Prev: Formatting a hard disk and handling of suspicious bad sectors
Next: 256GB SSD SLC in 2.5" size?
From: sobriquet on 17 Feb 2010 14:59

http://img237.imageshack.us/img237/2852/passportdiscrepancy.jpg

I have two identical WD 1tb passport usb drives filled with identical
data.
When I select all files (including hidden and system files) and
display its properties, the listed filesizes match up between the two
drives. But when I go to 'my computer' and display the properties of
each of the two passport drives, they differ in the size of the data
stored on the disk. Can anyone explain this discrepancy in the
reported data/free space between the two identical usb drives with
identical data?

The recycle bin is empty on both drives.

Kind regards and thanks in advance for any suggestions, Niek

From: Rod Speed on 17 Feb 2010 21:20
sobriquet wrote:

> http://img237.imageshack.us/img237/2852/passportdiscrepancy.jpg

> I have two identical WD 1tb passport usb drives filled with identical
> data. When I select all files (including hidden and system files) and
> display its properties, the listed filesizes match up between the two
> drives. But when I go to 'my computer' and display the properties of
> each of the two passport drives, they differ in the size of the data
> stored on the disk. Can anyone explain this discrepancy in the
> reported data/free space between the two identical usb drives with
> identical data?

You're displaying the contents of the recycle bin with the top display, not the entire drive.

> The recycle bin is empty on both drives.

No it is not.


From: sobriquet on 18 Feb 2010 05:41
On 18 feb, 03:20, "Rod Speed" <rod.speed....(a)gmail.com> wrote:
> sobriquet wrote:
> >http://img237.imageshack.us/img237/2852/passportdiscrepancy.jpg
> > I have two identical WD 1tb passport usb drives filled with identical
> > data. When I select all files (including hidden and system files) and
> > display its properties, the listed filesizes match up between the two
> > drives. But when I go to 'my computer' and display the properties of
> > each of the two passport drives, they differ in the size of the data
> > stored on the disk. Can anyone explain this discrepancy in the
> > reported data/free space between the two identical usb drives with
> > identical data?
>
> You're displaying the contents of the recycle bin with the top display, not the entire drive.

It might look like that, because the windows operating system (vista
in particular) was designed by a bunch of retards, but I can assure
you that I'm displaying the entire contents of the drive. If you look
carefully, you can
also see this in the top address bar that is pointing to the root
folder on both sides in the two explorer windows.

>
> > The recycle bin is empty on both drives.
>
> No it is not.

Well, I double checked it again and the recycle bin is empty on both
drives.
From: sobriquet on 18 Feb 2010 05:46
On 18 feb, 05:52, Jonathan de Boyne Pollard <J.deBoynePollard-
newsgro...(a)NTLWorld.COM> wrote:
> http://img237.imageshack.us/img237/2852/passportdiscrepancy.jpg
> I have two identical WD 1tb passport usb drives filled with identical data. [...]
>
>
>
> ... but not necessarily identical metadata.  That 28KiB difference is a mere 28 deleted MFT records, for example.  Or it could be journal entries, security descriptor records, or quite a number of other things.
>
>

But isn't this the kind of meta data that is supposed to disappear
when the recyclebin is emptied?
Is there any other way to clear any superfluous data somehow?
If two drives have the same data and one has more free space, surely,
somehow, it must be possible to free up
the same space on the other drive, because we're talking about two
identical drives and identical data that is supposed to be stored on
the drive.

I don't care about the minimal filespace that would be obtained this
way, I'm just interested in figuring out exactly what's responsible
for this discrepancy between the two drives in reported free space
while they contain identical data that has been stored on the drives
in an identical fashion.

From: sobriquet on 18 Feb 2010 17:29
On 18 feb, 21:17, Jonathan de Boyne Pollard <J.deBoynePollard-
newsgro...(a)NTLWorld.COM> wrote:
> http://img237.imageshack.us/img237/2852/passportdiscrepancy.jpg
> I have two identical WD 1tb passport usb drives filled with identical data. [...]
>
>
>
> ... but not necessarily identical metadata.  That 28KiB difference is a mere 28 deleted MFT records, for example.  Or it could be journal entries, security descriptor records, or quite a number of other things.
>
>
>
> But isn't this the kind of meta data that is supposed to disappear when the recyclebin is emptied?
>
>
>
> Put simply: No.  Deleted MFT records are nothing to do with files in the recycle bin, for example.
>
>
>
> Is there any other way to clear any superfluous data somehow?
>
>
>
> Put simply: Short of drastic measures such as reformatting the volume, no..  The MFT doesn't shrink in normal operation, for example.  And the security descriptor stream is only compacted bychkdsk.  (See MSKB 919241.)
>
>
>
> we're talking about two identical drives and identical data that is supposed to be stored on the drive.
>
>
>
> No, we're not.  As I said, the metadata are not necessarily identical.
>
>

I see. Could a virus or malware somehow gain access to this space
where this metadata is stored to hide a copy of itself there?
Can I use a diskeditor like HxD or DiskExplorer for NTFS to view this
metadata somehow?
 |  Next  |  Last
Pages: 1 2
Prev: Formatting a hard disk and handling of suspicious bad sectors
Next: 256GB SSD SLC in 2.5" size?