Understand the way file systems work. In both FAT and NTFS, there is a
"database" of file locations. In FAT, it is the File Allocation Table, which
contains the file name and the location of its bytes (File Allocation Table =
FAT). IN NTFS, you have the same basic concept in the Master File Table
(MFT), with one large exception: any file smaller than cluster size is stored
in the MFT itself.
When a file is created, an entry has to be made in the "database". If the
number of bytes are small enough, this happens simultaneously in NTFS. As a
file continues to be written (large file), the "database" is updated with new
locations (start/end bytes).
Technically, the file is created before bytes are written, or at least the
initial entry is made. This does not mean you will necessarily be able to see
the file as it is being written.
--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA
***************************
Think Outside the Box!
***************************