How to locate and correct disk space problems on NTFS volumes
IN THIS TASK
NTFS supports many volume and file-level features that may lead to what appear to be lost or incorrectly reported free disk space. For example, an NTFS volume may suddenly appear to become very full for no reason, and an administrator cannot find the cause or locate the offending folders and files. This may occur if malicious or unauthorized access to an NTFS volume where very large files or a high quantity of small files are secretly copied has occurred. These files then have their NTFS permissions removed or restricted. This behavior may also occur after a computer malfunction or power outage occurs that cause volume corruption.
The disk space allocation of an NTFS volume may appear to be misreported for any of the following reasons:
- The NTFS volume's cluster size is too large for the average-sized files that are stored there.
- File attributes or NTFS permissions prevent Windows Explorer or a Windows command prompt from displaying or accessing files or folders.
- The folder path exceeds 255 characters.
- Folders or files contain invalid or reserved file names.
- NTFS metafiles (such as the Master File Table) have grown, and you cannot de-allocate them.
- Files or folders contain alternate data streams.
- NTFS corruption causes free space to be reported as in use.
- Other NTFS features may cause file-allocation confusion.
Cluster Size Is Too LargeOnly files and folders that include internal NTFS metafiles like the Master File Table (MFT), folder indexes, and others can consume disk space. These files and folders consume all the file space allocation by using multiples of a cluster. A cluster is a collection of contiguous sectors. The cluster size is determined by the partition size when the volume is formatted. For additional information about clusters, click the following article number to view the article in the Microsoft Knowledge Base:
To determine the current cluster size and volume statistics, run a read-only chkdsk command from a command prompt. To do so, follow these steps :
- Click Start, click Run, type cmd, and then click OK.
- At the command prompt, type the following command:chkdsk d:where d: is the letter of the drive that you want to check.
- Click OK.
- View the resulting output. For example:Note: Multiply each value that the output reports in kilobytes (KB) by 1024 to determine accurate byte counts. For example: 2906360 x 1024 = 2,976,112,640 bytes.
4096543 KB total disk space. <--- Total formatted disk capacity. 2906360 KB in 19901 files. <--- Space used by user file data.6344 KB in 1301 indexes. <--- Space used by NTFS indexes.0 KB in bad sectors. <--- Space lost to bad sectors.49379 KB in use by the system. <--- Includes MFT and other NTFS metafiles.22544 KB occupied by the log file. <--- NTFS Log file - (Can be adjusted using chkdsk /L:size)1134460 KB available on disk. <--- Available FREE disk space4096 bytes in each allocation unit. <--- Cluster Size. (4K)1024135 total allocation units on disk. <--- Total Clusters on disk.283615 allocation units available on disk. <--- Available free clusters.
- Click Start, click My Computer, and then double-click the drive letter (for example, D) of the volume in question to open the volume and display the folders and files that the root contains.
- Click any file or folder, and then click Select All on the Edit menu.
- With all the files and folders selected, right-click any file or folder, click Properties, and then click the General tab.
The General tab displays the total number of files and folders on the whole volume and provides two file size statistics: SIZE and SIZE ON DISK.
You can only change the cluster size you are using by reformatting the volume. To do this, back up the volume, and then format the volume by using the format command and the /a switch to specify the appropriate allocation. For example:
Note: Alternately, you can enable NTFS compression to regain space that you lost because of an incorrect cluster size. However, this may result in decreased performance.
Back to Top
File Attributes or NTFS PermissionsBoth Windows Explorer and the directory list command dir /a /s display the total file and folder statistics for only those files and folders that you have permissions to access. By default, Files hidden files and protected operating system files are excluded. This behavior may cause Windows Explorer or the dir command to display inaccurate file and folder totals and size statistics.
To include these types of files in the overall statistics, change Folder Options. To do so, follow these steps :
- Click Start, click My Computer, and then double-click the drive letter (for example: D) of the volume. This opens the volume and displays the folders and files that the root contains.
- On the Tools menu, click Folder Options, and then click the View tab.
- Select the Show Hidden Files and Folders check box, and then click to clear the Hide protected operating system files check box.
- Click Yes when you receive the warning message, and then click the Apply button.
To determine the folders and files that you cannot access, follow these steps:
- At the command prompt, create a text file from the output of the dir /a /s command.
For example: At the command prompt, type the following command:dir d: /a /s >c:\d-dir.txt
- Start the Backup or Restore Wizard. To do so:
- Click Start, click Run, type ntbackup, and then click OK.
- Click Advanced Mode.
- Click Options on the Tools menu, click the Backup Log tab, click Detailed, and then click OK.
- In the Backup Utility, click the Backup tab, and then select the check box for the whole volume that is affected (for example: D:), and then click Start Backup.
- After the backup is complete, open the backup report and compare folder for folder the NTBackup log output with the d-dir.txt output that you saved in step 1.
After you locate the files that you do not have access to, you can add or change permissions by using the Security tab while you view the properties of the file or folder in Windows Explorer. By default, you cannot access the System Volume Information folder. You must add the correct permissions to include the folder in the dir /a /s command.
Note: You may notice folders or files that do not have a Security tab. Or, you may not be able to re-assign permissions to the affected folders and files. You may receive the following error message when you try to access them:
D:\folder_name\ is not accessible
Access is denied
Invalid File NamesFolders or files that contain invalid or reserved file names may also be excluded from file and folder statistics. Folders or files that contain leading or trailing spaces are valid in NTFS, but they are not valid from a Win32 subsystem point of view. Therefore, neither Windows Explorer nor a command prompt can reliably work with them.
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
You may not be able to rename or delete these files or folders. When you try to do so, you may receive one of the following error messages:
Cannot rename file: Cannot read from the source file or disk.
Cannot delete file: Cannot read from the source file or disk.
NTFS Master File Table (MFT) ExpansionWhen an NTFS volume is created and formatted, NTFS metafiles are created. One of these metafiles is named the Master File Table (MFT). It is very small when it is created (approximately 16 KB), but it grows as files and folders are created on the volume. When a file is created, it is entered in the MFT as a File Record Segment (FRS). The FRS is always 1024 bytes (1 KB). As files are added to the volume, the MFT grows. However, when files are deleted, the associated FRSs are marked as free for reuse, but the total FRSs and associated MFT allocation remains. That is why you do not regain the space used by the MFT after you delete a large number of files, .
To see exactly how large the MFT is, you can use the built-in defragmenter to analyze the volume. The resulting report provides detailed information about the size and number of fragments in the MFT.
Master File Table (MFT) fragmentation Total MFT size = 26,203 KB MFT record count = 21,444 Percent MFT in use = 81 % Total MFT fragments = 4
In use by system.
Back to Top
Alternate Data StreamsNTFS permits files and folders to contain alternate data streams. With this feature, you can associate multiple data allocations with a single file or folder. The use of alternate data streams on files and folders has the following limitations:
- Windows Explorer and the dir command do not report the data in alternate data streams as part of the file size or volume statistics. Instead, they show only the total bytes for the primary data stream.
- The output from chkdsk accurately reports the space that a user's data files use, including alternate data streams.
- Disk quotas accurately track and report all data stream allocations that are part of a user's data files.
- NTBackup records the number of bytes backed up in the backup log report. However it does not show which files contain alternate data streams. It also does not show accurate file sizes for files that include data in alternate streams.
NTFS File System CorruptionIn very rare circumstances, the NTFS Metafiles $MFT or $BITMAP may become corrupted and result in lost disk space. You can identify and fix this issue by running the chkdsk /f command against the volume. Toward the end of chkdsk, you receive the following message if you must adjust the $BITMAP:
Other NTFS Features That May Cause File Allocation ConfusionNTFS also supports hard links and reparse points that permit you to create volume mount points and directory junctions. These additional NTFS features may cause confusion when you try to determine how much space a physical volume is consuming.
A hard link is a directory entry for a file regardless of where the file data is located on that volume. Every file has at least one hard link. On NTFS volumes, each file can have multiple hard links, and therefore a single file can appear in many folders (or even in the same folder with different names). Because all the links refer to the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all the links to it are deleted. After you create a hard link, programs can use it like any other file name.
Note: Windows Explorer and a command prompt show all linked files as being the same size, even though they all share the same data and do not actually use that amount of disk space.
Volume mount points and directory junctions permit an empty folder on an NTFS volume to point to the root or subfolder on another volume. Windows Explorer and a dir /s command follow the reparse point, count any files and folders on the destination volume, and then include them in the host volume's statistics. This may mislead you to believe that more space is being used on the host volume than what is actually being used. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
In summary, you can use chkdsk output, NTBackup GUI or backup logs, and the viewing of disk quotas to determine how disk space is being used on a volume. However, Windows Explorer and the dir command have some limitations and drawbacks when used for this purpose.
Back to Top
Article ID: 814594 - Last Review: 06/20/2014 07:43:00 - Revision: 7.0
- kbhowtomaster KB814594