What is the relationship between streams (ADS) and allocation units (clusters)? [closed]

StackOverflow https://stackoverflow.com/questions/23521448

  •  17-07-2023
  •  | 
  •  

Question

I'm aware that NTFS has a minimum allocation unit or cluster which often defaults to 4k. This means that if I create a 100 byte file in notepad I'm using 4096 bytes on disk. If I create a second stream in this file, am I using a minimum of 8192 bytes? What's the relationship between streams and allocation units (if there is one)?

Was it helpful?

Solution

Everything is a stream on NTFS. When you create/read/write a file "foo.txt", you're actually talking to a stream of the file (it just happens to be the default stream $DATA). This means that the three traditional "file size" values of Valid Data Length, End of File, and Allocation Size apply to each individual stream.

And, to be pedantic, for very small streams the stream contents might be resident in the MFT. Thus, your 100 byte file might not be occupying an external 4096 byte cluster on disk. This doesn't really impact your question, but just wanted to mention it.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top