Still having false free space report on NTFS EWF Compact Flash

[Mark K Vallevand]

I'm still having problems with the reported free space on a 512mb
NTFS-formatted EWF-protected Compact Flash device. If you query the
properties of the C: drive, it shows very low free space. If you select all
the files and directories in the C: root, and query their properties, it
shows the correct amount of free space. Or, rather, the correct disk space
usage.

I haven't gathered any more information directly, because I have only seen
the problem once. But, other engineers are seeing it regularly. So, I have
their reports. It seems to happen mostly when there have been lots of file
updates. For example, sometimes it happens after installing a new version
of one of our applications, or after forcing pre-compilation of webpages.
But, if you delete a few meg of temp files, 100 meg of free space might
appear. If you reboot, 100 meg of free space might appear. If you do
nothing, the free space remains tight.

It it possible that the file system is really full? Could it be holding
updates in its journal and not releasing them promptly enough? Could free
space collection be occurring too slowly?

Is there a way to get detailed look at the file system to see where the free
space has gone?

Is there an NTFS format option that might give better performance?

We never saw this with SP1. Does anyone know of a SP2 change to NTFS or
whatever?

 

[Slobodan Brcin \(eMVP\)]

Hi Mark,

Do you suspect EWF? If you do please disable EWF and try to see if you still have this behavior.
Also do you use NTFS file compression?

If you really want to see usage of filesystem you can use FSCTL_GET_VOLUME_BITMAP and count free and used clusters. This function is
always correct.
Also you might want to use FSCTL_GET_NTFS_VOLUME_DATA to see what it report.

Regards,
Slobodan

 

[Mark K Vallevand]

EWF could be a suspect. However, I'm not sure if its a good idea to run for
long periods with the EWF disabled on CF devices while we hope the problem
will occur. However, the project might be willing to sacrefice a few CF to
track the problem down.

Yes, we use NTFS compression. Everything is compressed except the files in
C: root that must be uncompressed. I think XPe also keeps a few
uncompressed files as well. Without compression, we'd never fit XPe + our
software on 512mb. Could compression casue an effect like this?

Is there program written that does the FSCTLs mentioned? I won't have time
to whip up a program for a while. Maybe winhex? It looks like the eval
version does some of this. I'll keep that in my pocket if the problem
occurs.

 

[KM]

Mark,

EWF could be a suspect. However, I'm not sure if its a good idea to run for
long periods with the EWF disabled on CF devices while we hope the problem
will occur. However, the project might be willing to sacrefice a few CF to
track the problem down.

Even if you escalate this issue through Microsoft PSS, you may expect the same question
Seems like you would need to get this test data anyway.

Yes, we use NTFS compression. Everything is compressed except the files in
C: root that must be uncompressed. I think XPe also keeps a few
uncompressed files as well. Without compression, we'd never fit XPe + our
software on 512mb. Could compression casue an effect like this?

Is there program written that does the FSCTLs mentioned? I won't have time
to whip up a program for a while. Maybe winhex? It looks like the eval
version does some of this. I'll keep that in my pocket if the problem
occurs.

You could use NtFsControlFile on the FSCTL_GET_VOLUME_BITMAP to make it faster.
Just for the same of saving you same time writting the code, take a look in to the Defrag sources from www.sysinternals.com
(http://www.sysinternals.com/ntw2k/info/defrag.shtml).
If you change the DumpBitmap function implementation there to not dump the free clusters but rather just sum thier sizes, you will
be done with the tool (something like numFree there will show you the number of Free clusters).

Btw, that may be a good idea in general to try to defrag your NTFS volume that shows the free space problem.

Also, I still think the GetDiskFreeSpaceEx could be a good test too.