Disk runs out of space if Comodo Internet Security is installed

The virtual disk behaves strangely if Comodo Internet Security is installed on the system. Free space on virtual disk expires before it should. The difference between how much disk space is taken and how many files are actually written to disk can exceed 100% (for example, 2 GB is recorded, but 4 GB is taken), and the disk size limit is reached very quickly and files are no longer placed on disk (because there is no space). If an image is connected to a virtual disk, the "phantom occupied" space can be freed by rebooting the image, but this does not solve the problem, when writing to the disk is active, it will be occupied again. When CIS is removed, this behavior is not observed. I tested with another antivirus (Kaspersky Internet Security), with it does not observe such behavior.

OS: Windows 10 with last updates (Windows 11 too)
Comodo Internet Security v12.2.2.8012 (last version)

Sorry we were unable to reproduce this. We have installed the latest version of CIS and our RAM Disk, and copied a 300 MB file to a 1 GB RAM Disk a few times. The used disk space remained correct, as you can see in the screen shot below.

I guess in your case it may be caused by CIS antivirus that retains a copy of written data for checking, but it should behave the same way with any volume, even a USB thumb drive. It's unlikely to be an issue with our product since a RAM disk is a simple block storage device. It does not allocate space for files or anything like that, only emulates a storage device in RAM.

Try writing a large number of small files. In my case, 600 files with a total size of 2 gigabytes

Looks like this only happens if NTFS compression is enabled, but I'm not sure.

I checked again, it depends only on NTFS compression, not CIS. I get 100% reproduce when NTFS compression is enabled. So, 600 files with a total size of 2 gigabytes with enabled NTFS compression.

I don't use RAM Disk, but I can confirm that Comodo Internet Security and other comprehensive antivirus\security suites can break or mess up with may things in the system. Some problems are totally unexpected, incomprehensible, and can take a lot of time to figure out what's happening. In my case CIS paralyzed a few apps that I really needed for work. And there was no other way to fix that except to uninstall Comodo completely. I tried a few other security suites, but they all are too invasive and basically take over the system, break other apps, and slow everything down.

Also, keep in mind that Comodo adds alternate data streams to each NTFS file. If you have many small files, this can create a huge discrepancy between the space that Windows reports as free, and the free space that you would expect to have (calculated as your disk size minus the sum of all file sizes). Moreover, all files downloaded from the internet will also have "Zone.Identifier" stream added, no matter if you have Comodo or not. Those streams are "invisible", so they are not added to the file size, but they do eat into the free space on disks.

Eventually I solved the problem by installing NetGenius - that's how I came across Softperfect! I use NetGenius as a firewall for blocking all unwanted and unnecessary online activities of various apps. It is super light and fast compared to Comodo, and doesn't break the system. And for protection against viruses and other malware I simply adopted a better online hygiene. I became much more aware and careful. I avoid visiting dubious sites, and never open emails or files from untrusted sources. I also occasionally scan my computer with portable scanners like Kaspersky Virus Removal Tool, which can be simply downloaded, run once, and then deleted without leaving a trace.

As I said, apparently I was wrong and my problem is not related to CIS, I checked on a virtual machine and incorrect behavior RamDisk observed only when NTFS compression is enabled

I am afraid this is not reproducible. Here is my test case:

Create 600 files 2 MB each with random contents totalling 1.2 GB



Create an 8 GB RAM disk with compressed NTFS



Copy these 600 files ten times from D:\TEMP to R:\TEST and query free space



There is a space discrepancy with 2.2 GB been used while the files occupy 1.2 GB but that's not unusual and not related to the problem you described. The reduced free space can have multiple reasons. One thing to understand is that free disk space will always be less than <Disk size> minus <Total size of all files>. This is because there is a lot of metadata which also eats up space like VSS Snapshots, MFT, logs and so on.

During compression of single files NTFS will temporarily keep the original file until compression has completed. This is to ensure that you still would be left with a valid version of the file in case your computer crashed. This however should only be temporary. Nevertheless everything points to NTFS metadata to cause this, not the RAM Disk.

You just reproduced the problem, but you say it's not reproducible. Whatever the reasons, the occupied space remains occupied beyond measure and this does not disappear over time. Where such a large amount of metadata came from in random files.

In addition, this is not observed when using AMD RAMDisk. On any other (not virtual) disk, this behavior is also not observed. I checked VHDX - the same strange behavior. I don't understand why.

I have tested it with mounted VHD file as you suggested and encountered the same issue. In this test the I:\ drive is a mounted 8GB VHD file and there is 1.2 GB difference in free space reported in Windows Explorer and chkdsk output.



Microsoft has this article on NTFS disk space misreporting, but none of the points are relevant to our case.

I have come to the conclusion that it's not our RAM Disk's fault, but some kind of Windows bug or something.

Yes, I was wrong about AMD RAMDisk, I checked and there is the same problem. For some reason earlier I thought that there wasn't. Then I thought it happens on small disks. I checked, this happens on disks of any size, only on large disks this is not as noticeable. Free space is displayed correctly only after the disk is remounted. I think the topic can be closed.

In order to stop the consumption disk space while using Comodo, simply change the logging setting to "Write to Windows Log Event", set a size, and then tick the "Keep on updating it removing the oldest records".