Article ID: 315688 - View products that this article applies to.
This article was previously published under Q315688
For a Microsoft Windows 2000 version of this article, see 303079
The NTFS file system supports many volume- and file-level features that may cause free disk space to be either misreported or reported as lost. You may notice this behavior if an NTFS volume suddenly becomes very full, and you cannot find the cause or locate the folders and files that cause the NTFS volume to become full. This behavior may occur if a user gains malicious or unauthorized access to an NTFS volume on which either very large files or a high quantity of small files are secretly copied, and then removes or restricts NTFS permissions on these files. This behavior may also occur after a system malfunction or a power outage that causes volume corruption to occur.
This article describes how to check NTFS disk space allocation to either discover offending files and folders or locate volume corruption. This article is intended for users of Windows XP operating systems that support advanced storage features and troubleshooting methods.
The disk space allocation of an NTFS volume may be misreported for any of the following reasons:
The Cluster Size Is Too LargeDisk space can be consumed only by files and folders that include internal NTFS metafiles, for example the MFT, folder indexes, and so on. Multiples of a cluster consume all file space allocation. A cluster is a collection of contiguous sectors. The cluster size is determined at the time that the volume is formatted and is further determined by the partition size.
For more information about clusters, click the following article number to view the article in the Microsoft Knowledge Base:
140365After a file is created, it consumes the minimum size of a single cluster of disk space, depending on the initial file size. After you add data to a file, NTFS increases the file's allocation in multiples of the cluster size.
(http://support.microsoft.com/kb/140365/ )Default cluster size for FAT and NTFS
To determine the current cluster size and volume statistics, run the following command from a command prompt:
chkdsk d:The following text is an example of the output that is displayed if you run this command:
4096543 KB total disk space.Note Multiply each value that is reported in kilobytes (KB) by 1024 to determine the accurate byte size (for example, 2,906,360 x 1024 = 2,976,112,640 bytes).
(This value is the total formatted disk capacity.)
2906360 KB in 19901 files.
(This value is the space used by user file data.)
6344 KB in 1301 indexes.
(This value is the space used by NTFS indexes.)
0 KB in bad sectors.
(This value is the space lost to bad sectors.
49379 KB in use by the system.
(This value is includes MFT and other NTFS metafiles.)
22544 KB occupied by the log file.
(This value is the NTFS Log file; you use the chkdsk /l:size to adjust this value.)
1134460 KB available on disk.
(This value is the available FREE disk space.)
4096 bytes in each allocation unit.
(This value is the cluster size [4K])
1024135 total allocation units on disk.
(This value is the total clusters on disk.)
283615 allocation units available on disk. (This value is the available free clusters.)
Review this output to determine the default cluster size and how your disk space is being used. To see if the cluster is using the optimal cluster size, determine the amount of wasted space:
format D: /a:2048Alternatively, you can enable NTFS compression to regain space that is lost because of an incorrect cluster size; however, if you do so, you may experience a slight decrease in performance.
File Attributes or NTFS PermissionsYou can use either Windows Explorer or the dir /a /s folder list command to report the file and folder statistics for only those files and folders that you have permissions to access. Hidden files and protected operating system files are always excluded from this report by default. Because some folders are excluded, inaccurate file and folder totals and size statistics may be displayed by Windows Explorer or dir command outputs. To include these types of files in the overall statistics, change Folder Options:
To determine the folders and files that cannot be accessed:
After you locate files to which you do not have access, open the file or folder's properties in Windows Explorer, click the Security tab, and then add or change permissions so that the folder is in included in the dir /a /s command output. By default, you do not have access to the System Volume Information folder.
NOTE: You may find that some of the folder or file properties do not contain a Security tab, or you may find that you cannot re-assign permissions to the affected folders and files. You may receive the following error message while you try to access these files:
If you find these types of folders, contact Microsoft Product Support Services for additional assistance. To contact Microsoft Product Support Services, visit the following Microsoft Web site:
D:\folder_name\ is not accessible
Access is denied
Invalid File NamesFolders or files that contain invalid or reserved file names may also be excluded from file and folder statistics. Folders or files that contain leading or trailing spaces are acceptable in NTFS; however, these files are not acceptable in the Win32 subsystem. Therefore, neither Windows Explorer nor a command prompt can reliably handle files that have leading or trailing spaces.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
120716Typically, it is not possible to rename or delete files or folders that have leading or trailing spaces. If you try to rename or delete these folders of files, you may receive one of the following error messages:
(http://support.microsoft.com/kb/120716/ )How to remove files with reserved names in Windows
Error renaming file or folder
Cannot rename file: Cannot read from the source file or disk.
If you have folders or files that you cannot delete or rename, contact Product Support Services at the following Microsoft Web site:
Error deleting file or folder
Cannot delete file: Cannot read from the source file or disk.
NTFS MFT ExpansionAfter you create and format an NTFS volume, NTFS metafiles are created. One of these metafiles is called the "Master File Table" (MFT). This file is very small when it is created (approximately 16 KB), but it grows as files and folders are created on the volume. When a file is created, it is entered into the MFT as a file record segment, which is always 1024 bytes (1 KB) in size. As files are added to the volume, the MFT grows as required. However, when you delete files, the associated file record segments are marked as free to be reused, but the total file record segments and associated MFT allocation remains the same. This behavior explains why you do not regain the space that is used by the MFT after you delete a large number of files.
To determine the exact size of the MFT, use the built-in disk defragmenter utility to analyze the volume. View the defragmenter report to obtain detailed information about the size and number of fragments in the MFT.
The following text is an example of the defragmenter report:
For a more complete picture of how much space (overhead) is being used by the entire NTFS file system, run the chkdsk command, and then view resulting output for the following line:
Master File Table (MFT) fragmentation Total MFT size = 26,203 KB MFT record count = 21,444 Percent MFT in use = 81 % Total MFT fragments = 4
In use by system.Currently, only third-party defragmenter utilities consolidate unused MFT file record segment records and reclaim unused MFT allocated space.
Alternate Data StreamsNTFS allows files and folders to contain alternate data streams. This feature allows multiple data allocations to be associated with a single file or folder. Please be aware of the following limitations when you use alternate data streams on files and folders:
J:\>streams.exe -s *
>c:\ADS.TXT Contents of ADS.TXT
Streams v1.5 - Enumerate alternate NTFS data streams Copyright (C) 1999-2003 Mark Russinovich Sysinternals - www.sysinternals.com
J:\alternate.txt: :mikes_data:$DATA 412440576 <---- LARGE DATA STREAM
J:\myfile.txt: :CA_INOCULATEIT:$DATA 512 <-- small data stream
J:\backup_gui.JPG: :CA_INOCULATEIT:$DATA 512
J:\RECYCLER\S-1-5-21-124525095-708259637-1543119021-5678\desktop.ini: :CA_INOCULATEIT:$DATA 512
J:\RECYCLER\S-1-5-21-124525095-708259637-1543119021-5678\INFO2: :CA_INOCULATEIT:$DATA 512 **/>>
NTFS File System CorruptionIn very rare circumstances, the NTFS $MFT or $BITMAP metafiles may become corrupted and result in lost disk space. To identify and fix this issue, run the chkdsk /F command against the volume in question. Toward the end of chkdsk process, you receive the following message if the $BITMAP metafile needs to be adjusted:
Correcting errors in the master file table's (MFT) BITMAP attribute. CHKDSK discovered free space marked as allocated in the volume bitmap. Windows has made corrections to the file system.
Other NTFS Features That May Cause File Allocation ConfusionNTFS also supports hard links and reparse points that allow volume mount points and folder junctions to be created. These additional NTFS features may cause confusion when you try to determine how much space is being consumed on a physical volume.
A hard link is a folder entry for a file regardless of where the actual file data exists on that volume. Every file is considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links; therefore, a single file can be displayed in many folders (or even in the same folder with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all of the links to it have been deleted. After you create a hard link, programs can use the link like any other file name. Note that Windows Explorer and a command prompt will show all linked files as being the same size, even though they all share the same data and do not actually use that amount of disk space.
Volume mount points and folder junctions allow an empty folder on an NTFS volume to point to the root or subfolder on another volume. Windows Explorer and the dir /s command follow the reparse point, count any files and folders on the destination volume, and then include them in the host volume's statistics. This behavior may lead you to believe that more space is being used on the host volume than what is actually being used. For more information about junction points, click the following article number to view the article in the Microsoft Knowledge Base:
205524In summary, use the following methods to correctly determine how the disk space is being used on a volume:
(http://support.microsoft.com/kb/205524/ )How to create and manipulate NTFS junction points
For help with common system maintenance tasks in Windows Vista, visit the following Microsoft Web page:
Fix problems with common system maintenance tasks