NTFS File: "Size 0 bytes" but "Size On Disk 3.98 GB (4,282,056,704)"

scottbernstein · 24 Sep 2016

I accidentally created a video file that had a colon in its file name. The command line utility that I used to create the video happily created the file without complaining, BUT now the filename became everything before the colon (not an issue) and the file itself is inaccessible. It shows up as size: 0 bytes, but when I look at the properties, it shows up a the proper size, with "Size on disk: 3.98 GB (4,282,056,704 bytes)".

I tried to use various file recovery tools such as Recuva and Minitool Power Data Recovery, and they happily recover the file to a different drive, all 4GB of it, but the files they recover are in the same state -- still 0 bytes, but 4GB on disk.

None of them seem to actually be accessible by any software.

Has anyone had experience trying to restore a "0 byte" file that is still on the disk with an actual amount of bytes?

I am technical so am not averse to doing some low level disk editing if someone pointed me in the right direction.

Thanks in advance.

Best,
Scott Bernstein

dalchina · 25 Sep 2016

Hi, I would try examining the file from a command prompt, outside Windows e.g. from SHIFT + left click restart and wend your way through the lengthy sequence and a restart to a command prompt.

You may be able to delete it that way, perhaps by using wild cards and 8.3 format as necessary.

Also try this search:
deleting 0 byte file

Lots of interesting results which may help.

Bree · 25 Sep 2016

dalchina said:

You may be able to delete it that way, perhaps by using wild cards and 8.3 format as necessary.

I think Scott may want to rename it rather than delete it. Perhaps there's now no way to source another copy (with a valid name for a change). Renaming may well be possible from a command prompt by wildcard or 8.3 names. It may also help if it's first copied to a USB that doesn't use the NTFS format (you may need to use exFAT to get past FAT32's 4GB file size limit).

But probably the easiest way to rename it would be to boot from a Linux Live USB and do it from there.

Afterthought: If you can copy the file to a FAT32/exFAT drive, it's a lot easier to manually edit the FAT file structure than it is for NTFS. This thread may give some ideas:
http://superuser.com/questions/18746...acters-such-as

abolibibelot · 20 Feb 2019

I registered just to reply to this thread...
The same thing happened to me recently, and the explanation is : because of the colon caracter, the contents of the video file were saved as an “alternate data stream”, instead of a regular file. So the file, from Windows Explorer, appears as empty, but in fact the whole video has been saved (and occupies the expected size on the partition), it's just not accessible by common means. If the file is deleted, although it's supposed to be empty, it will release the whole size of data contained in the ADS (which can be a lot – in my case the video file was 1.3GB). If you still have it (which is doubtful more than 2 years later, but it may help someone having the same issue and finding this discussion) you can view the alternate data streams with a little free tool : AlternateStreamView from Nirsoft (the same editor has a gazillion other very useful little free tools). It allows to export a file's alternate data stream(s) as regular file(s).

---
A bit of humor, quotation from The Sopranos, when asked if Adriana (who has become an informant for the FBI and as a result developped an irritable bowel syndrom) is still feeling sick, Christopher replies:
“They gotta replace her colon with a semi-colon.”

scottbernstein · 20 Feb 2019

abolibibelot said:

The same thing happened to me recently, and the explanation is : because of the colon caracter, the contents of the video file were saved as an “alternate data stream”, instead of a regular file. So the file, from Windows Explorer, appears as empty, but in fact the whole video has been saved (and occupies the expected size on the partition), it's just not accessible by common means. If the file is deleted, although it's supposed to be empty, it will release the whole size of data contained in the ADS (which can be a lot – in my case the video file was 1.3GB). If you still have it (which is doubtful more than 2 years later, but it may help someone having the same issue and finding this discussion) you can view the alternate data streams with a little free tool : AlternateStreamView from Nirsoft (the same editor has a gazillion other very useful little free tools). It allows to export a file's alternate data stream(s) as regular file(s).

WOW, that's amazing. Thanks for this. At this point I gave up on the file. But if it ever happens again, I will know where to look!!!

jumanji · 20 Feb 2019

Excellent and thank you @abolibibelot for registering and coming in giving us an " alternate data stream" hitherto unknown and invisible

.

Here is the link to the Nirsoft Utility AlternateStreamView - View/Copy/Delete NTFS Alternate Data Streams

EdTittel · 20 Feb 2019

Thanks for posting the alternate streams tool @abolibibelot. He has "something for just about everything" Windows-related, utility wise.
Best wishes & good work!
--Ed--

Bree · 20 Feb 2019

abolibibelot said:

I registered just to reply to this thread...
The same thing happened to me recently, and the explanation is : because of the colon caracter, the contents of the video file were saved as an “alternate data stream”, instead of a regular file....

Well Spotted! I have known about alternate data streams for a while, but hadn't realised this was the case here. Nirsoft can show the properties of the ADS, and this blog will tell you how to access the data.

Alternate Data Streams in NTFS | Ask the Core Team