Short answer
An MFT scan reads the NTFS Master File Table, the drive's file index, to build a file inventory. A folder scan visits accessible folders instead. Osenpa Disk Analyzer chooses the available method automatically.
A folder scan can take longer. That is not an error or a sign that you need to clean the drive. Either method can produce a complete or partial result.
Wait for the result, then read any access, protection, skipped-item, or partial warning before trusting the total.
This guide covers Osenpa Disk Analyzer. Check requirements and download options before you begin.
On this page
When to use this method
Use this guide when one drive takes longer to scan or the result reports access, protection, skipped, or partial coverage.
Before you start
Keep the drive connected and let the scan finish. To check the file system, open the drive's Properties in File Explorer. An NTFS drive may use the MFT method when Windows allows the required access; you do not need to choose a scan method manually.
Scan methods and coverage When the MFT method is available, when folder traversal is used and what can be missed.
- What the result reports
- Read item-level access, protection or skipped cues and any drive-level coverage warning. A message about a drive taking longer is separate from a warning that some content could not be read.
- How the method is chosen
- Supported NTFS volumes can use the built-in file index; other targets and NTFS volumes without native access use compatible folder traversal.
- Important limit
- Damaged records, locked paths, reparse points that redirect to another location, protected locations or a disconnected drive can leave a useful but incomplete inventory.
Check the file system and the scan time
The result is a snapshot, so files created or removed afterward need a new scan. MFT inventory reads file-system metadata, not the contents of every document. To find what is using the space, follow the large-file walkthrough after checking scan coverage.
Read the scan result in context
-
Choose one drive
Select the drive you want to inspect. Use Scan All only when you need several drives. You should see the chosen drive's label and capacity.
-
Let the scan finish
Choose Scan on the drive card and wait for the results to appear automatically. The app chooses the compatible method from the file system and available access. If you chose the wrong drive, use Cancel Scan, check the drive list and start the intended scan.
-
Check the scan method and messages
When drive tabs are present, point to a tab to read any scan explanation offered. A message that the drive may take longer to scan describes normal behavior. Check partial, access, protection or skipped messages separately before treating the total as complete.
-
Retry only after a warning
Reconnect the drive or resolve a known access problem, then scan again. You should see the warning disappear or the reported scope change.
MFT scan compared with a folder scan
Coverage and completion matter alongside speed.
Scroll the table horizontally on a narrow screen.
| Question | MFT scan | Folder scan |
|---|---|---|
| Best fit | A supported NTFS volume with native access | A non-NTFS file system, or an NTFS volume where native access is unavailable |
| How it works | Reads NTFS file-system metadata | Walks accessible folders and files |
| Typical tradeoff | Often faster for a broad inventory | Walks every accessible path, so duration rises with tree size and access checks |
| What can limit coverage | Damaged records, reparse points or restricted native access | Locked, protected, disconnected or inaccessible paths |
| Trust signal | Method plus item-level access, protection or skipped cues; verify coverage when a warning reports incomplete access | Method plus item-level access, protection or skipped cues; verify coverage when a warning reports incomplete access |
Scan interpretation mistakes
- Calling every result a complete drive inventory
- Comparing methods by speed without checking scope
- Ignoring item-level access, protection or skipped cues
- Treating every slower scan as partial even when no incomplete-coverage warning is present
Checkpoint: Scan result checks
- The reported method matches the target.
- Item-level access, protection or skipped cues have been reviewed.
- A finished state is not treated as proof of complete coverage.
- A result with an incomplete-coverage warning is checked with a focused rescan before its total is trusted.