2

I've been creating small NTFS partitions (<16 MiB) using Truecrypt and I've found that around the 12 MiB mark the amount of usable space decreases rather than increases. Seems like something is being used by the NTFS file system, but what?

NTFS

Total |  File    | Free
 4 MB |  3.74 MB |  1.01 MB
 8 MB |  7.74 MB |  4.01 MB
 9 MB |  8.74 MB |  4.95 MB
12 MB | 11.74 MB |  1.95 MB
15 MB | 14.74 MB |  4.95 MB
16 MB | 15.74 MB |  5.95 MB
17 MB | 16.74 MB |  6.95 MB
32 MB | 31.74 MB | 21.9  MB
  • Total - Size of my partition
  • File - Size of the partition when mounted (Truecrypt overhead?)
  • Free - Free space available for use

At the 12 MiB mark, the amount of usable free space drops from 4.95 MiB to 1.95 MiB. This is weird and counterintuitive. Why?

EDIT: Cluster sizes are 512 KB for all tests.

4
  • I edited my Answer with a photo.
    – vssher
    Dec 25 '19 at 4:46
  • Are the cluster sizes the same for every run or are you leaving it at "automatic"?
    – Mokubai
    Dec 25 '19 at 6:13
  • Cluster sizes are 512 kb, the minimum, for all tests.
    – Edison Hua
    Dec 26 '19 at 3:51
  • 1
    Cluster sizes are 512 kb this is not true. Cluster size is 4KB by default, and the sector size is 512 bytes for old hard drives and 4KB for many new drives. If the cluster size is 512KB then it's impossible to create a 4MB drive because now there are only 8 clusters in the partition
    – phuclv
    Nov 24 '20 at 16:51
2

NTFS uses a number of special files and folders in the root folder for storing metadata. You can find the list of them here. Some of them may not be available if the partition size is too small, and for those that exist their sizes may not scale linearly based on the partition size, or the size is fixed

For example $UpCase stores the list uppercase characters for case-insensitive file name lookup, and it's size is always the same regardless of partition size because there's a fixed number of characters in Unicode (for a specific Unicode version). $MFT is the master file table which is the most important thing in NTFS, and its size is always 256KB by default for partitions not larger than 32MB. $MFT size may be increased later if there are too many files in the partition though

Those files are hidden so you need some special forensic tool like ntfstool to do the analysis. Anyway I've created partitions like yours and take screenshots of their contents with WizTree to demonstrate what you see

4-8-9-12-15-16-17-32MB NTFS partitions

As you can see, all the first 10 files always have the same size for the 4-8-9-12-15-16-17-32MB NTFS partitions except $Bitmap (because it marks the free clusters in the partition, and the number of clusters is in proportion of partition size). Their total size is ~2.4MB in all cases. However there are notable differences in the $Extend\$RmMetadata\$TxfLog folder with several special marks:

  • For the 4MB partition there's no $TxfLog for transactional NTFS because the remaining space is just too small to be useful
  • When the partition size increases to 8 or 9MB then a small $TxfLog.blf appears. Therefore the free space decreases slightly at 8MB
  • When the partition size is 12MB or more then 2 container files for TxfLog appears. The free space suddenly decreases at 12MB, but after that it always increases linearly up to 32MB because the size of the two TxfLogContainer* files are the same

The sizes are not exactly the same in your encrypted partitions, but the behavior is the same

4 MB  |  3.74 MB | 1.01 MB ← No $TxfLog
8 MB  |  7.74 MB | 4.01 MB ← $TxfLog.blf
9 MB  |  8.74 MB | 4.95 MB
12 MB | 11.74 MB | 1.95 MB ← TxfLogContainer00000000000000000001/00000000000000000002
15 MB | 14.74 MB | 4.95 MB
16 MB | 15.74 MB | 5.95 MB
17 MB | 16.74 MB | 6.95 MB
32 MB | 31.74 MB | 21.9 MB

If APNG doesn't work in your browser, you can view the screenshots separately here:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.