NTFS supports many volume and file-level features that may lead to what appear to be lost or incorrectly reported free disk space. For example, an NTFS volume may suddenly appear to become very full for no reason, and an administrator cannot find the cause or locate the offending folders and files. This may occur if malicious or unauthorized access to an NTFS volume where very large files or a high quantity of small files are secretly copied has occurred. These files then have their NTFS permissions removed or restricted. This behavior may also occur after a computer malfunction or power outage occurs that cause volume corruption.
The disk space allocation of an NTFS volume may appear to be misreported for any of the following reasons:
- The NTFS volume's cluster size is too large for the average-sized files that are stored there.
- File attributes or NTFS permissions prevent Windows Explorer or a Windows command prompt from displaying or accessing files or folders.
- The folder path exceeds 255 characters.
- Folders or files contain invalid or reserved file names.
- NTFS metafiles (such as the Master File Table) have grown, and you cannot de-allocate them.
- Files or folders contain alternate data streams.
- NTFS corruption causes free space to be reported as in use.
- Other NTFS features may cause file-allocation confusion.
For additional information about clusters, click the following article number to view the article in the Microsoft Knowledge Base:
To determine the current cluster size and volume statistics, run a read-only chkdsk command from a command prompt. To do so, follow these steps :
- Click Start, click Run, type cmd, and then click OK.
- At the command prompt, type the following command:chkdskwhere d: is the letter of the drive that you want to check.
- Click OK.
- View the resulting output. For example:Note: Multiply each value that the output reports in kilobytes (KB) by 1024 to determine accurate byte counts. For example: 2906360 x 1024 = 2,976,112,640 bytes.
4096543 KB total disk space. <--- Total formatted disk capacity.
2906360 KB in 19901 files. <--- Space used by user file data.
6344 KB in 1301 indexes. <--- Space used by NTFS indexes.
0 KB in bad sectors. <--- Space lost to bad sectors.
49379 KB in use by the system. <--- Includes MFT and other NTFS metafiles.
22544 KB occupied by the log file. <--- NTFS Log file - (Can be adjusted using chkdsk /L:size)
1134460 KB available on disk. <--- Available FREE disk space
4096 bytes in each allocation unit. <--- Cluster Size. (4K)
1024135 total allocation units on disk. <--- Total Clusters on disk.
283615 allocation units available on disk. <--- Available free clusters.
- Click Start, click My Computer, and then double-click the drive letter (for example, D) of the volume in question to open the volume and display the folders and files that the root contains.
- Click any file or folder, and then click Select All on the Edit menu.
- With all the files and folders selected, right-click any file or folder, click Properties, and then click the
The General tab displays the total number of files and folders on the whole volume and provides two file size statistics: SIZE and SIZE ON DISK.
You can only change the cluster size you are using by reformatting the volume. To do this, back up the volume, and then format the volume by using the format command and the /a switch to specify the appropriate allocation. For example:
Note: Alternately, you can enable NTFS compression to regain space that you lost because of an incorrect cluster size. However, this may result in decreased performance.
Back to Topdir /a /s display the total file and folder statistics for only those files and folders that you have permissions to access. By default, Files hidden files and protected operating system files are excluded. This behavior may cause Windows Explorer or the dir command to display inaccurate file and folder totals and size statistics.
To include these types of files in the overall statistics, change Folder Options. To do so, follow these steps :
- Click Start, click My Computer, and then double-click the drive letter (for example:
D) of the volume. This opens the volume and displays the folders and files that the root contains.
- On the Tools menu, click Folder Options, and then click the View tab.
- Select the Show Hidden Files and Folderscheck box, and then click to clear the Hide protected operating system files check box.
- Click Yes when you receive the warning message, and then click the Apply button.
To determine the folders and files that you cannot access, follow these steps:
- At the command prompt, create a text file from the output of the dir /a /s command.
For example: At the command prompt, type the following command:dir d: /a /s >c:\d-dir.txt
- Start the Backup or Restore Wizard. To do so:
- Click Start, click
Run, type ntbackup, and then click
- Click Advanced Mode.
- Click Start, click
- Click Options on the
Tools menu, click the Backup Log tab, click
Detailed, and then click OK.
- In the Backup Utility, click the Backuptab, and then select the check box for the whole volume that is affected (for example: D:), and then click Start Backup.
- After the backup is complete, open the backup report and compare folder for folder the NTBackup log output with the d-dir.txt output that you saved in step 1.
After you locate the files that you do not have access to, you can add or change permissions by using the
Security tab while you view the properties of the file or folder in Windows Explorer. By default, you cannot access the System Volume Information folder. You must add the correct permissions to include the folder in the dir /a /s command.
Note: You may notice folders or files that do not have a
Security tab. Or, you may not be able to re-assign permissions to the affected folders and files. You may receive the following error message when you try to access them:
D:\folder_name\ is not accessible
Access is denied
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
You may not be able to rename or delete these files or folders. When you try to do so, you may receive one of the following error messages:
Cannot rename file: Cannot read from the source file or disk.
Cannot delete file: Cannot read from the source file or disk.
To see exactly how large the MFT is, you can use the built-in defragmenter to analyze the volume. The resulting report provides detailed information about the size and number of fragments in the MFT.
Master File Table (MFT) fragmentation
Total MFT size = 26,203 KB
MFT record count = 21,444
Percent MFT in use = 81 %
Total MFT fragments = 4
In use by system.
Back to Top
- Windows Explorer and the dir command do not report the data in alternate data streams as part of the file size or volume statistics. Instead, they show only the total bytes for the primary data stream.
- The output from chkdsk accurately reports the space that a user's data files use, including alternate data streams.
- Disk quotas accurately track and report all data stream allocations that are part of a user's data files.
- NTBackup records the number of bytes backed up in the backup log report. However it does not show which files contain alternate data streams. It also does not show accurate file sizes for files that include data in alternate streams.
A hard link is a directory entry for a file regardless of where the file data is located on that volume. Every file has at least one hard link. On NTFS volumes, each file can have multiple hard links, and therefore a single file can appear in many folders (or even in the same folder with different names). Because all the links refer to the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all the links to it are deleted. After you create a hard link, programs can use it like any other file name.
Note: Windows Explorer and a command prompt show all linked files as being the same size, even though they all share the same data and do not actually use that amount of disk space.
Volume mount points and directory junctions permit an empty folder on an NTFS volume to point to the root or subfolder on another volume. Windows Explorer and a dir /s command follow the reparse point, count any files and folders on the destination volume, and then include them in the host volume's statistics. This may mislead you to believe that more space is being used on the host volume than what is actually being used. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
In summary, you can use chkdsk output, NTBackup GUI or backup logs, and the viewing of disk quotas to determine how disk space is being used on a volume. However, Windows Explorer and the dir command have some limitations and drawbacks when used for this purpose.
Back to Top
Article ID: 814594 - Last Review: Jun 20, 2014 - Revision: 1