http://msdn.microsoft.com/en-us/library/windows/desktop/aa364418%28v=vs.85%29.aspx Memory makes no difference. The underlying Win32 API is an enumeration. So is the Native API http://msdn.microsoft.com/en-us/library/windows/hardware/ff567047%28v=vs.85%29.aspx. You start it, and it keeps going slice by slice until it errors out with "no more files". According to ReactOS, the kernel and its drivers dont make a mega list with every entry in ram, which would justify seeking. They advance a counter every time you fetch an entry. http://doxygen.reactos.org/d5/d16/ntfs_2dirctl_8c_source.html#l00481