NTFS File: "Size 0 bytes" but "Size On Disk 3.98 GB (4,282,056,704)"

  1.    #1

    NTFS File: "Size 0 bytes" but "Size On Disk 3.98 GB (4,282,056,704)"


    I accidentally created a video file that had a colon in its file name. The command line utility that I used to create the video happily created the file without complaining, BUT now the filename became everything before the colon (not an issue) and the file itself is inaccessible. It shows up as size: 0 bytes, but when I look at the properties, it shows up a the proper size, with "Size on disk: 3.98 GB (4,282,056,704 bytes)".

    I tried to use various file recovery tools such as Recuva and Minitool Power Data Recovery, and they happily recover the file to a different drive, all 4GB of it, but the files they recover are in the same state -- still 0 bytes, but 4GB on disk.

    None of them seem to actually be accessible by any software.

    Has anyone had experience trying to restore a "0 byte" file that is still on the disk with an actual amount of bytes?

    I am technical so am not averse to doing some low level disk editing if someone pointed me in the right direction.

    Thanks in advance.

    Best,
    Scott Bernstein
      My ComputerSystem Spec

  2.    #2

    Hi, I would try examining the file from a command prompt, outside Windows e.g. from SHIFT + left click restart and wend your way through the lengthy sequence and a restart to a command prompt.

    You may be able to delete it that way, perhaps by using wild cards and 8.3 format as necessary.

    Also try this search:
    deleting 0 byte file

    Lots of interesting results which may help.
      My ComputersSystem Spec

  3. Bree's Avatar
    Posts : 10,558
    10 Home x64 (1809) (10 Pro on 2nd pc)
       #3

    dalchina said: View Post
    You may be able to delete it that way, perhaps by using wild cards and 8.3 format as necessary.
    I think Scott may want to rename it rather than delete it. Perhaps there's now no way to source another copy (with a valid name for a change). Renaming may well be possible from a command prompt by wildcard or 8.3 names. It may also help if it's first copied to a USB that doesn't use the NTFS format (you may need to use exFAT to get past FAT32's 4GB file size limit).

    But probably the easiest way to rename it would be to boot from a Linux Live USB and do it from there.

    Afterthought: If you can copy the file to a FAT32/exFAT drive, it's a lot easier to manually edit the FAT file structure than it is for NTFS. This thread may give some ideas:
    http://superuser.com/questions/18746...acters-such-as
    Last edited by Bree; 25 Sep 2016 at 13:08. Reason: afterthought
      My ComputersSystem Spec

  4.    #4

    I registered just to reply to this thread...
    The same thing happened to me recently, and the explanation is : because of the colon caracter, the contents of the video file were saved as an “alternate data stream”, instead of a regular file. So the file, from Windows Explorer, appears as empty, but in fact the whole video has been saved (and occupies the expected size on the partition), it's just not accessible by common means. If the file is deleted, although it's supposed to be empty, it will release the whole size of data contained in the ADS (which can be a lot – in my case the video file was 1.3GB). If you still have it (which is doubtful more than 2 years later, but it may help someone having the same issue and finding this discussion) you can view the alternate data streams with a little free tool : AlternateStreamView from Nirsoft (the same editor has a gazillion other very useful little free tools). It allows to export a file's alternate data stream(s) as regular file(s).

    ---
    A bit of humor, quotation from The Sopranos, when asked if Adriana (who has become an informant for the FBI and as a result developped an irritable bowel syndrom) is still feeling sick, Christopher replies:
    “They gotta replace her colon with a semi-colon.”
      My ComputerSystem Spec

  5.    #5

    abolibibelot said: View Post
    The same thing happened to me recently, and the explanation is : because of the colon caracter, the contents of the video file were saved as an “alternate data stream”, instead of a regular file. So the file, from Windows Explorer, appears as empty, but in fact the whole video has been saved (and occupies the expected size on the partition), it's just not accessible by common means. If the file is deleted, although it's supposed to be empty, it will release the whole size of data contained in the ADS (which can be a lot – in my case the video file was 1.3GB). If you still have it (which is doubtful more than 2 years later, but it may help someone having the same issue and finding this discussion) you can view the alternate data streams with a little free tool : AlternateStreamView from Nirsoft (the same editor has a gazillion other very useful little free tools). It allows to export a file's alternate data stream(s) as regular file(s).
    WOW, that's amazing. Thanks for this. At this point I gave up on the file. But if it ever happens again, I will know where to look!!!
      My ComputerSystem Spec

  6. jumanji's Avatar
    Posts : 923
    Windows 7 Ultimate 32bit
       #6

    Excellent and thank you @abolibibelot for registering and coming in giving us an " alternate data stream" hitherto unknown and invisible.

    Here is the link to the Nirsoft Utility AlternateStreamView - View/Copy/Delete NTFS Alternate Data Streams
      My ComputerSystem Spec

  7.    #7

    Thanks for posting the alternate streams tool @abolibibelot. He has "something for just about everything" Windows-related, utility wise.
    Best wishes & good work!
    --Ed--
      My ComputersSystem Spec

  8. Bree's Avatar
    Posts : 10,558
    10 Home x64 (1809) (10 Pro on 2nd pc)
       #8

    abolibibelot said: View Post
    I registered just to reply to this thread...
    The same thing happened to me recently, and the explanation is : because of the colon caracter, the contents of the video file were saved as an “alternate data stream”, instead of a regular file....

    Well Spotted! I have known about alternate data streams for a while, but hadn't realised this was the case here. Nirsoft can show the properties of the ADS, and this blog will tell you how to access the data.

    Alternate Data Streams in NTFS | Ask the Core Team
      My ComputersSystem Spec


 

Related Threads
Hi, I just upgraded from W8.1 to W10 and it looks like the icons got smaller by default in the "details" view in the File Explorer. Problem: My problem is that now the overlay icons which are used by TortoiseSVN do not seem to show anymore in...
My hard drive not showing in "my computer" or "Disk Management" but is showing under device manager. I got the hard drive from a friend and his dad had put a Password encryption on it. Any Ideas?
Hi all, I have been searching the web for an answer to this question since first getting Windows 10 last year. I would like my File Explorer to open using the "List" view rather than the current default of "Details". I have seen many responses...
I'm logged in an admin account and it's greyed out. I searched online and it seems some people have this issue as well but I couldn't find a solution.31699
I just installed the Windows 10, and can't find the above 2 programs. So, I googled "Windows 10 Defrag", but they only showed where the program is in Win 7, 8, and 8.1, not where the program is in Windows 10. Any help will be very much appreciated.
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 16:00.
Find Us