<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <style> <!-- p.MsoNormal, li.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} ol {margin-bottom:0mm;} --> </style> <title>The Windows Master File Table (MFT) programming tutorials</title> <meta name="keywords" content="Windows Master File Table, MFT, tutorials, programming, info, project, system, kernel, platform, online" /> <meta name="description" content="The Windows Master File Table (MFT) information for C/C++ programming" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="Section1"> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="5" face="Times New Roman"> <span style="line-height:115%;font-family:&quot;Arial&quot;; font-weight:400"> Win32 Windows Volume Program and Code Example 19</span></font></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">&nbsp;</span></font><script type="text/javascript"> <!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "0761177910"; google_ad_width = 728; google_ad_height = 90; //--> </script> <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script> </p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">Windows Master File Table (MFT)</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The NTFS file system contains a file called the <b><span style="font-weight:bold">master file table</span></b>, or MFT. There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself. All information about a file, including its size, time and date stamps, permissions, and data content, is stored either in MFT entries, or in space outside the MFT that is described by MFT entries. As files are added to an NTFS file system volume, more entries are added to the MFT and the MFT increases in size. When files are deleted from an NTFS file system volume, their MFT entries are marked as free and may be reused. However, disk space that has been allocated for these entries is not reallocated, and the size of the MFT does not decrease. Because utilities that defragment NTFS file system volumes on Windows 2000 cannot move MFT entries, and because excessive fragmentation of the MFT can impact performance, the NTFS file system reserves space for the MFT to keep the MFT as contiguous as possible as it grows. The space reserved by the NTFS file system for the MFT in each volume is called the MFT zone. Space for file and directories are also allocated from this space, but only after all of the volume space outside of the MFT zone has been allocated.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Depending on the average file size and other variables, either the reserved MFT zone or the unreserved space on the disk may be allocated first as the disk fills to capacity. Volumes with a small number of relatively large files will allocate the unreserved space first, while volumes with a large number of relatively small files allocate the MFT zone first. In either case, fragmentation of the MFT starts to take place when one region or the other becomes fully allocated. If the unreserved space is completely allocated, space for user files and directories will be allocated from the MFT zone. If the MFT zone is completely allocated, space for new MFT entries will be allocated from the unreserved space.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The MFT could not be used for defragmentation under Windows 2000, but this restriction is removed in Windows XP and later. Also, the MFT itself can be defragmented. To reduce the chance of the MFT zone becoming fully allocated before the defragmentation process is complete, leave as much space at the beginning of the MFT zone as possible before defragmenting the volume. If the MFT zone becomes fully allocated before defragmentation has completed, there must be unallocated space outside of the MFT zone. The default MFT zone is calculated and reserved by the system when it mounts the volume, and is based on volume size. You can increase the MFT zone by means of the registry entry detailed in <a href="http://go.microsoft.com/FWLink/?LinkId=83991" target="_blank">Microsoft Knowledge Base Article 174619</a>, but you cannot make the default MFT zone smaller than what is calculated. Increasing the MFT zone does not decrease the disk space that users can use for data files.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">To determine the current size of the MFT, analyze the NTFS file system drive with Disk Defragmenter, then click the <b> <span style="font-weight:bold">View Report</span></b> button. The drive statistics will be displayed, including the current MFT size, and number of fragments. You can also obtain the size of the MFT by using the FSCTL_GET_NTFS_VOLUME_DATA control code. The master file table (MFT) stores the information required to retrieve files from an NTFS partition. A file may have one or more MFT records, and can contain one or more attributes. In NTFS, a file reference is the MFT segment reference of the base file record. The MFT contains file record segments; the first 16 of these are reserved for special files, such as the following:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">1.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">0: MFT (<b>$Mft</b>)</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">2.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">5: root directory (<b>\</b>)</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">3.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">6: volume cluster allocation file (<b>$Bitmap</b>)</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">4.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">8: bad-cluster file (<b>$BadClus</b>)</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Each file record segment starts with a file record segment header. For more information, see <a title="The FILE_RECORD_SEGMENT_HEADER structure" target="_blank" href="http://msdn.microsoft.com/en-us/library/bb470124(VS.85).aspx"> FILE_RECORD_SEGMENT_HEADER</a>. Each file record segment is followed by one or more attributes. Each attribute starts with an attribute record header. For more information, see <a title="The ATTRIBUTE_RECORD_HEADER structure" target="_blank" href="http://msdn.microsoft.com/en-us/library/bb470039(VS.85).aspx"> ATTRIBUTE_RECORD_HEADER</a>. The attribute record includes the attribute type (such as $DATA or $BITMAP), an optional name, and the attribute value. The user data stream is an attribute, as are all streams. The attribute list is terminated with 0xFFFFFFFF (<b>$END</b>). The following are some example attributes.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <ol style="margin-top:0mm" start="1" type="1"> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The $Mft file contains an unnamed <b>$DATA</b> attribute that is the sequence of MFT record segments, in order.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The $Mft file contains an unnamed $BITMAP attribute that indicates which MFT records are in use.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The $Bitmap file contains an unnamed $DATA attribute that indicates which clusters are in use.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The $BadClus file contains a $DATA attribute named <b>$BAD</b> that contains an entry that corresponds to each bad cluster.</span></font></li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">When there is no more space for storing attributes in the file record segment, additional file record segments are allocated and inserted in the first (or base) file record segment in an attribute called the attribute list. The attribute list indicates where each attribute associated with the file can be found. This includes all attributes in the base file record, except for the attribute list itself. Structures related to the MFT include the following (<i>some of the structures definition cannot be found in the MSDN documentation</i>):</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">1.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">ATTRIBUTE_LIST_ENTRY</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">2.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">ATTRIBUTE_RECORD_HEADER</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">3.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">FILE_NAME</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">4.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">FILE_RECORD_SEGMENT_HEADER</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">5.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">MFT_SEGMENT_REFERENCE</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">6.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">MULTI_SECTOR_HEADER</span></font></p> <p class="MsoNormal" style="margin-top:0mm;margin-right:0mm;margin-bottom:0mm; margin-left:35.7pt;margin-bottom:.0001pt;text-indent:-17.85pt;line-height:normal"> <font size="3" face="Arial"><span style="font-size:12.0pt;">7.</span></font><font size="3" face="Times New Roman"><span style="font-family:&quot;Times New Roman&quot;,&quot;serif&quot;"><font face="Times New Roman"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-family:Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></font></span> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;">STANDARD_INFORMATION</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "2156170134"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h3 align="center" style="margin-top: 0; margin-bottom: 0"> <font face="Byington"><span style="font-weight: 400">&nbsp; &lt; <a title="Deleting a Mounted Folder C/C++ Program Example" href="windowsvolumeapis1_17.html"> Windows Volume 18</a> | <a title="The Win32 programming tutorial using Visual Studio, C and C++ languages" href="index.html"> Win32 Programming Index</a> | <a title="Windows storage/volume programming tutorials" href="windowsvolumeapis1index.html"> Windows Volume Index</a> | <a title="The Windows Master File Table Program Example 1" href="windowsvolumeapis1_19.html"> Windows Volume 20</a> &gt;</span></font></h3> <div align="center"> <script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=527221&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=82741"></script> </div> </div> </body> </html>