Microsoft KB Archive/93600

= Unused Space in Sector is Zeroed Out Under Windows NT =

Article ID: 93600

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Advanced Server 3.1
 * Microsoft Windows NT Workstation 3.1

-



This article was previously published under Q93600



SUMMARY
When you create a new file, a certain amount of space is allocated for that file. Under Windows NT, if you do not use the entire space allocated, the file system returns zeros for the unused space. This prevents subsequent users from reading previously written and deleted data.

Under Windows NT, the file allocation table (FAT) structure actually fills such unused space with zeros. Unlike FAT systems, the high-performance file system (HPFS) and Windows NT file system (NTFS) keep track of how much valid data is actually in the file.



FAT Under MS-DOS
Under MS-DOS, when a file is written to a disk, a certain amount of space on a given sector may be unallocated. This is because the file size may be less than or greater than the size of a single sector. In this unallocated space, there could be pre-existing data marked as deleted that could be read and copied by intruders. This can be detrimental in enviroments that want to prevent old data from being extracted after it is supposedly deleted.

FAT Under Windows NT
Windows NT prevents access to old data fragments by masking old data bits with zeros. Thus, when a sector is read into memory, Windows NT replaces the old data bits with zeros and prevents any intruder from accessing this deleted data. This replacement is done in kernel mode.

NTFS and HPFS
Unlike FAT systems, HPFS and NTFS keep track of how much valid data is in a file. For example, if you create a 10 MB file and write 1 MB of data, HPFS and NTFS do not actually zero out the 9 MB of unused space (as the FAT system does), but are aware that this space is unavailable, and any disk read to the upper 9 MB returns all zeros.

Additional query words: prodnt

Keywords: kbother KB93600

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.