View Single Post
Old October 21st 13, 03:34 AM posted to microsoft.public.windowsxp.hardware
external usenet poster
Posts: 10,550
Default Disk Uses More Space Than Size of Files

"VanguardLH" wrote ...

And that backup is which one?

Still waiting on that question.

In addition, Windows Explorer will never show you the size of Alternate
Data Streams (ADS) added to a file. For example, I can create a .txt
file whose primary data stream chews up only, say 5KB but then add an
alternate data stream that is gigabytes in size. Windows Explorer,
'dir', and other normal file utilities will only show you the size of
the primary data stream.

While there are legitimate uses of ADS, it can also be misused.

That shows how using just the simple 'echo' console command that you can
add a huge file onto a text file. By redirecting stdout to the target
file but specifying a name for an ADS (the part after the colon in the
filename), all that stdout goes into the ADS. While that article looks
old, ADS is still a feature of NTFS.

You didn't say if the backup partition on the external drive is
formatted using FAT32, NTFS, exFAT, or some other file system.

You can find ADS utilities to expose the multiple streams (the blank or
no name one is the primary one or the one you normally consider the
file itself). is one such
utility but there are probably lots of these. I've used this one in the
past but obviously it's mostly to reveal there is an ADS on file that
you select rather than scan all your files to find which ones have one,
or more, ADS attached to them. You might want to ask in the
alt.comp.freeware newsgroup (get ready to ignore lots of noise) on what
is a good ADS explorer tool. As I recall, there was one ran from the
command line that would strip all ADS from the specified files but then
you lose any meta data they stored, like a thumbnail image. I once had
such a command-line scanner tool so I know that you'll find lots of
files that have an ADS for them but often it's trivial meta-data.

I do remember that some backup programs use the ADS to keep track of
their versioning history. Don't remember which one but recall one that
used the ADS to record if a file had already been backed up and the hash
value for the file at that time. For a subsequent incremental backup
job, it could use that meta-data to determine if it could skip an
unchanged file. The archive file attribute is not a reliable means of
determining if a file has changed or not so meta-data was used to keep
track if a file (in its current state) had already been backed up. I
even recall an anti-virus program doing that (I think it was Kaspersky)
so it could shorten its on-demand scans. If the file hadn't changed
since the last scan and it was included in the scan, info stored as
meta-data in an ADS on the file, then the AV's scan could skip that file
to eliminate wasting time rechecking a file that had already been
checked before, didn't change, so it doesn't need to be checked again.
If you used an ADS scanner to strip them from files, the AV program
would have to scan all files again.

That's an example of a scanner so you don't have to manually select
files in an explorer tool to see if they have an ADS and what is its
size. I've never used ADS Scanner. Just remember there are also
legimate uses of ADS so stripping them off means losing data which could
affect functionality within the OS or an app that handles the file.

SysInternals has their 'streams' utility to scan from a command prompt
for ADS on files. Without the -d switch, it'll list which files were
found to have an ADS. With the -d switch, it would delete the ADS file
on every matching file to the filespec you gave it. Again, you could
end up deleting more than you want, so look before deleting.