Win32 Windows Volume Program and Code Example 19




Windows Master File Table (MFT)


The NTFS file system contains a file called the master file table, or MFT. There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself. All information about a file, including its size, time and date stamps, permissions, and data content, is stored either in MFT entries, or in space outside the MFT that is described by MFT entries. As files are added to an NTFS file system volume, more entries are added to the MFT and the MFT increases in size. When files are deleted from an NTFS file system volume, their MFT entries are marked as free and may be reused. However, disk space that has been allocated for these entries is not reallocated, and the size of the MFT does not decrease. Because utilities that de-fragment NTFS file system volumes on Windows 2000 cannot move MFT entries, and because excessive fragmentation of the MFT can impact performance, the NTFS file system reserves space for the MFT to keep the MFT as contiguous as possible as it grows. The space reserved by the NTFS file system for the MFT in each volume is called the MFT zone. Space for file and directories are also allocated from this space, but only after all of the volume space outside of the MFT zone has been allocated.



Depending on the average file size and other variables, either the reserved MFT zone or the unreserved space on the disk may be allocated first as the disk fills to capacity. Volumes with a small number of relatively large files will allocate the unreserved space first, while volumes with a large number of relatively small files allocate the MFT zone first. In either case, fragmentation of the MFT starts to take place when one region or the other becomes fully allocated. If the unreserved space is completely allocated, space for user files and directories will be allocated from the MFT zone. If the MFT zone is completely allocated, space for new MFT entries will be allocated from the unreserved space.

The MFT could not be used for defragmentation under Windows 2000, but this restriction is removed in Windows XP and later. Also, the MFT itself can be defragmented. To reduce the chance of the MFT zone becoming fully allocated before the defragmentation process is complete, leave as much space at the beginning of the MFT zone as possible before defragmenting the volume. If the MFT zone becomes fully allocated before defragmentation has completed, there must be unallocated space outside of the MFT zone. The default MFT zone is calculated and reserved by the system when it mounts the volume, and is based on volume size. You can increase the MFT zone by means of the registry entry detailed in Microsoft Knowledge Base Article 174619, but you cannot make the default MFT zone smaller than what is calculated. Increasing the MFT zone does not decrease the disk space that users can use for data files.

To determine the current size of the MFT, analyze the NTFS file system drive with Disk Defragmenter, then click the View Report button. The drive statistics will be displayed, including the current MFT size, and number of fragments. You can also obtain the size of the MFT by using the FSCTL_GET_NTFS_VOLUME_DATA control code. The master file table (MFT) stores the information required to retrieve files from an NTFS partition. A file may have one or more MFT records, and can contain one or more attributes. In NTFS, a file reference is the MFT segment reference of the base file record. The MFT contains file record segments; the first 16 of these are reserved for special files, such as the following:


1.      0: MFT ($Mft)

2.      5: root directory (\)

3.      6: volume cluster allocation file ($Bitmap)

4.      8: bad-cluster file ($BadClus)


Each file record segment starts with a file record segment header. For more information, see FILE_RECORD_SEGMENT_HEADER. Each file record segment is followed by one or more attributes. Each attribute starts with an attribute record header. For more information, see ATTRIBUTE_RECORD_HEADER. The attribute record includes the attribute type (such as $DATA or $BITMAP), an optional name, and the attribute value. The user data stream is an attribute, as are all streams. The attribute list is terminated with 0xFFFFFFFF ($END). The following are some example attributes.


  1. The $Mft file contains an unnamed $DATA attribute that is the sequence of MFT record segments, in order.
  2. The $Mft file contains an unnamed $BITMAP attribute that indicates which MFT records are in use.
  3. The $Bitmap file contains an unnamed $DATA attribute that indicates which clusters are in use.
  4. The $BadClus file contains a $DATA attribute named $BAD that contains an entry that corresponds to each bad cluster.



When there is no more space for storing attributes in the file record segment, additional file record segments are allocated and inserted in the first (or base) file record segment in an attribute called the attribute list. The attribute list indicates where each attribute associated with the file can be found. This includes all attributes in the base file record, except for the attribute list itself. Structures related to the MFT include the following (some of the structures definition cannot be found in the MSDN documentation):




3.      FILE_NAME







  < Windows Volume 18 | Win32 Programming Index | Windows Volume Index | Windows Volume 20 >