79. Files with Zeroes

• When NTFS encounters files with long runs of zeros, the system counts how many zeroes are present in the MFT header attribute. The counter is stored instead of actual data.

• Long runs of zeros are common on disks, so counting them is an easy way to compress a file.

• The counting mechanism kicks in when the run of zeros consumes an entire cluster.

• The resulting "sparseness" of the file is annotated in the data run that maps the clusters allocated to the file.