Monitoring NTFS deduplication