3

I recently formatted a single disk from the line of new 14TB Seagates on Windows 10 with ReFS, with a 4K block size, to use the full capacity available and noticed that out of the approximately 12.7TB it presents as usable that it already reports that 100GB has been consumed though the disk is empty.

I checked in disk manager and saw no additional partitions added (plus this would be space consumed within the same partition) and checked for hidden files, but turned up nothing. 100GB consumed for an empty disk seems a little surprising unless it is used for some kind of parity, but also I'm fairly new to using ReFS and don't know all its features.

I've noticed from Microsoft's documentation that ReFS offers something called "mirror-accelerated parity", but I am not using ReFS across two or more disks, but rather a standalone disk. Could the 100GB be reserved for parity or some other feature for preventing data corruption (also mentioned in the Microsoft documentation)? And would it matter if I chose an 8K block size instead?

Any thoughts on what could be using that space?

I am asking this from a security standpoint because I am concerned that to an auditor I wouldn't be able to explain the space usage on a freshly formatted system if there were suspicion of steganography or other forms of hidden data resulting from various methods of hiding malicious software that might actually be occupying space on a drive while not being visible - in environments where monitoring of such things is very strict.

Addendum:

Here is some additional information I pulled about the drive from System Info:

Bytes/Sector: 512
Partitions: 1
Sectors/Track: 63
Tracks/Cylinder: 255
(Total Disk) Size: 12.73TB (14,000,512,296,960)
Total Cylinders: 1,702,132
Total Sectors: 27,344,750,580
Partition: Disk #0,Partition #0
Partition Size: 12.73TB (14,000,383,328,256)
Partition Starting Offset: 135,266,304 bytes

There is a delta in size between the Total Disk Size and the Partition Size of 122.99GB, but this does not match the now 101GB (seems like it grew by 1GB since I last looked at it - though the disk is still empty) that is reported used. And again, the 101GB is reported as consumed within the partition itself.

The disk is still empty, though I did test creation of a .txt file and then delete it. If there is parity I wonder if creation of that file is what increased the utilization reported (after the fact), even though the file was deleted.

Additional reading on ReFS: - https://www.iperiusbackup.net/en/refs-vs-ntfs-differences-and-performance-comparison-when-to-use/

SeligkeitIstInGott
  • 149
  • 2
  • 5
  • 18
  • 1
    The one time I used ReFS as on a large scale it took 5.34 TB out of 1 PB just for itself. So my (not very diverse) experience is: yes, it does. – Gerald Schneider Jan 31 '19 at 15:06
  • Thanks. That gives me some reference point. I'm wondering why that would apply to standalone disks too though. If it is parity (though technically a disk can't parity itself - can it? Or at least it would be pointless...) I guess ReFS makes it non-optional, regardless of number of disks. – SeligkeitIstInGott Jan 31 '19 at 15:21
  • 2
    I have never used ReFS. However, BTRFS and ZFS do this same kind of stuff.. Both of those systems need reserved space for metadata, which it absolutely should report as "consumed". It's completely reasonable for a checksumming filesystem with an integrated volume manager and copy on write (COW) to consume this much space for its internals. – Spooler Feb 01 '19 at 17:42
  • Metadata could be the explanation. Oddly though I've never noticed whether NTFS does this too or not. I almost formatted the drive NTFS but wanted to try ReFS. – SeligkeitIstInGott Feb 01 '19 at 23:38

1 Answers1

0

12.73TB (14,000,512,296,960)... Microsoft is reporting 12.7Tib, Seagate sells 14TB drives, this is the same thing in different units. 14x10^12 = 12.73x2^40

user625481
  • 1