This article describes how to check NTFS disk space allocation to either discover offending files and folders or locate volume corruption. This article is intended for users of Windows XP operating systems that support advanced storage features and troubleshooting methods.
- The cluster size of the NTFS volume is too large for the average-sized files that are being stored.
- File attributes or NTFS permissions prevent files or folders from being either displayed or accessed when you use either Microsoft Windows Explorer or a Windows command prompt.
- The folder path exceed 255 characters.
- Folders or files contain invalid or reserved file names.
- NTFS metafiles (such as the Master File Table [MFT]) have grown and cannot be unallocated.
- Files or folders contain alternate data streams.
- NTFS corruption causes Windows to report free space as being in use.
- Other NTFS features cause file-allocation confusion.
The Cluster Size Is Too LargeDisk space can be consumed only by files and folders that include internal NTFS metafiles, for example the MFT, folder indexes, and so on. Multiples of a cluster consume all file space allocation. A cluster is a collection of contiguous sectors. The cluster size is determined at the time that the volume is formatted and is further determined by the partition size.
For more information about clusters, click the following article number to view the article in the Microsoft Knowledge Base:
To determine the current cluster size and volume statistics, run the following command from a command prompt:
(This value is the total formatted disk capacity.)
2906360 KB in 19901 files.
(This value is the space used by user file data.)
6344 KB in 1301 indexes.
(This value is the space used by NTFS indexes.)
0 KB in bad sectors.
(This value is the space lost to bad sectors.
49379 KB in use by the system.
(This value is includes MFT and other NTFS metafiles.)
22544 KB occupied by the log file.
(This value is the NTFS Log file; you use the chkdsk /l:size to adjust this value.)
1134460 KB available on disk.
(This value is the available FREE disk space.)
4096 bytes in each allocation unit.
(This value is the cluster size [4K])
1024135 total allocation units on disk.
(This value is the total clusters on disk.)
283615 allocation units available on disk. (This value is the available free clusters.)
Review this output to determine the default cluster size and how your disk space is being used. To see if the cluster is using the optimal cluster size, determine the amount of wasted space:
- Double-click My Computer, and then double-click the drive letter (for example, D) of the volume that you want to check.
- Click any file or folder, and then click Select All on the Edit menu.
- Right-click any file or folder, and then click Properties.
- Click the General tab, and then review the "Size" and "Size on disk" file size values, which calculate the total number of files and folders on the entire volume.
File Attributes or NTFS PermissionsYou can use either Windows Explorer or the dir /a /s folder list command to report the file and folder statistics for only those files and folders that you have permissions to access. Hidden files and protected operating system files are always excluded from this report by default. Because some folders are excluded, inaccurate file and folder totals and size statistics may be displayed by Windows Explorer or dir command outputs. To include these types of files in the overall statistics, change Folder Options:
- Double-click My Computer, and then double-click the drive letter of the volume that you want to check.
- Click Folder Options on the Tools menu, and then click the View tab.
- Click the Show Hidden Files and Folders check box, and then click to clear the Hide protected operating system files check box.
- After you receive the warning message, click Apply.
To determine the folders and files that cannot be accessed:
- From a command prompt, send the output of a dir /a /s to a text file.
For example, run the following command:dir d: /a /s >c:\d-dir.txt
- Start Ntbackup.exe, click Options on the Tools menu, click the Backup Log tab, and then click Detailed.
- Click the Backup tab, back up the entire volume that is affected (in this example, drive D), and then start the backup procedure.
- After the backup procedure is complete, view the backup report, and then compare the folders in the Ntbackup log output with the folders in the output that you saved in a text file in step 1.
After you locate files to which you do not have access, open the file or folder's properties in Windows Explorer, click the Security tab, and then add or change permissions so that the folder is in included in the dir /a /s command output. By default, you do not have access to the System Volume Information folder.
NOTE: You may find that some of the folder or file properties do not contain a Security tab, or you may find that you cannot re-assign permissions to the affected folders and files. You may receive the following error message while you try to access these files:
Access is denied
Invalid File NamesFolders or files that contain invalid or reserved file names may also be excluded from file and folder statistics. Folders or files that contain leading or trailing spaces are acceptable in NTFS; however, these files are not acceptable in the Win32 subsystem. Therefore, neither Windows Explorer nor a command prompt can reliably handle files that have leading or trailing spaces.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
Cannot rename file: Cannot read from the source file or disk.
Cannot delete file: Cannot read from the source file or disk.
NTFS MFT ExpansionAfter you create and format an NTFS volume, NTFS metafiles are created. One of these metafiles is called the "Master File Table" (MFT). This file is very small when it is created (approximately 16 KB), but it grows as files and folders are created on the volume. When a file is created, it is entered into the MFT as a file record segment, which is always 1024 bytes (1 KB) in size. As files are added to the volume, the MFT grows as required. However, when you delete files, the associated file record segments are marked as free to be reused, but the total file record segments and associated MFT allocation remains the same. This behavior explains why you do not regain the space that is used by the MFT after you delete a large number of files.
To determine the exact size of the MFT, use the built-in disk defragmenter utility to analyze the volume. View the defragmenter report to obtain detailed information about the size and number of fragments in the MFT.
The following text is an example of the defragmenter report:
Master File Table (MFT) fragmentation
Total MFT size = 26,203 KB
MFT record count = 21,444
Percent MFT in use = 81 %
Total MFT fragments = 4
Alternate Data StreamsNTFS allows files and folders to contain alternate data streams. This feature allows multiple data allocations to be associated with a single file or folder. Please be aware of the following limitations when you use alternate data streams on files and folders:
- Windows Explorer and the dir command do not report the data in alternate data streams as part of the file size or volume statistics. Instead, they show only the total bytes for the primary data stream.
- The output from the chkdsk command accurately reports space used by a user's data files, including alternate data streams.
- Disk quotas accurately track and report all data stream allocations that are part of a user's data files.
- Ntbackup records the number of bytes that are backed up in the backup log report. However, it does not show which files contain alternate data streams, nor does it show accurate file sizes for files that include data in alternate streams.
J:\>streams.exe -s *
>c:\ADS.TXT Contents of ADS.TXT
Streams v1.5 - Enumerate alternate NTFS data streams Copyright (C) 1999-2003 Mark Russinovich Sysinternals - www.sysinternals.com
J:\alternate.txt: :mikes_data:$DATA 412440576 <---- LARGE DATA STREAM
J:\myfile.txt: :CA_INOCULATEIT:$DATA 512 <-- small data stream
J:\backup_gui.JPG: :CA_INOCULATEIT:$DATA 512
J:\RECYCLER\S-1-5-21-124525095-708259637-1543119021-5678\desktop.ini: :CA_INOCULATEIT:$DATA 512
J:\RECYCLER\S-1-5-21-124525095-708259637-1543119021-5678\INFO2: :CA_INOCULATEIT:$DATA 512 **/>>
NTFS File System CorruptionIn very rare circumstances, the NTFS $MFT or $BITMAP metafiles may become corrupted and result in lost disk space. To identify and fix this issue, run the chkdsk /F command against the volume in question. Toward the end of chkdsk process, you receive the following message if the $BITMAP metafile needs to be adjusted:
Other NTFS Features That May Cause File Allocation ConfusionNTFS also supports hard links and reparse points that allow volume mount points and folder junctions to be created. These additional NTFS features may cause confusion when you try to determine how much space is being consumed on a physical volume.
A hard link is a folder entry for a file regardless of where the actual file data exists on that volume. Every file is considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links; therefore, a single file can be displayed in many folders (or even in the same folder with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all of the links to it have been deleted. After you create a hard link, programs can use the link like any other file name. Note that Windows Explorer and a command prompt will show all linked files as being the same size, even though they all share the same data and do not actually use that amount of disk space.
Volume mount points and folder junctions allow an empty folder on an NTFS volume to point to the root or subfolder on another volume. Windows Explorer and the dir /s command follow the reparse point, count any files and folders on the destination volume, and then include them in the host volume's statistics. This behavior may lead you to believe that more space is being used on the host volume than what is actually being used.
For more information about junction points, click the following article number to view the article in the Microsoft Knowledge Base:
- View the output from the chkdsk command.
- Use the Ntbackup GUI or view the backup logs.
- View the disk quotas.
Article ID: 315688 - Last Review: Oct 29, 2009 - Revision: 1