MacOS – Why 2 same files have different size on NTFS

filesystemmacosntfs

I have 2 same files residing on an NTFS filesystem:

Romans-MacBook-Pro:cut poma$ md5 src.mov 
MD5 (src.mov) = 7d59d01e5efffe3a258eff86d8b775a0
Romans-MacBook-Pro:cut poma$ md5 copy.mov 
MD5 (copy.mov) = 7d59d01e5efffe3a258eff86d8b775a0

According to ls they have same sizes and same attributes:

Romans-MacBook-Pro:cut poma$ ls -l@
total 10681888
...
-rw-r--r--@ 1 poma  staff   290300838 Jan 19 13:56 copy.mov
    com.apple.quarantine            22 
    Mac_Metadata            20 
-rw-rw-rw-@ 1 poma  staff   290300838 Jan 19 13:12 src.mov
    com.apple.quarantine            22 
    Mac_Metadata            20

But according to Finder and mdls they have different size:

Romans-MacBook-Pro:cut poma$ mdls src.mov 
kMDItemFSContentChangeDate = 2015-01-19 06:12:45 +0000
kMDItemFSCreationDate      = 2015-01-05 04:54:25 +0000
kMDItemFSCreatorCode       = ""
kMDItemFSFinderFlags       = 0
kMDItemFSHasCustomIcon     = 0
kMDItemFSInvisible         = 0
kMDItemFSIsExtensionHidden = 0
kMDItemFSIsStationery      = 0
kMDItemFSLabel             = 0
kMDItemFSName              = "src.mov"
kMDItemFSNodeCount         = 290301124
kMDItemFSOwnerGroupID      = 99
kMDItemFSOwnerUserID       = 99
kMDItemFSSize              = 290301124
kMDItemFSTypeCode          = ""

Romans-MacBook-Pro:cut poma$ mdls copy.mov 
kMDItemFSContentChangeDate = 2015-01-19 06:56:04 +0000
kMDItemFSCreationDate      = 2015-01-19 06:56:04 +0000
kMDItemFSCreatorCode       = ""
kMDItemFSFinderFlags       = 0
kMDItemFSHasCustomIcon     = 0
kMDItemFSInvisible         = 0
kMDItemFSIsExtensionHidden = 0
kMDItemFSIsStationery      = 0
kMDItemFSLabel             = 0
kMDItemFSName              = "copy.mov"
kMDItemFSNodeCount         = 290300838
kMDItemFSOwnerGroupID      = 99
kMDItemFSOwnerUserID       = 99
kMDItemFSSize              = 290300838
kMDItemFSTypeCode          = ""

AFAIK resource forks should appear in ls -l@ as com.apple.ResourceFork attribute. There is no such attribute on my file. What may be the difference between them?

UPDATE: I didn't notice at first. Both files reside in NTFS filesystem which is accessed through Paragon NTFS driver v12.

Best Answer

This is probably due to how Paragon driver handles native NTFS compression. If I understand their docs correctly, it can un-compress on-the-fly, but cannot actually write the file back in compressed state.

From their faq page:

  1. How does the NTFS for Mac® driver handle compressed files?
    NTFS supports its own compression feature. It is impossible (without a special copy routine) to copy compressed files or directories “as is” - because after the reading step we get the uncompressed file or directory. However, if the destination folder is compressed (on an NTFS partition), then the file or folder will be compressed too.

You can confirm your suspicions from Windows, by using standard Windows tools: https://technet.microsoft.com/en-us/library/cc976811.aspx
(Unfortunately, I haven't found any tools that can confirm it from Paragon)

Related Question