Different results to Everything (Windows Sandbox)

[KoalaBear84]

EFUtool is reporting differently than Everything, and I already saw why while it was scanning.

Maybe it isn't 'wrong', but well, different.

My SSD (partition) is ~ 499GB, and the scans returns 720.89GB. And also the 'issue' is somehow shows

Scan may not show as normal as I resized the terminal multiple times.

.\EFUtool.exe index.efu C:\
EFUtool v1.2.1 (c) 2019 Pedro Fonseca [pbfonseca@gmail.com]

Creating EFU file: index.efu

Scanning and indexing folders
Updating directory sizes                                                                                                                                                                               a
Finalizing EFU
Replacing EFU file

Contents:  720.89 GB in 1,706,233 files, 500,248 folders [156 depth]

EFUtool finished in 0:02:53

The different is in this part.

Everything (index file 533MB):

"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\",0
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\",0
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\BaseLayer\",0
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\BaseLayer\ContainerImage.def",1051
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\BaseLayer\Files\",0
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\BaseLayer\Files\$Recycle.Bin\",0

EFUTool (index file 1.22GB):

"C:\ProgramData\Microsoft\Windows\Containers",251038385367
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages",250310673111
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34",250310673111
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\BaseLayer",249255547095
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\BaseLayer\Files",249176779949
"C:\ProgramData\Microsoft\Windows\Containers\BaseImages\6256bd0c-63e1-4feb-a5d6-c5c7a7521f34\BaseLayer\Files\$Recycle.Bin",0

It looks like it's coming from Windows Sandbox.

I have no idea why Everything is handling this differently, and how it detects this 'duplicate' like thing. Couldn't find a thread about that.

Not sure what to do with this, but at least if someone it searching for this it will show up next time.

[zybexXL]

The files in that folder are likely Sparse image files. Sparse files declare their full size to Explorer (or to a DIR command), but can actually take up much less physical space on disk as only the non-zeroed sectors are written to disk. So you can create a 1 TB sparse file on your 500 GB volume if you want, you just can't fill it up with actual data. This is frequently done by VMWare and others to create an image file that represents the full volume size of the VM, but doesn't actually take up all that space.

You can check the file Properties on Explorer, and it should show the "Size on Disk" as being much smaller than "Size".

EFUTool is just doing a recursive DIR, so it sees the declared total size. Everything NTFS scan on the other hand is reading the volume's MFT table, which will have the actual used space. Hence the difference.

I suppose I could report the actual space for sparse files, but this is only relevant on NTFS volumes, and the tool is mostly used for Network volume scans.

[KoalaBear84]

I guess so. Clear. No problem then. At least it's documented now in an issue :)

Screenshot: