Different results to Everything (Windows Sandbox) about efutool

[zybexXL]

The files in that folder are likely Sparse image files. Sparse files declare their full size to Explorer (or to a DIR command), but can actually take up much less physical space on disk as only the non-zeroed sectors are written to disk. So you can create a 1 TB sparse file on your 500 GB volume if you want, you just can't fill it up with actual data. This is frequently done by VMWare and others to create an image file that represents the full volume size of the VM, but doesn't actually take up all that space.

You can check the file Properties on Explorer, and it should show the "Size on Disk" as being much smaller than "Size".

EFUTool is just doing a recursive DIR, so it sees the declared total size. Everything NTFS scan on the other hand is reading the volume's MFT table, which will have the actual used space. Hence the difference.

I suppose I could report the actual space for sparse files, but this is only relevant on NTFS volumes, and the tool is mostly used for Network volume scans.

[KoalaBear84]

I guess so. Clear. No problem then. At least it's documented now in an issue :)

Screenshot: