It includes not just the resident portion of the file cache but also of the paged pool and of pageable code in drivers and the OS itself. And in NT4 task manager showed a counter called "file cache", ...