Navigation:  »No topics above this level«

Notes on NTFS

Previous pageReturn to chapter overviewNext page

The file system NTFS can be used with the operating system Windows NT or later. It offers some special features which also have effects for TreeSize Professional. We will describe some of these features and their impacts on this software in the following paragraphs.

Access Control Lists

A user under Windows NT or later is able to restrict the way other users can access his files and folders. He can grant or deny other users or groups certain rights like reading, writing, executing or deleting files. That way a user may even deny the administrator to access his files and folders. If an administrator tries to access a folder in the Windows Explorer to which the owner denied any other users reading access, an "Access Denied" error message will be displayed. However, TreeSize Professional is able to scan such folders, if you are logged in as administrator or as a user that has the right to perform backups (This option can be changed at "Control Panel" / "Administrative Tools" / "Local Security Policy" and with the user editor of Windows).

File Based Compression

NTFS supports compression on an individual file basis. Files that are compressed on an NTFS volume can be read and written without first being decompressed by another program. Decompression happens automatically during the reading of the file. The file is compressed again when it is closed or explicitly saved.

The space occupied by a compressed file is usually much smaller than its normal size. As a consequence, for folders that are partially or completely compressed, the allocated space reported by TreeSize Professional may be smaller than the size reported for this folder. TreeSize Professional is able to show the compression ratio in an extra column on the "Details" tab. Additionally it can show compressed files and folders in a different color. These features can be turned on in the Options dialog.

TreeSize Professional is able to compress and decompress entire file system branches using the context menu.

The NTFS version that comes with Windows 2000 and later supports an additional concept that is similar to compressed files: sparse files. Files which are large but only partially used are called sparse files. Because the operating system does not allocate disk space for the unused parts of a sparse file, it occupies less disk space than its actual size is. TreeSize Professional treats sparse files like compressed files and also calculates the compression ratio for them.

Reparse Points: Volume Mount Points and Symbolic Links

Since Windows 2000 NTFS supports volume mount points and symbolic links. A volume mount point is an existing path where you "mount" another volume. Given this, users and applications can refer to the mounted volume by that path. It allows you to unify disparate file systems into one logical file system. Symbolic links work similar: If you for example have an empty folder "C:\Documents\Images", you can create a symbolic link to "E:\Pics" in it. Applications will then see the content of "E:\Pics" in "C:\Documents\Images".

If the Option "Follow Mount Points and Symbolic Links" is turned on, TreeSize Professional will include the contents of these folders when scanning. Since they are not physically stored on the drive you are scanning, this may produce irritating results.

Alternate Data Streams (ADS)

In NTFS, a file consists of different data streams. One stream holds the security information (access rights and such things), another one holds the "real data" you expect to be in a file. There may be alternate data streams, holding data the same way the standard data stream does. These alternate data streams are hidden. That means that you can have a file with 1 byte in the official main data stream and some hundred MB in one or more alternate data streams. The dir command, file managers or windows explorer will show 1 byte as the size of this file, but it actually allocates more space on your hard drive.

TreeSize Professional can detect alternate data streams and add their sizes to the allocated file size.
Note: ADS stores information in the same cluster as the main data stream, so if a file has one or more ADS, this file does not necessarily allocate more disk space.

You can choose to detect alternate data streams, to get a more accurate allocated space of directory branches, in the Options Dialog.You can search for Files containing alternate data streams using the Custom File Search of TreeSize Professional.

Hard Links

In a Windows environment a hard link is a reference, or pointer, to physical data on a NTFS storage volume. All named files are hard links. The name associated with the file is simply a label that refers the operating system to the actual data. On NTFS volumes more than one name can be associated with the same data. Though called by different names, any changes made will affect the actual data, regardless of how the file is called at a later time. Hard links can only refer to data that exists on the same file system. The data is accessible as long as at least one link that points to it exists. When the last link is removed, the space is considered free. Please note that all hard link pointing to the same file share also the same Security Description (access permissions).

If more than one hard link points to a file's data, the space allocated by these files is just one time the file size (not including the space of the file master table), no matter how many hard links exists TreeSize Professional is able to detect the number of hard links pointing to one file data and takes that value into account when calculating the allocated space of directory branches.

You can choose to detect hard links, to get a more accurate allocated space of directory branches, in the Options Dialog.

The TreeSize FileSearch uses the hard link mechanism of NTFS storage volumes to remove redundant file content of duplicate files. Use the "Deduplicate" function to remove duplicate files by hard links. This will reduce the allocated space of your hard disk.