NTFS compression minutiae – Dmitry Brant
Summary
It’s been a rather productive sprint of making enhancements to DiskDigger in recent weeks, specifically in solidifying its support for parsing NTFS filesystems, and supporting the finer details and edge cases that are found in the wild. Firstly, individual files in NTFS can be compressed, which the user can choose to do to conserve disk space. (DiskDigger has been able to recover compressed files, but I have now improved the speed of the decompression routine. Starting with Windows 10, there is a system process that runs in the background and looks for system files and program files that are seldom used, and compresses them in a different way: it creates an alternate data stream called and writes the compressed data to it, using either the Xpress or LZX algorithms (Xpress seems to be the default). Anyway, DiskDigger now supports this second type of compression in NTFS filesystems, and will transparently decompress the file when it’s recovered.