MFT Fragmentation
Home Up

 

MFT Fragmentation

by Lance Jensen, Executive Software Customer Support Director

The Master File Table (MFT) is the heart of the NTFS file system. It is essentially an index to all of the files on an NTFS volume, containing the file name, a list of the file attributes, and pointers to the fragments. The data for each file is contained in one record in the MFT, called the "file record". (For more information on the MFT, see my article in eLetter Volume 2, Issue 5).

Fragmentation of the MFT can be a problem on NTFS partitions. This is because the MFT is used for every disk I/O. While much of the MFT can be cached so that an actual disk I/O does not have to be performed every time, it is still true that on most systems the MFT is accessed more than any other file. This means that MFT fragmentation is likely to have more impact on the system than fragmentation of any other single file.

There are steps you can take to prevent or at least minimize MFT fragmentation. We'll cover these steps at the end of this article. First, let's examine how the MFT gets fragmented to begin with.

Converting FAT to NTFS

One of the major ways the MFT gets fragmented is when a FAT partition is converted to NTFS. A FAT partition is converted to NTFS when such a conversion is needed or desired, but it also occurs automatically during Windows NT installation if the NTFS format is chosen. The partition created during installation is a FAT partition, and even if the NTFS format is chosen during installation, the partition is still created as FAT, and only converted to NTFS after the first boot.

When a FAT partition is converted to NTFS, an MFT is created. If there is a large enough contiguous free space, the MFT is made contiguous, with contiguous pre-allocated expansion space. However, since the MFT itself plus the pre-allocated expansion space comprises about 12% of the partition, there is usually not enough contiguous free space and the MFT is created fragmented. In addition, the MFT will almost certainly not be at the beginning of the disk (or partition) as it is on NTFS-created partitions. This means you have data areas before the MFT and after it, then a secondary copy of critical MFT data, then another data area. So you can see that the converted partition has three data areas instead of the usual two; data fragmentation will thus begin to occur sooner.

As mentioned above, the partition created during Windows NT installation is a FAT partition, and this partition is only converted to NTFS after the first boot (if the NTFS format is chosen). This means you get the initial system files written to the beginning of the disk, then, when the conversion is done, the MFT is created. You can avoid this by using a dual-boot system. (See my earlier article "Multiple Boot Systems" in eLetter Volume 2, Issue 6 for details. Basically, you install a minimal Windows NT, then create an NTFS partition, preferably on another disk, and do your full installation of Windows NT to the new partition. Afterwards you can reformat the original partition to NTFS and reinstall the minimal Windows NT to retain the benefits of having two Windows NT installations.)

Another problem for the MFT is that Windows NT will, under some conditions, write files in the space reserved for MFT expansion. If such files have been written, the MFT will reach them as it grows, and will have to fragment to get around them.

MFT Record Overflow

A partition can have scattered pieces of the MFT sitting in the data area, outside the normal MFT area (the part that Diskeeper shows as green). These "MFT record overflow" pieces are actually things like extent lists, security attributes, and extremely long filenames that at some time in the past couldn't fit inside the MFT record for that file. These pieces are not part of a file, but are extensions to the MFT. Thus Diskeeper currently cannot move them. This means the free space cannot be fully consolidated, and it will be harder for the partition to be defragmented.

Preventing MFT Fragmentation

The only real "fix" at this time is to back up the partition, reformat it, and restore the data. Note that the partition should have a cluster size of at least 1Kb, because the MFT records are 1Kb in size; a smaller cluster size will allow the MFT records themselves to fragment.

To prevent or minimize MFT fragmentation, you should avoid the following:

  • converting FAT partitions to NTFS format, other than by deleting and recreating the partitions

  • use of compressed files on an active partition

  • compressing and decompressing entire volumes or directory sub-trees

  • unnecessary security lists

  • extremely long (greater than 31 character) file and directory names

Lance Jensen is our ace Tech Support Director, and has great experience with both Windows NT and Digital's OpenVMS. He can be reached at dknt_support@executive.com. Please feel free to write to him with questions or comments about this article.