John Doe wrote:
John Doe wrote:

"Alexander Shofner-Geidt" wrote:

you can run Windows Disk Cleanup utility, select Drive C:\
That sounds like a good idea to attack the expansion problem.

Yes, it worked. Selected everything and it chopped the backup size in
half. Took a long time to do so, with little other system activity
except the CPU stuck at about 15% for many minutes.

Rather than that being all cleaning, some of it
involved compression. That could be why you were
seeing CPU usage.

Compact.exe /CompactOS:Query

Compact.exe /CompactOS:Query /WinDir:E:\Windows

Compact.exe /CompactOS:always
Compact.exe /CompactOS:never

Before using Linux for forensic NTFS work, you can do

Compact.exe /CompactOS:never

to remove the application of the second (newer) kind
of NTFS file compression from C:\Windows or so. It's
also possible if you examined items from Windows 7,
Windows 7 might not know about the new compression
method either.

The representation of NTFS used colors in Explorer for
the state of the files. One color used for compression,
one color used for encryption, but I don't think necessarily
the new compression method has a color for easy recognition.
But you might be able to tell from an Attribute or from
nfi.exe somehow. fsutil.exe is an example of a utility
that can answer at least some questions of that sort.

Paul