3

I understand why "Size on disk" is larger than "Size".

I have three NTFS-formatted drives with the same exact data on it. Their allocation unit is 4096 bytes. The number of files and folders as well as the size matches on all three.

However when I open the properties for the root folder of these mirrored drives, only on the first two have the Size on disk match though. On the third, it is slightly larger.

Is this a potential signal of file corruption, or a mere byproduct of the file system?

3
  • What is the actual size on disk for each version of the file? Or are you asking about the entire filesystem?
    – Mokubai
    Aug 28, 2018 at 14:13
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Ramhound
    Aug 28, 2018 at 14:18
  • @Mokubai Size for the root folder of the mirrored structure, I updated my question.
    – Mooseman
    Aug 28, 2018 at 14:22

2 Answers 2

4

It is possible that on one system some files have been modified or had a byte changed and so one or more files were moved into or out of the MFT area (where cluster alignment is not used and it may not count towards the filesystem "in use" count) or were fragmented, causing a difference in used space.

From Blackbagtech

DATA ATTRIBUTE

This MFT attribute contains information about where the data for the actual file exists on the volume.  As you may know, sometimes if the data is small enough the entire data of the file can be stored within the Master File Table.  However, in most cases the file’s data is too large to fit within the MFT.

2

If you copied the same file(s) onto a different disk but see a different number of files or different total size then you're having a disk and/or copying problem. Size is calculated based on the total data of the files, therefore if the number is different then the files are different

OTOH, size on disk depends on how the files are actually stored on disks and isn't actually related to the file sizes, therefore the total size on disk can be changed if the files are stored differently on disk. There are a lot of reasons that can change that value

  • Sparse files on the original drive will be expanded at the destination if the copying tool is not smart enough. For example you have a 1GB sparse file that only has 1MB of real data, i.e. the size on disk will be ~1MB. When you copy, the size on destination disk will now be 1GB
  • Compressed files will also be decompressed if the destination doesn't have compress attribute, or they may be recompressed with a different algorithm, which results in a different size on disk
  • Very small files can be stored inside the MFT, called resident files, if their sizes fit into the free space in the MFT record. That available space depends on metadata usage, therefore it's possible that the same file is resident on one disk but non-resident on another, due to for example
    • Different number of hardlinks: If the destination drive has DOS-8.3 name generation disabled, then it frees some space in the record. Thus some previously non-resident files can now be inlined and their size on disk will be 0
    • Different permissions: The source files are possibly created on another computer, which contains different permission information. When you copy them using another PC with another user, different ACLs may be stored on the destination's MFT record, again affecting the resident status of files
    • ADS were not copied/removed on the destination drive. The content of the files will still be the same but now no space is consumed in the MFT record anymore. More ADS's can also be added, which of course takes space in the record.
    • Different number of fragments on the drives: Since each fragment is stored as contiguous extent in the record, more fragmented files will need more MFT space. The destination files are likely to be less fragmented, hence more likely to be inlined
    • The old file was originally bigger: When removing content from a non-resident file, even if the new size fits in the MFT entry, it will never be made resident. But copying the file to a new location then it'll be a resident at the destination
  • Different create/delete patterns in folders: A directory is just a special file that stores a list of its children files. So the directory size depends on how many files/folders it has. When removing files from the directory only the file indexes are removed and the directory size won't be shrunk. But copying the directory to another place then the new directory will be smaller. It's very easy to check by running fsutil file layout dirpath as admin and look at the $INDEX_ALLOCATION stream size for both the old and new directories

There are more reasons that can change the metadata size of a file and result in different size on disk for resident files. But more importantly, once a resident file has been made non-resident, it will never be converted back to resident again and will consume disk space forever

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .