Why does my C:\ drive show that it's using more space than is actually being used?

Question

I'm running a Windows 8 computer, and I've noticed that when I look at the properties for my SSD, it shows that I'm using 80GB/100GB, however, when I go into the C:\ directory and select everything (including hidden items) and check the properties... They only total to 53GB, which is waaaaaaaay off.

I also checked my D:\ drive, which is not an SSD, and did the same thing as described above. The numbers matched up. Drive said it was using 255GB, files said they were using 254GB.

What is up with my C:\ drive?

Answer 1

There will always be a discrepancy between the used space reported on the drive itself and the sum of the files/folders on it, and the discrepancy will almost always be more on the OS drive than in any other drive on the system. There are a couple of reasons for this:

1. The used/free graph on the drive properties is a very simple calculation based on the volume bitmap. The volume bitmap is just a record of which blocks are allocated and which are free. The graph merely subtracts the number of used blocks from the total and multiplies by the blocksize to arrive at a value. The volume bitmap does not consider what data those blocks hold or what they're allocated to; only that they're allocated to something.
2. File Explorer or the command line will actually look at the sizes of all the files on the drive and add them together, but it can't see everything. Files with the hidden and system attributes do not display by default, so those files would not be considered unless you specifically selected them. Also, you wouldn't be able to get the size of files you don't have permission to access.
3. File metadata such as access control lists, auditing data, extended attributes, etc. take space to store in the MFT, but are not actually part of the file and are therefore not reported.
4. NTFS reparse points (such as junctions and hard links) are usually reported incorrectly by the file system. Hard links in particular get reported multiple times (making the space used look higher than what it actually is). Although symlinks are usually reported correctly.
5. Sparse files, alternate data streams, volume shadow copies, and NTFS compression also distort the filesystem's view. Sparse files can be reported as gigabytes in size but may only have 100MB of data and only take 100MB of space. Compression tends to report the uncompressed size, not the compressed one. Alternate data streams do not get counted even though they're part of the file (the filesystem only reports the size of the first stream).
6. Volume slack. Files are reported in bytes but are stored as 4KB clusters and rounded up to the nearest 4KB boundary. So if you have a 1-byte file, it will take 4KB of space. a 5KB file will take 8KB of space, etc. It's not much but it adds up over thousands of files.

There are more, but really, the volume bitmap (the size reported by the drive's properties) is the true, accurate representation of how much free space you have.