Using SwiftSearch to know if a little file is stored directly on $MFT
I decided to better start this new topic because I really hate when a topic is hijacked to talk about subjects not directly related to the topic.
To keep things togeter, I'm going to quote the posts where this talk started:
Well after this very long preamble, let's go to the main subject of the topic.
Wonko mentioned several tools on his quoted links, and commented depending of the tool he gets different results.
I remembered I have already available SwiftSearch on my PC and decided to give it a try for this task. I have used it before on Wimboot installations to see if a file is a real size file or only a Pointer to the coupled WIM (cero size on disk in this case).
Then I created C:\Test.txt file of 700 bytes, and copied it to other partitions on my HD, and also to C: renamed as Test-2.txt, and in all cases the size on disk is 0, wich I take as located on %MFT.
Then copied it again as Test-XXXXXXXXXXXXXXXXXX.txt, and just because the name is longer now, it is not located anymore on $MFT, and now same 700 bytes size file is consuming 4 K or 4,096 bytes, a full cluster size, which is the minimum used size a file stored outside of $MFT can be on NTFS.