){kind=link}
It can feel alarming when a folder’s Properties window reports one size and file count, but the delete confirmation reports a much larger number—sometimes by tens of thousands of files and many gigabytes. In most cases, this doesn’t mean Windows “created” extra data; it usually means you’re seeing two different scans with different permissions and rules.
What Those Two Numbers Actually Represent
In Windows, the folder size shown in Properties and the numbers shown during deletion can come from different enumeration paths:
- Properties (Right-click → Properties): typically performs a scan based on what File Explorer can currently read. If some subfolders are inaccessible, they may be skipped or counted as empty.
- Delete confirmation: may run a more complete, real-time traversal of items to be removed, sometimes after you grant elevation. That process can suddenly “discover” items that were previously hidden behind permissions.
A mismatch is often a visibility problem, not a sudden growth problem: different access levels can produce different counts from the same path.
Permissions and UAC Elevation: The Most Common Cause
A frequent explanation is simple: you didn’t have permission to read everything inside the folder when you checked Properties, but you did have permission (or temporarily gained it) when deleting.
On Windows 11, File Explorer can prompt you to “Continue” (UAC elevation) when accessing protected content. If you approve, Explorer may gain the ability to enumerate and act on subfolders that were previously unreadable. That can make file counts jump during operations like delete.
To understand how Windows handles that “Continue” prompt and why it appears, see Microsoft’s troubleshooting note here: “Continue” dialog box for folder access in Windows Explorer .
Junctions, Reparse Points, and Hard Links
Another reason numbers can look “off” is the presence of NTFS link features: junctions, symbolic links, and other reparse points, plus hard links. These can affect how tools count items and how “size” is interpreted.
A junction can make one directory path point to another directory. Depending on how the scan is performed, a tool may count the linked content differently (or avoid it to prevent loops). Microsoft provides a technical overview here: Hard Links and Junctions (Win32) .
If a folder tree contains reparse points, space accounting can also feel confusing—Microsoft even calls out that NTFS features like hard links and reparse points can complicate disk usage analysis: Disk space problems on NTFS volumes (notes on hard links and reparse points) .
Why File Explorer Can Disagree With Itself
| What you see | Why it can differ | Typical symptom |
|---|---|---|
| Properties shows smaller size/count | Some subfolders are unreadable (permissions), so enumeration is incomplete | Delete prompt later “finds” more items |
| Delete prompt shows larger count | Elevation or a deeper traversal includes protected/hidden content | Sudden jump in files/bytes right before deletion starts |
| Different tools report different sizes | Hard links and reparse points can be counted differently to avoid double counting or loops | One tool reports much bigger/smaller totals |
| “Size” vs “Size on disk” confusion | Allocation granularity and NTFS features affect on-disk usage | Many small files inflate “Size on disk” |
If you’re dealing with unusually deep paths or filenames, Windows path rules can also affect certain operations and tools. Microsoft’s background documentation on naming and path conventions is here: Naming Files, Paths, and Namespaces .
How to Verify What’s Really Inside Before Deleting
If you want confidence before removing a large folder, the goal is to run a count/size check that: (1) uses consistent permissions, and (2) makes it obvious whether special link types exist.
- Check whether access is the issue: try expanding the folder tree in File Explorer and watch for “Access denied” or “Continue” prompts. If prompts appear, that alone explains why one scan was incomplete.
- Look for reparse points/junctions: these often show special attributes in advanced tools. If you suspect this, read Microsoft’s overview of junction behavior and reparse points: Hard Links and Junctions.
- Use a consistent, elevated scan: if you run a scan with the permissions needed to traverse everything, your numbers become more stable. (Be cautious: elevating changes what you can see and delete.)
If a folder contains protected areas, the “regular” Properties scan can be truthful about what you can access, while the delete scan can be truthful about what actually exists. They can both be “right,” but answering different questions.
A Safer Deletion Approach for Large Folders
When the folder is large and you’re uncertain, a safer approach is to reduce the risk of deleting the wrong thing:
- Confirm the exact path you’re deleting (especially if the folder name is common).
- Check for unexpected redirects (junctions/reparse points) so you don’t remove content outside your intended tree.
- Consider moving first (same drive) to a temporary quarantine location, then delete from there if it still looks correct.
- Prefer backup/restore readiness for critical data: if the folder might contain anything important, ensure you have a recovery plan.
- Watch the prompts: if Windows asks for elevated permission, treat that as a signal that protected content is involved.
If the mismatch is driven by permissions, the “jump” at delete time is often a sign that the deletion process can finally enumerate protected subfolders. If the mismatch is driven by links/reparse points, understanding those features first helps you avoid surprises.
Key Takeaways
A folder showing one size/count in Properties and a larger size/count during deletion is commonly explained by: permissions (UAC elevation) and/or NTFS link features. The difference usually reflects what the system can enumerate under different access levels, not an unexplained creation of data.
Before deleting large remnants, it’s reasonable to verify the path, check for protected subtrees, and understand whether junctions/reparse points are present. That turns a scary-looking number change into a predictable, explainable behavior.
Post a Comment