files that contain invalid or reserved file names may also be excluded from file and directory statistics. Directories or files that contain leading or trailing spaces are perfectly legal from an NTFS file system perspective, but are not legal from a Win32 subsystem point of view, and therefore, neither Windows Explorer nor a command prompt can reliably handle them. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
120716Often times it is not possible to rename or delete these files or folders. When you attempt to rename or delete them, you may receive one of the following error messages:
(http://support.microsoft.com/kb/120716/ )How to Remove Files with Reserved Names in Windows
Error renaming file or folder
Cannot rename file: Cannot read from the source file or disk.
If you have directories or files that cannot be deleted or renamed, contact Product Support Services at the following Microsoft Web site:
Error deleting file or folder
Cannot delete file: Cannot read from the source file or disk.
NTFS Master File Table (MFT) expansionWhen an NTFS volume is first created and formatted, NTFS metafiles are created. One of these metafiles is called the Master File Table (MFT). It is very small when first created (approximately 16 KB), but it grows as files and directories are created on the volume. When a file is first created, it is entered into the MFT as a File Record Segment (FRS), which is always 1024 bytes (1 KB) in size. As files are added to the volume, the MFT grows as required. However, when files are deleted, the associated FRSs are marked as free to be reused, but the total FRSs and associated MFT allocation remains. This explains why, after deleting a large number of files, you don't regain the space used by the MFT.
To see exactly how large the MFT is, you can use the built-in defrag utility to analyze the volume. The resulting defrag report provides detailed information about the size and number of fragments in the MFT.
However, for a more complete picture of how much space (overhead) is being used by the entire NTFS file system, perform a chkdsk, and then look at the resulting output for the following line:
Master File Table (MFT) fragmentation Total MFT size = 26,203 KB MFT record count = 21,444 Percent MFT in use = 81 % Total MFT fragments = 4
In use by system.Currently, only third-party defrag utilities consolidate unused MFT FRS records and reclaim unused MFT allocated space.
Alternate data streamsNTFS allows files and directories to contain alternate data streams. This feature allow multiple data allocations to be associated with a single file or directory. Please be aware of the following limitations when you use alternate data streams on files and directories.
When a file or directory contains alternate data streams:
NTFS File system corruptionIn very rare circumstances, the NTFS Metafiles $MFT or $BITMAP may become corrupted and result in lost disk space. This issue can be identified and fixed by running a chkdsk /F against the volume in question. Toward the end of chkdsk, you receive the following message if the $BITMAP needs to be adjusted:
Correcting errors in the master file table's (MFT) BITMAP attribute.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
Other NTFS features that may cause file allocation confusionNTFS also supports hard links and reparse points that allow volume mount points and directory junctions to be created. These additional NTFS features may cause confusion when you try to determine how much space is being consumed on a physical volume.
A hard link is a directory entry for a file regardless of where the actual file data exists on that volume. Every file can be considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links, and therefore a single file can appear in many directories (or even in the same directory with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all links to it have been deleted. After you create a hard link, programs can use it like any other file name. Keep in mind that Windows Explorer and a command prompt will show all linked files as being the same size, even though they all share the same data and don't actually use that amount of disk space.
Volume mount points and directory junctions allow an empty folder on an NTFS volume to point to the root or subfolder on another volume. Windows Explorer and a DIR /s command follow the reparse point, count any files and directories on the destination volume, and include them in the host volume's statistics. This may lead you to believe that more space is being used on the host volume than what is actually being used. For more information about junction points, click the following article number to view the article in the Microsoft Knowledge Base:
205524In summary, chkdsk output, NTBackup GUI or backup logs, and the viewing of disk quotas are all good methods of determining how disk space is being used on a volume. On the other hand, Windows Explorer and the DIR command have some limitations and drawbacks when used for this purpose.
(http://support.microsoft.com/kb/205524/ )How to create and manipulate NTFS junction points