Jump to content

Wipe free space removes MFT Zone


mike42

Recommended Posts

After running a wipe free space I observed my MFT zone had shrunk to a tiny size (one block displayed in Defraggler). I assume this happened, because CCleaner fills up the free space with one huge file and Windows releases the MFT zone in order to accomodate this file. However, this implies that the MFT will get fragmented as soon as you copy additional files to the disk.

 

Is there no way to write data (eg. zeros) to unallocated clusters without creating a file as such?

 

regards,

Mike

Link to comment
Share on other sites

  • Moderators

As I'm sure you know the 'standard' way of wiping free space is to fill up the disk with large files, and this includes the MFT zone. However the files are then deleted, leaving the disk with the same amount of free space as before, and the MFT zone as empty, or as full, as it was before.

 

I don't really know how CC's wipe free space works, and I know even less about Defraggler. In XP it is not possible to reduce the MFT zone below 12.5% (according to M/S) so I wouldn't think that your zone has decreased in size. Do any other Defraggler users notice this? In Vista the MFT is treated differently (from what I remember), being allocated in not-necessarily-contiguous 200k blocks.

 

This is assuming that the wipe free space option ran to completion and removed all filler files.

 

I don't think that it is wise to write to clusters without going through Windows file allocation processes, otherwise you could be in deep youknowwhat.

Link to comment
Share on other sites

However the files are then deleted, leaving the disk with the same amount of free space as before, and the MFT zone as empty, or as full, as it was before.

True, after deletion of the dummy files the (previous) MFT zone is freed too. But apparently it is not reserved for MFT anymore (at least, that's what Defraggler claims). So regular files might be placed where originally the MFT zone was.

I don't really know how CC's wipe free space works

It writes a huge file until the disk is full.

and I know even less about Defraggler

I mentioned Defraggler just, because it displays the MFT zone on its drive map.

In XP it is not possible to reduce the MFT zone below 12.5% (according to M/S) so I wouldn't think that your zone has decreased in size.

Afaik, windows WILL decrease the MFT zone as the disk is getting almost full, downto whatever size it takes to fit the new files on the disk.

I don't think that it is wise to write to clusters without going through Windows file allocation processes, otherwise you could be in deep youknowwhat.

Probably true ....

Link to comment
Share on other sites

  • Moderators
Afaik, windows WILL decrease the MFT zone as the disk is getting almost full, downto whatever size it takes to fit the new files on the disk.

To be pedantic, when the non-mft zone area of the disk is full then Windows will place new files in the mft zone, which is not the same as reducing the mft zone size. When these files are deleted then the mft zone resumes it's size and function (that's an assumption). I would rather lean towards Defraggler not truly reporting the mft zone than the zone being reduced.

 

Are you on XP? Do you have the default MFT zone size (12.5%) or is (was) your zone larger by a multiple of that?

 

Oh yes, can you do something like allocating a file large enough to be seen, and then look in Defraggler to see whether it's been put in the mft zone or not?

Link to comment
Share on other sites

To be pedantic, when the non-mft zone area of the disk is full then Windows will place new files in the mft zone, which is not the same as reducing the mft zone size. When these files are deleted then the mft zone resumes it's size and function (that's an assumption). I would rather lean towards Defraggler not truly reporting the mft zone than the zone being reduced.

 

Are you on XP? Do you have the default MFT zone size (12.5%) or is (was) your zone larger by a multiple of that?

 

Oh yes, can you do something like allocating a file large enough to be seen, and then look in Defraggler to see whether it's been put in the mft zone or not?

Yes, I'm on XP Pro SP3. I had set the MFT zone size to 2 (which means 25% I think) for test purposes.

 

The situation was the following: I had the $MFT file in the middle of other data. The MFT zone was sitting somewhere at the end of my disk (probably because I changed the MFT zon size in the registry once). Then I started wipe free space and watched it happen in Defraggler on the drive map. As the disk was filled up with the temporary file, the MFT zone was halved repeatedly to make space until it was gone completely (this is done by Windows). Finally, when the wipe-file was deleted by CCleaner again, the complete MFT zone was relocated (by Windows, I guess) to sit right behind my original $MFT file, ie. now covering all my normal data files that are placed behind the $MFT file. So, apparently Windows is doing strange things with the MFT zone when free disk space is running short. But most likely CCleaner is not to blame for that.

I don't know, what went wrong in my first try (when the MFT zone was gone completely after wiping).

Link to comment
Share on other sites

  • Moderators

Well, that's put a different complexion on things. I don't know if this is to do with your zone changes, or is something that Windows has done, or some combination of both. It's all rather peculiar though.

Link to comment
Share on other sites

  • 4 months later...

Thank you, you may have solved my problem. Not a big problem but it has been annoying me.

 

The MFT Zone is a large area which is supposed to be continuous with MFT so that MFT can expand into it without fragmenting. However on my drive the Zone is near the end of the partition, nowhere near either the MFT or the MFT-2 copy, as you can see.

Mft starts at 7278a (=468,874), so-called Zone starts at 9aac60(=10,136,672).

 

C:\>fsutil fsinfo ntfsinfo c:

NTFS Volume Serial Number : 0x2c400d41400d12ee

Version : 3.1

Number Sectors : 0x0000000005dbf6e0

Total Clusters : 0x0000000000bb7edc

Free Clusters : 0x000000000047ddb7

Total Reserved : 0x0000000000000500

Bytes Per Sector : 512

Bytes Per Cluster : 4096

Bytes Per FileRecord Segment : 1024

Clusters Per FileRecord Segment : 0

Mft Valid Data Length : 0x000000000a4ec000

Mft Start Lcn : 0x000000000007278a

Mft2 Start Lcn : 0x00000000002150bb

Mft Zone Start : 0x00000000009aac60

Mft Zone End : 0x0000000000b17780

I've done the usual Registry machinations but nothing changes that misplaced zone. And anyway, I wouldn't want a gigantic dead zone in the fastest part of the drive.

 

Defragmenters all move the MFT and other system files to the fastest part of the drive, and leave a small pad after the MFT. That pad is the actual MFT 'zone' that NTFS uses. So I have really wanted to get rid of the useless Zone at the end of the partition - although it doesn't really decrease the available disk space, according to Microsoft.

 

You seem to have hit on a way I can accomplish this. :).

I am going to try wiping free space. I'm hoping it will cause NTFS to reconstitute a smaller Zone in the right place. Thanks, I never would have thought of it and I believe it should work. (Can't do it right now, PC is too busy).

 

In the picture, the $ files, including $mft, are in the first 5 (red) squares. The MFT Zone is all that purple at the end.

post-15514-1250746233_thumb.png

post-15514-1250746233_thumb.png

Link to comment
Share on other sites

  • 7 years later...
  • Moderators

start an elevated command prompt, type in this; fsutil fsinfo ntfsinfo c:

after you hit Enter, look for the field MFT Start Lcn:

 

(it's all laid out in the quote in post #7)

Backup now & backup often.
It's your digital life - protect it with a backup.
Three things are certain; Birth, Death and loss of data. You control the last.

Link to comment
Share on other sites

  • Moderators

I love it. A vague question tacked onto the end of an eight-year-old thread discussing long obsolete operating systems. If you're not a spammer, then use Google. If you are, one of us will help you on your way.

Link to comment
Share on other sites

start an elevated command prompt, type in this; fsutil fsinfo ntfsinfo c:

after you hit Enter, look for the field MFT Start Lcn:

 

(it's all laid out in the quote in post #7)

Thanks for your reply, is there any other way to get it? Such as operating system API function?  or The start LCN(MFT zoon) is recorded in NTFS?(Just like the start LCN of the MFT is recorded  in the BPB)

Link to comment
Share on other sites

  • Moderators

not my area sorry.

hell, if it wasn't for post #7 I wouldn't have even known that way to get the MFT location, not something I have ever needed to know in all my 50+ years.

 

 

let Dr Google be your friend....  :)

Backup now & backup often.
It's your digital life - protect it with a backup.
Three things are certain; Birth, Death and loss of data. You control the last.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.