Storage devices fillled up but file still written to it

Question

I created a bootable thumb drive for my windows installation and Ubuntu live CD, it also contains some windows exe (applications).

IMO in order to prevent against virus I came to the idea that I had better fill up all the space in the thumb drive. I use the command below on Ubuntu

yes > AAA.dummy

To create a dummy file and it stops when the drive has been filled up, and as I can see obviously see in Nautilus (Ubuntu file manager) it shows the drive is completely filled up and Windows 10 explorer shows 0 byte free on the drive.

Good it looks like what I want but trying to see if a file can still be written to drive I simply did

touch temp.text

The file get created, I was confused but I feel probably since the size of the created file is just 0 byte it doesn't matter but

echo "it doesn't work" > temp.txt

also works, the file is written and it shows in the drive. How Come?

If the space is 0 byte how is something still written to it? I ain't even save from Virus!. Tried same stuff on my Android device with a Terminal emulator, I filled up the space on removable sdcard but commands like touch still create empty file although this time around echo > *.txt doesn't work

EDIT:

Sorry I didn't add that, the file system is NFTS

My main concern is a virus can still write to the drive?

What file system are you using on the thumb drive? – StarCat Jan 06 '21 at 07:24 — StarCat, Jan 06 '21 at 07:24
I use Nfts yes, sorry for not adding that in the question – MaleeqB Jan 06 '21 at 07:52 — MaleeqB, Jan 06 '21 at 07:52

score 0 · Accepted Answer · answered Jan 06 '21 at 08:28

From this answer to "How can a file's size on disk be 0 bytes when there's data in it?":

To save disk space, NTFS keeps small files "resident", storing their contents right in the file record, so no cluster has to be allocated for it. Therefore, the size on disk is zero because there's nothing beyond the file record. Once the file gets sufficiently large, NTFS makes it "nonresident", allocates one or more clusters for it (creating a nonzero "size on disk"), and creates a "mapping pair" in the file record in the place of the data to point to the cluster.

Additionally:

As files are added to an NTFS volume, more entries are added to the MFT [Master File Table] and so the MFT increases in size. When files are deleted from an NTFS volume, their MFT entries are marked as free and may be reused, but the MFT does not shrink. Thus, space used by these entries is not reclaimed from the disk.

So it's possible there was a free entry in MFT and the file content went there.

Storage devices fillled up but file still written to it

1 Answers1