Don't Trust All Your Eyes Tell You... (hard links in Windows Vista)
There are times when the Windows shell gives you incorrect information - not because it likes lying, but because it is being given this information by a lower-level component.
Such is the case with the long-awaited "hard links" introduced with Windows Vista.
A hard link is effectively an additional pointer to an already-existing file, which displays all the properties of the file in exactly the same way as the original reference - the data itself is not copied, however.
Because a hard link appears no different from a regular file, all enumerations of folders which contain links to the same file will be overestimating the disk space used.
Example...
Here I created a "test" folder on my desktop and copied into it one ~100MB file "test.dat" (large size for better illustration):
C:\Users\padams\Desktop\test>dir Volume in drive C has no label. Volume Serial Number is A8D0-FCE3 Directory of C:\Users\padams\Desktop\test 2008-10-10 16:23 <DIR> . 2008-10-10 16:23 <DIR> .. 2008-10-10 16:23 104 921 808 test.dat 1 File(s) 104 921 808 bytes 2 Dir(s) 54 231 470 080 bytes free |
I then made 10 hard links to this file; copy01.dat thru copy10.dat:
C:\Users\padams\Desktop\test>mklink /h copy01.dat test.dat Hardlink created for copy01.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy02.dat test.dat Hardlink created for copy02.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy03.dat test.dat Hardlink created for copy03.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy04.dat test.dat Hardlink created for copy04.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy05.dat test.dat Hardlink created for copy05.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy06.dat test.dat Hardlink created for copy06.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy07.dat test.dat Hardlink created for copy07.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy08.dat test.dat Hardlink created for copy08.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy09.dat test.dat Hardlink created for copy09.dat <<===>> test.dat C:\Users\padams\Desktop\test>mklink /h copy10.dat test.dat Hardlink created for copy10.dat <<===>> test.dat |
Now see how the folder contents are presented:
C:\Users\padams\Desktop\test>dir Volume in drive C has no label. Volume Serial Number is A8D0-FCE3 Directory of C:\Users\padams\Desktop\test 2008-10-10 16:26 <DIR> . 2008-10-10 16:26 <DIR> .. 2008-10-10 16:23 104 921 808 copy01.dat 2008-10-10 16:23 104 921 808 copy02.dat 2008-10-10 16:23 104 921 808 copy03.dat 2008-10-10 16:23 104 921 808 copy04.dat 2008-10-10 16:23 104 921 808 copy05.dat 2008-10-10 16:23 104 921 808 copy06.dat 2008-10-10 16:23 104 921 808 copy07.dat 2008-10-10 16:23 104 921 808 copy08.dat 2008-10-10 16:23 104 921 808 copy09.dat 2008-10-10 16:23 104 921 808 copy10.dat 2008-10-10 16:23 104 921 808 test.dat 11 File(s) 1 154 139 888 bytes 2 Dir(s) 54 231 461 888 bytes free |
Look at the number of bytes allegedly used, but then compare the 'bytes free' values from the 2 listings - clearly the disk space used has not increased by 1GB by making 10 hard links.
The command prompt is not "faulty" - Explorer is given the same information on the files too:
When do we use hard links?
Most of the contents of %systemroot%\System32 is actually hard links to files in folders under %systemroot%\winsxs - the "Side-By-Side" component store.
This basically means if you view the properties of the %systemroot% folder, you can pretty much subtract the size of the %systemroot%\System32 folder to get a more accurate total size.
On a side-note, details on the winsxs folder can be found here, along with the reasoning for its size:
https://blogs.technet.com/askcore/archive/2008/09/17/what-is-the-winsxs-directory-in-windows-2008-and-windows-vista-and-why-is-it-so-large.aspx
Why use hard links?
To save disk space when multiple copies of the same file are useful, especially if the file contents change and all references need to be in sync.
You could use shortcuts (.lnk files) or symbolic (soft) links, but these are separate files on disk and have to be understood by the applications looking at them - an application from the mid 90's, for example, would try to open a .lnk file if you told it to, it would have no idea that this is a pointer to where the file really is.
What happens when a hard link is deleted?
The file itself is only deleted when ALL references to it have disappeared.
So in the above example I could delete test.dat and copy01.dat thru copy09.dat - the file would not be deleted as it is still accessible through copy10.dat.
Once copy10.dat is deleted, then the disk space is marked as free again.