Scribd
Upload
31 views2 pages

Understanding the Master File Table (MFT)

Uploaded by

ebilan
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
31 views2 pages

Understanding the Master File Table (MFT)

Uploaded by

ebilan
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Master File Table (MFT)

Probably the most important of the key system (metadata) files that define an
NTFS volume, the Master File Table or MFT is the place where information about
every file and directory on an NTFS volume is stored. The MFT is in essence a
relational database table, containing various attributes about different files. It acts
as the "starting point" and central management feature of an NTFS volume--sort of
a "table of contents" for the volume, if you will. It is somewhat analog to the file
allocation table in a FAT partition, but is much more than just a list of used and
available clusters.

When any file or directory is created on the NTFS volume, a record is created for it
within the MFT. The size of each record in the MFT seems to be a matter of some
controversy; the best that I can tell is that each record is equal to the cluster size of
the volume, but with a minimum of 1,024 bytes and a maximum of 4,096.
(Meaning that even if 512 byte clusters are used, each MFT record is still 1,024
bytes, and even if clusters greater than 4,096 bytes are used, each MFT record is
limited to 4,096 bytes.) However, some sources say that the size of each MFT
record is fixed at either 1,024 or 2,048 bytes.

The system uses these MFT records to store information about the file or directory;
this information takes the form of attributes. Since the size of each MFT record is
limited, there are different ways that NTFS can store a file's attributes: as
either resident attributes that are stored within the MFT record, or non-
resident attributes, stored either in additional MFT records or in extents that lie
outside the MFT. See the discussion of file attributes for more details.

Remember that under NTFS, there is no special distinction between the data in a
file and the attributes that describe the file--the data itself is just the contents of the
"data attribute". This has an interesting implication for small files. If the amount of
space required for all of the attributes of a file, including the data it contains, is
smaller than the size of the MFT record, the data attribute will be stored resident--
within the MFT record itself. Thus, such files require no additional storage space
on the volume, and also do not require separate accesses to the disk to check the
MFT and then read the file, which improves performance.

Larger files get more complicated. As additional attributes are added to a file--
either standard attributes defined by the system or new ones created by the user--
and as the existing attributes are expanded in size, they may no longer fit into the
MFT record for the file. If this occurs, the attributes will be moved out of the MFT
and be made non-resident by the file system. Large files will have their data stored
as external attributes, and very large files may even get so large that the attributes
containing pointers to the file data become external attributes themselves! I discuss
this nested structuring of files on the page describing NTFS files and data storage.
As more files and directories are added to the file system, it becomes necessary for
NTFS to add more records to the MFT. Since keeping the MFT contiguous on the
disk improves performance, when an NTFS volume is first set up, the operating
system reserves about 12.5% of the disk space immediately following the MFT;
this is sometimes called the "MFT Zone". This is a substantial chunk of real estate
to reserve, but bear in mind that it is still usable. Regular files and directories will
not use this space until and unless the rest of the disk volume space is consumed,
but if that occurs, the "MFT Zone" will be used. Eventually, if there are enough
entries placed in the MFT, as it expands it will use up the "MFT Zone". When this
happens, the operating system will automatically allocate more space elsewhere on
the disk for the MFT. This allows the MFT to grow to a size limited only by the
size of the volume, but this fragmentation of the MFT may reduce performance by
increasing the number of reads required for some files, and the MFT cannot
generally be defragmented.

Note: The first sixteen records in the MFT are always reserved for the
volume's metadata files.

Common questions

Powered by AI

Storing file data as non-resident attributes in NTFS enables the accommodation of larger files and additional attributes. While this is beneficial for expanding storage capabilities, it also increases complexity by requiring additional MFT records or external extents to manage file data. This approach can impact performance due to increased disk access operations and potential fragmentation .

When file attributes exceed the size of an MFT record, NTFS moves these attributes out of the MFT, making them non-resident. This involves storing the attributes in additional MFT records or external extents, which optimizes space but may complicate file management for large files .

NTFS initially manages the risk of MFT fragmentation by reserving the 'MFT Zone' to ensure contiguous space for MFT expansion, enhancing performance through reduced disk seeks. However, once this zone is fully utilized, MFT fragmentation occurs as space is allocated elsewhere on the disk, leading to increased read operations and diminished performance .

The Master File Table (MFT) serves as a relational database table containing information about every file and directory on an NTFS volume. It acts as the 'table of contents' for the volume, maintaining file attributes and metadata, similar to the file allocation table in a FAT partition but much more comprehensive .

The size of individual MFT records is influenced by the cluster size of the volume, with a minimum record size of 1,024 bytes and a maximum of 4,096 bytes. Even with smaller clusters, records are at least 1,024 bytes; with larger clusters, they max out at 4,096 bytes .

NTFS optimizes future MFT expansion by reserving about 12.5% of the volume space as the 'MFT Zone'. This foresight ensures enough contiguous space is available to add more records while maintaining performance. This reserved area is initially not used by regular files, allowing space to be dedicated specifically to MFT expansion as needed .

In NTFS, resident file attributes are stored within the MFT record itself, optimized for smaller files where all details fit in the record. Non-resident attributes, however, are those that are too large to fit within a single MFT record and are stored outside the MFT, in additional records or external extents .

Small files in the NTFS file system often have all their attributes, including the data, stored resident within the MFT record, requiring no additional storage space and avoiding extra disk accesses. Larger files have more complex storage needs; their attributes and data are typically stored as non-resident, in external attributes, to accommodate the larger size .

When the MFT entries exceed the reserved MFT Zone, the operating system allocates more space elsewhere on the disk for MFT expansion, leading to MFT fragmentation. This fragmentation increases the number of reads required, potentially reducing performance, as the MFT cannot be easily defragmented .

The 'MFT Zone' is a reserved area on the disk, approximately 12.5% of the volume space immediately following the MFT, ensuring room for future MFT expansion while keeping it contiguous for performance benefits. This zone is used when the rest of the disk fills up, although using it can fragment the MFT, reducing performance because it increases the number of disk reads .

You might also like