muk07 wrote:
I already do not have hypotheses
Probably in this article the answer: http://habrahabr.ru/company/infopulse/blog/274183/
Something is written down except the main file in additional flows NTFS. Or (that is less probable) is not written down.