Hard Drive – Identifying a 7 cm x 9.5 cm Hard Disk with 48 Pins

Alternate data streams

Your source files might have NTFS Alternate data streams. If your backup/synchronization software is not aware of them, they won't be copied to the target. There are many tools that can display them, and since Windows Vista you can do dir /r, which displays not only files but their alternate data streams as well.

Different filesystem cluster size

Disk space taken up by a file is rounded up, as a file takes a whole number of filesystem clusters. E.g. if your file's size is 3000 bytes, and filesystem cluster size is 4K, then the file will take 4K exactly. If your two filesystems use different cluster size, then amount of disk space wasted in this manner will be different.

Other rarely-used NTFS features

NTFS has several other features which may or may not be supported by your backup software:

• Compression. If compressed files are uncompressed during copying, they will take more space.
• Sparse files: Special care must be taken when copying these, otherwise they will "explode", e.g. take much more space and not be sparese anymore.
• Reparse points, hard links, and many other features that can confuse your backup software.

Conslusion

Don't rely on filesystem totals. Use some kind of auditing to make sure your files are copied properly. For example, you may try md5deep to calculate hashes and compare files.

Some flash drives (and even external HDDs) have built-in software. These drives are made to look like 2 devices to the OS, the first is presented as a CD-ROM and the second is presented as a normal read/write mass storage device.

This is not partitioning as understood/done by the OS - it's done on a lower level - it's controlled by the microcontroller in the USB device.

Utilities from device manufacturers (often in Chinese) do exist to change this arrangement--and you have to use one compatible with the microcontroller--and they are difficult to find and use.

I'm betting this flash drive at one point was destined to have built in software on it, but the manufacturer changed their mind for whatever reason.

So the unallocated area probably was a fake "CD-ROM" area containing encryption or backup software from another SKU of drives this manufacturer (or possibly another manufacturer) offers.

The manufacturer probably had an oversupply of these particular devices or some other related economic condition, then ran a utility to reconfigure the flash arrangement and remove the "CD-ROM" partition, but didn't bother to wipe this section of flash before packaging.

You should run TestDisk on the unallocated partition and see what you can find!