Article ID: 814594 - View products that this article applies to.
For a Microsoft Windows 2000 version of this article, see the following Knowledge Base article:
(http://support.microsoft.com/kb/303079/EN-US/ )How to Locate and Correct Disk Space Problems on NTFS Volumes
This article discusses how to check an NTFS file system's disk space allocation to discover offending files and folders or look for volume corruption in Windows Server 2003-based computers.
NTFS supports many volume and file-level features that may lead to what appear to be lost or incorrectly reported free disk space. For example, an NTFS volume may suddenly appear to become very full for no reason, and an administrator cannot find the cause or locate the offending folders and files. This may occur if malicious or unauthorized access to an NTFS volume where very large files or a high quantity of small files are secretly copied has occurred. These files then have their NTFS permissions removed or restricted. This behavior may also occur after a computer malfunction or power outage occurs that cause volume corruption.
The disk space allocation of an NTFS volume may appear to be misreported for any of the following reasons:
The following information can help you to optimize, repair, or gain a better understanding of how your NTFS volumes use disk space.
140365When a file is created, it consumes a minimum of a single cluster of disk space, depending on the initial file size. When data is later added to a file, NTFS increases the file's allocation in multiples of the cluster size.
(http://support.microsoft.com/kb/140365/EN-US/ )Default Cluster Size for FAT and NTFS
To determine the current cluster size and volume statistics, run a read-only chkdsk command from a command prompt. To do so, follow these steps :
You can only change the cluster size you are using by reformatting the volume. To do this, back up the volume, and then format the volume by using the format command and the /a switch to specify the appropriate allocation. For example:
format D: /a:2048(This example uses a 2-KB cluster size).
Note: Alternately, you can enable NTFS compression to regain space that you lost because of an incorrect cluster size. However, this may result in decreased performance.
To include these types of files in the overall statistics, change Folder Options. To do so, follow these steps :
To determine the folders and files that you cannot access, follow these steps:
After you locate the files that you do not have access to, you can add or change permissions by using the Security tab while you view the properties of the file or folder in Windows Explorer. By default, you cannot access the System Volume Information folder. You must add the correct permissions to include the folder in the dir /a /s command.
Note: You may notice folders or files that do not have a Security tab. Or, you may not be able to re-assign permissions to the affected folders and files. You may receive the following error message when you try to access them:
If you have any such folders, contact Microsoft Product Support Services for additional help. To do so, visit the following Microsoft Web site:
D:\folder_name\ is not accessible
Access is denied
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/120716/EN-US/ )How to Remove Files with Reserved Names in Windows NT
You may not be able to rename or delete these files or folders. When you try to do so, you may receive one of the following error messages:
Error renaming file or folder
Cannot rename file: Cannot read from the source file or disk.
If you have folders or files that you cannot delete or rename, contact Microsoft Product Support Services. To do so, visit the following Microsoft Web site:
Error deleting file or folder
Cannot delete file: Cannot read from the source file or disk.
To see exactly how large the MFT is, you can use the built-in defragmenter to analyze the volume. The resulting report provides detailed information about the size and number of fragments in the MFT.
However, for more complete information about how much space (overhead) the whole NTFS is using, run the chkdsk.exe command, and then view the output for the following line:
Currently, only third-party defragmenters consolidate unused MFT FRS records and reclaim unused MFT allocated space.
A hard link is a directory entry for a file regardless of where the file data is located on that volume. Every file has at least one hard link. On NTFS volumes, each file can have multiple hard links, and therefore a single file can appear in many folders (or even in the same folder with different names). Because all the links refer to the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all the links to it are deleted. After you create a hard link, programs can use it like any other file name.
Note: Windows Explorer and a command prompt show all linked files as being the same size, even though they all share the same data and do not actually use that amount of disk space.
Volume mount points and directory junctions permit an empty folder on an NTFS volume to point to the root or subfolder on another volume. Windows Explorer and a dir /s command follow the reparse point, count any files and folders on the destination volume, and then include them in the host volume's statistics. This may mislead you to believe that more space is being used on the host volume than what is actually being used. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/205524/EN-US/ )How to Create and Manipulate NTFS Junction Points
In summary, you can use chkdsk output, NTBackup GUI or backup logs, and the viewing of disk quotas to determine how disk space is being used on a volume. However, Windows Explorer and the dir command have some limitations and drawbacks when used for this purpose.
For more information, visit the following Microsoft Web site:
For help with common system maintenance tasks in Windows Vista, visit the following Microsoft Web page:
Fix problems with common system maintenance tasks
Article ID: 814594 - Last Review: October 29, 2009 - Revision: 6.0