Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Rewrite Master File Table?
759 views
Skip to first unread message
Howard Schwartz
Oct 11, 2011, 10:41:26 PM10/11/11
to
This is a bit off topic, but relates most closely to Paragon's sometimes
free ``total Defrag''. That software has an option to `compact'' the master
file table (MFT) for NTFS drives. What this does, is rewrite the MFT
database so as to eliminate hundrads, perhaps thousands of obselete
entries.
I would love to do this, although it is usually considered unnecessary,
even dangerous. But I do not want to load some 300 megs for paragon's,
rather bad defrag program, just to get this function.
I have found no other freeware, or even moderate shareware that will
compact or truncate the MFT in this way. Some defrag programs (e.g., puran
defrag, ultra defrag) can defrag the MFT files, but they do not eliminate
obselete entries.
Any suggestions? Ive googed the subject, searched other newsgroups, etc.
free ``total Defrag''. That software has an option to `compact'' the master
file table (MFT) for NTFS drives. What this does, is rewrite the MFT
database so as to eliminate hundrads, perhaps thousands of obselete
entries.
I would love to do this, although it is usually considered unnecessary,
even dangerous. But I do not want to load some 300 megs for paragon's,
rather bad defrag program, just to get this function.
I have found no other freeware, or even moderate shareware that will
compact or truncate the MFT in this way. Some defrag programs (e.g., puran
defrag, ultra defrag) can defrag the MFT files, but they do not eliminate
obselete entries.
Any suggestions? Ive googed the subject, searched other newsgroups, etc.
Bjorn S.
Oct 16, 2011, 10:01:08 AM10/16/11
to
On Wed, 12 Oct 2011 02:41:26 +0000 (UTC), Howard Schwartz wrote in
Well if you googled the subject you have read all the warnings. I
googled the subject as well now and found the free Killdisk version
by http://www.killdisk.com/ mentioned in thread or two.
Claims to be able to;
"Wipe all unused space on existing drives, not touching
existing data"
and specifically:
"Wipes out deleted MFT and ROOT system records ".
I have NOT tried or tested this one, so I can not say if it works as
announced or not.
--
All the best,
Bjorn S. - I only post via <news.individual.net>
googled the subject as well now and found the free Killdisk version
by http://www.killdisk.com/ mentioned in thread or two.
Claims to be able to;
"Wipe all unused space on existing drives, not touching
existing data"
and specifically:
"Wipes out deleted MFT and ROOT system records ".
I have NOT tried or tested this one, so I can not say if it works as
announced or not.
--
All the best,
Bjorn S. - I only post via <news.individual.net>
Message has been deleted
Howard Schwartz
Oct 16, 2011, 2:30:51 PM10/16/11
to
Guy <Use-Reply-To-Address-Header@[127.1]> wrote in
news:9F8069F48DB47EAC2E...@127.0.0.1:
> Windows Sysinternals Contig and SDelete utilities.
>
I know Contig does not do this. It does a simple defrag of files, without
any optimizing of space or moving files to best areas. Do not know about
SDelete. Such things usually write over space that is marked by te MFT as
available, and then overwrite the entries in the MFT. This does NOT compact
and truncate the MFT.
Again I wonder about reading my question.
news:9F8069F48DB47EAC2E...@127.0.0.1:
> Windows Sysinternals Contig and SDelete utilities.
>
I know Contig does not do this. It does a simple defrag of files, without
any optimizing of space or moving files to best areas. Do not know about
SDelete. Such things usually write over space that is marked by te MFT as
available, and then overwrite the entries in the MFT. This does NOT compact
and truncate the MFT.
Again I wonder about reading my question.
Howard Schwartz
Oct 16, 2011, 2:35:13 PM10/16/11
to
Bjorn S. <bsus...@hotmail.com> wrote in news:9g06d6Fq55U1
@mid.individual.net:
> found the free Killdisk version
> by http://www.killdisk.com/ mentioned in thread or two.
>
> Claims to be able to;
> "Wipe all unused space on existing drives, not touching
> existing data"
> and specifically:
> "Wipes out deleted MFT and ROOT system records ".
>
Pretty sure this will not compact and therefore rewrite the MFt.
These utilities, as you know, try to overwrite spaace marked as `free'
ikn the MFT after we delete files and folders. Then they Overwrite the
corresponding entries in the MFT, so there is no trace of the original
file pointers. That is what they mean by `wipe', even for free space.
But they do not Delete these entries, which requires a rewrite of the
whole table, after which the database can be compacted.
@mid.individual.net:
> found the free Killdisk version
> by http://www.killdisk.com/ mentioned in thread or two.
>
> Claims to be able to;
> "Wipe all unused space on existing drives, not touching
> existing data"
> and specifically:
> "Wipes out deleted MFT and ROOT system records ".
>
These utilities, as you know, try to overwrite spaace marked as `free'
ikn the MFT after we delete files and folders. Then they Overwrite the
corresponding entries in the MFT, so there is no trace of the original
file pointers. That is what they mean by `wipe', even for free space.
But they do not Delete these entries, which requires a rewrite of the
whole table, after which the database can be compacted.
Bear Bottoms
Oct 16, 2011, 2:46:46 PM10/16/11
to
Howard Schwartz <howa...@gmail.com> wrote in
news:Xns9F807519...@178.63.61.145:
Good grief. Yesterday I explained to ACF the size of the MFT Zone is
determined by the Registry.
"Q: How does Paragon Total Defrag manage MFT Zone empty space?
A: Actually, the "MFTZone" is kind of a fictitious parameter. It is just
a block of free space on disk, that is reserved for the $MFT. In the
disk map it can be seen as a simple free space block.
The MFT Zone is created and managed by the file system driver, not by
any defragmenter. Only the file system driver is responsible for leaving
the MFT Zone free. There are no fixed borders for the MFT Zone on the
disk - the driver has a built-in set of rules, which he uses to manage
this space. The size of the MFT Zone is determined by a key value in the
Registry -
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
Key Name: NtfsMftZoneReservation
Key Type: REG_DWORD
This value's valid range is from 1 to 4 (i.e., 1 reserves 12.5 percent,
2 reserves 25 percent, 3 reserves 37.5 percent, and 4 reserves 50
percent of the NTFS volume for the MFT's buffer zone). The default value
of this Registry key is 1, although you can allocate as much as 50
percent of the volume's space to the MFT zone.
Even if the Key doesn't exist, it's value is assumed to be 1 - so there
will always be a 12,5 % free space zone on your volume (unless, all the
volume except the MFT Zone is full, and the file system driver will
start to write files into the MFT Zone beginning from it's end).
The MFT Zone is created as an effort to keep the Master File Table
unfragmented - since in certain conditions (i.e. lots of temporary files
are created and deleted) it grows rapidly.
As the $MFT grows, it will occupy the increasing amount of space in the
MFT Zone, and the current size of $MFT is totally unrelated to the size
of the MFT Zone. When one executes the "Compact MFT" (also may be called
“Shrink MFT” in some editions) operation, the $MFT itself will be
shrinked, but the MFT Zone will remain intact - just a block of reserved
free space.
Total Defrag obeys the file system's drivers' rules for managing the MFT
Zone.
Unfortunately there is no way to disable the MFT Zone creation while
using Microsoft's driver for NTFS. Presumably some third-party
filesystem drivers would allow to do that. Paragon’s UFSD (Universal
File System Driver) implementation for NTFS also handles the MFT Zone as
the Microsoft driver does."
--
Bear
http://bearware.info
news:Xns9F807519...@178.63.61.145:
determined by the Registry.
"Q: How does Paragon Total Defrag manage MFT Zone empty space?
A: Actually, the "MFTZone" is kind of a fictitious parameter. It is just
a block of free space on disk, that is reserved for the $MFT. In the
disk map it can be seen as a simple free space block.
The MFT Zone is created and managed by the file system driver, not by
any defragmenter. Only the file system driver is responsible for leaving
the MFT Zone free. There are no fixed borders for the MFT Zone on the
disk - the driver has a built-in set of rules, which he uses to manage
this space. The size of the MFT Zone is determined by a key value in the
Registry -
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
Key Name: NtfsMftZoneReservation
Key Type: REG_DWORD
This value's valid range is from 1 to 4 (i.e., 1 reserves 12.5 percent,
2 reserves 25 percent, 3 reserves 37.5 percent, and 4 reserves 50
percent of the NTFS volume for the MFT's buffer zone). The default value
of this Registry key is 1, although you can allocate as much as 50
percent of the volume's space to the MFT zone.
Even if the Key doesn't exist, it's value is assumed to be 1 - so there
will always be a 12,5 % free space zone on your volume (unless, all the
volume except the MFT Zone is full, and the file system driver will
start to write files into the MFT Zone beginning from it's end).
The MFT Zone is created as an effort to keep the Master File Table
unfragmented - since in certain conditions (i.e. lots of temporary files
are created and deleted) it grows rapidly.
As the $MFT grows, it will occupy the increasing amount of space in the
MFT Zone, and the current size of $MFT is totally unrelated to the size
of the MFT Zone. When one executes the "Compact MFT" (also may be called
“Shrink MFT” in some editions) operation, the $MFT itself will be
shrinked, but the MFT Zone will remain intact - just a block of reserved
free space.
Total Defrag obeys the file system's drivers' rules for managing the MFT
Zone.
Unfortunately there is no way to disable the MFT Zone creation while
using Microsoft's driver for NTFS. Presumably some third-party
filesystem drivers would allow to do that. Paragon’s UFSD (Universal
File System Driver) implementation for NTFS also handles the MFT Zone as
the Microsoft driver does."
--
Bear
http://bearware.info
Bear Bottoms
Oct 16, 2011, 3:01:57 PM10/16/11
to
Poóh the Cat
Oct 16, 2011, 3:21:50 PM10/16/11
to
Howard is a bit tetchy, and I'm scared to drift, but Winhex will wipe
unused space in the MFT, and if that is correct, and I guess it is,
same difference, sans defrag like.
http://www.winhex.com/winhex/index-m.html
Not freeware, but says eval will do this. Dunno if it will.
--
Behind every great man there's a cat
Message has been deleted
Bear Bottoms
Oct 16, 2011, 4:08:17 PM10/16/11
to
On 10/16/2011 2:21 PM, Poóh the Cat wrote:
>> Unfortunately there is no way to disable the MFT Zone creation while
>> >using Microsoft's driver for NTFS. Presumably some third-party
>> >filesystem drivers would allow to do that. Paragon’s UFSD (Universal
>> >File System Driver) implementation for NTFS also handles the MFT Zone as
>> >the Microsoft driver does."
> You gotta linky to that info?
http://kb.paragon-software.com/paragon/include/templ/object2.jsp?catId=2124&objId=6218&statId=1813399&foLang=en
>> Unfortunately there is no way to disable the MFT Zone creation while
>> >using Microsoft's driver for NTFS. Presumably some third-party
>> >filesystem drivers would allow to do that. Paragon’s UFSD (Universal
>> >File System Driver) implementation for NTFS also handles the MFT Zone as
>> >the Microsoft driver does."
> You gotta linky to that info?
http://preview.tinyurl.com/4yre7s6
--
Bear
http://bearware.info
Poóh the Cat
Oct 16, 2011, 4:12:43 PM10/16/11
to
Poóh the Cat
Oct 16, 2011, 5:04:31 PM10/16/11
to
dir /a $mft doesn't work
After a rake around I tried
defrag c: /a /v
and got
Master File Table (MFT):
MFT size = 239.00 MB
MFT record count = 244735
MFT usage = 100%
Total MFT fragments = 2
The 100% usage seemed a bit weird, but I googled and someone has
reported it as a bug
Moving on I found Sysinternals NTFSInfo gives this output
MFT Information
---------------
MFT size : 239 MB (0% of drive)
MFT start cluster : 786432
MFT zone clusters : 29275296 - 29326528
MFT zone size : 200 MB (0% of drive)
MFT mirror start : 2
Which again looks like the MFT zone is way smaller than 12.5% of the
drive, and smaller than the MFT<mind boggles>
Older, but none the wiser.
Bear Bottoms
Oct 16, 2011, 5:40:11 PM10/16/11
to
On 10/16/2011 3:12 PM, Po�h the Cat wrote:
> On Sun, 16 Oct 2011 15:08:17 -0500, Bear Bottoms
> <bearbo...@gmai.com> wrote:
>
> On Sun, 16 Oct 2011 15:08:17 -0500, Bear Bottoms
> <bearbo...@gmai.com> wrote:
>
>> On 10/16/2011 2:21 PM, Po�h the Cat wrote:
>>>> Unfortunately there is no way to disable the MFT Zone creation while
>>>>> using Microsoft's driver for NTFS. Presumably some third-party
>>>>> filesystem drivers would allow to do that. Paragon�s UFSD (Universal
>>>> Unfortunately there is no way to disable the MFT Zone creation while
>>>>> using Microsoft's driver for NTFS. Presumably some third-party
>>>>> File System Driver) implementation for NTFS also handles the MFT Zone as
>>>>> the Microsoft driver does."
>>> You gotta linky to that info?
>>
>> http://kb.paragon-software.com/paragon/include/templ/object2.jsp?catId=2124&objId=6218&statId=1813399&foLang=en
>>
>> http://preview.tinyurl.com/4yre7s6
>
> Thanks. I feel like I'm the filling in a Bear sandwich.
>
OMG...you too!
>>>>> the Microsoft driver does."
>>> You gotta linky to that info?
>>
>> http://kb.paragon-software.com/paragon/include/templ/object2.jsp?catId=2124&objId=6218&statId=1813399&foLang=en
>>
>> http://preview.tinyurl.com/4yre7s6
>
> Thanks. I feel like I'm the filling in a Bear sandwich.
>
If you are that interested, Google it next time.
--
Bear
http://bearware.info
Poóh the Cat
Oct 16, 2011, 5:44:33 PM10/16/11
to
On Sun, 16 Oct 2011 16:40:11 -0500, Bear Bottoms
<bearbo...@gmai.com> wrote:
>On 10/16/2011 3:12 PM, Poóh the Cat wrote:
>> On Sun, 16 Oct 2011 15:08:17 -0500, Bear Bottoms
>> <bearbo...@gmai.com> wrote:
>>
<bearbo...@gmai.com> wrote:
>On 10/16/2011 3:12 PM, Poóh the Cat wrote:
>> On Sun, 16 Oct 2011 15:08:17 -0500, Bear Bottoms
>> <bearbo...@gmai.com> wrote:
>>
>>> On 10/16/2011 2:21 PM, Poóh the Cat wrote:
>>>>> Unfortunately there is no way to disable the MFT Zone creation while
>>>>>> using Microsoft's driver for NTFS. Presumably some third-party
>>>>>> filesystem drivers would allow to do that. Paragon’s UFSD (Universal
>>>>> Unfortunately there is no way to disable the MFT Zone creation while
>>>>>> using Microsoft's driver for NTFS. Presumably some third-party
>>>>>> File System Driver) implementation for NTFS also handles the MFT Zone as
>>>>>> the Microsoft driver does."
>>>> You gotta linky to that info?
>>>
>>> http://kb.paragon-software.com/paragon/include/templ/object2.jsp?catId=2124&objId=6218&statId=1813399&foLang=en
>>>
>>> http://preview.tinyurl.com/4yre7s6
>>
>> Thanks. I feel like I'm the filling in a Bear sandwich.
>>
>OMG...you too!
>
>If you are that interested, Google it next time.
Your alter ego is a tricky dicky. I was watching my back.
>>>>>> the Microsoft driver does."
>>>> You gotta linky to that info?
>>>
>>> http://kb.paragon-software.com/paragon/include/templ/object2.jsp?catId=2124&objId=6218&statId=1813399&foLang=en
>>>
>>> http://preview.tinyurl.com/4yre7s6
>>
>> Thanks. I feel like I'm the filling in a Bear sandwich.
>>
>OMG...you too!
>
>If you are that interested, Google it next time.
Bear Bottoms
Oct 16, 2011, 6:41:30 PM10/16/11
to
Poóh the Cat <supérsécr...@IPaddress.invalid> wrote in
news:tujm97pk8oq5a4898...@4ax.com:
I watch both sides because imma Bi-Polar bear :)
--
Bear
http://bearware.info
news:tujm97pk8oq5a4898...@4ax.com:
--
Bear
http://bearware.info
hummingbird
Oct 17, 2011, 6:12:26 AM10/17/11
to
On Sun, 16 Oct 2011 22:41:30 +0000 (UTC), Bear Bottoms wrote :
> Poóh the Cat <supérsécr...@IPaddress.invalid> wrote in
> news:tujm97pk8oq5a4898...@4ax.com:
>
> > On Sun, 16 Oct 2011 16:40:11 -0500, Bear Bottoms
> > <bearbo...@gmai.com> wrote:
> >
> >>On 10/16/2011 3:12 PM, Poóh the Cat wrote:
> >>> On Sun, 16 Oct 2011 15:08:17 -0500, Bear Bottoms
> >>> <bearbo...@gmai.com> wrote:
> >>>
> >>>> On 10/16/2011 2:21 PM, Poóh the Cat wrote:
> >>>>>> Unfortunately there is no way to disable the MFT Zone creation
> >>>>>> while
> >>>>>>> using Microsoft's driver for NTFS. Presumably some third-party
> >>>>>>> filesystem drivers would allow to do that. Paragon?s UFSD
> Poóh the Cat <supérsécr...@IPaddress.invalid> wrote in
> news:tujm97pk8oq5a4898...@4ax.com:
>
> > On Sun, 16 Oct 2011 16:40:11 -0500, Bear Bottoms
> > <bearbo...@gmai.com> wrote:
> >
> >>On 10/16/2011 3:12 PM, Poóh the Cat wrote:
> >>> On Sun, 16 Oct 2011 15:08:17 -0500, Bear Bottoms
> >>> <bearbo...@gmai.com> wrote:
> >>>
> >>>> On 10/16/2011 2:21 PM, Poóh the Cat wrote:
> >>>>>> Unfortunately there is no way to disable the MFT Zone creation
> >>>>>> while
> >>>>>>> using Microsoft's driver for NTFS. Presumably some third-party
> >>>>>>> (Universal File System Driver) implementation for NTFS also
> >>>>>>> handles the MFT Zone as the Microsoft driver does."
> >>>>> You gotta linky to that info?
> >>>>
> >>>> http://kb.paragon-software.com/paragon/include/templ/object2.jsp?catId
> >>>> =2124&objId=6218&statId=1813399&foLang=en
> >>>>
> >>>> http://preview.tinyurl.com/4yre7s6
> >>>
> >>> Thanks. I feel like I'm the filling in a Bear sandwich.
> >>>
> >>OMG...you too!
> >>
> >>If you are that interested, Google it next time.
> >
> > Your alter ego is a tricky dicky. I was watching my back.
>
> I watch both sides because imma Bi-Polar bear :)
I swing both ways too. I always knew we had something special in common.
> >>>>>>> handles the MFT Zone as the Microsoft driver does."
> >>>>> You gotta linky to that info?
> >>>>
> >>>> http://kb.paragon-software.com/paragon/include/templ/object2.jsp?catId
> >>>> =2124&objId=6218&statId=1813399&foLang=en
> >>>>
> >>>> http://preview.tinyurl.com/4yre7s6
> >>>
> >>> Thanks. I feel like I'm the filling in a Bear sandwich.
> >>>
> >>OMG...you too!
> >>
> >>If you are that interested, Google it next time.
> >
> > Your alter ego is a tricky dicky. I was watching my back.
>
> I watch both sides because imma Bi-Polar bear :)
hb
(the REAL hummingbird)
--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer)
I use many posting servers to keep ahead of being detected.
I might use Astra. Sometimes I use ES. I use Giganews and
I like Individual. I rarely use Plusnet.
Yuhler G
Oct 17, 2011, 1:31:36 PM10/17/11
to
On article <9F8093929E35DEAC2E...@127.0.0.1>, Guy wrote:
>
> Howard Schwartz wrote:
>
> > Guy wrote:
> >
> >> Windows Sysinternals Contig and SDelete utilities.
> >>
> >
> > I know Contig does not do this. It does a simple defrag of files,
> > without any optimizing of space or moving files to best areas. Do
> > not know about SDelete. Such things usually write over space that
> > is marked by te MFT as available, and then overwrite the entries
> > in the MFT. This does NOT compact and truncate the MFT.
> >
>
>
> To shrink the area reserved for Mft,
> > Guy wrote:
> >
> >> Windows Sysinternals Contig and SDelete utilities.
> >>
> >
> > I know Contig does not do this. It does a simple defrag of files,
> > without any optimizing of space or moving files to best areas. Do
> > not know about SDelete. Such things usually write over space that
> > is marked by te MFT as available, and then overwrite the entries
> > in the MFT. This does NOT compact and truncate the MFT.
> >
>
>
> you need to reformat the volume.
>
Probably changing cluster size.
>
> > Again I wonder about reading my question.
> >
>
>
> I read your post just fine...
> > Again I wonder about reading my question.
> >
>
>
>
> "...eliminate hundrads [sic], perhaps thousands of
> obselete [sic] entries (...) eliminate obselete [sic] entries."
--
Best,
Yuhler G.
Reply-To: partially ROT13, invalid=com
Due to spam I'm filtering-out GoogleGroups. Sorry. :(
Howard Schwartz
Oct 18, 2011, 4:46:37 PM10/18/11
to
Yuhler G <rstrezn...@znvyahyy.invalid> wrote in
news:MPG.29065ab3a...@news.eternal-september.org:
>> To shrink the area reserved for Mft,
>> you need to reformat the volume.
>>
> Probably changing cluster size.
Of course, I said nothing about shrinking ``the area'' reserved for the
MFt. I asked about shrinking the MFT itself.
>> > Again I wonder about reading my question
compact or shrink the MFT. It it just stuffed with nonsense overwrites,
for security, so spyware and such can not read the names and pointers to
the locations of deleted files.
news:MPG.29065ab3a...@news.eternal-september.org:
>> To shrink the area reserved for Mft,
>> you need to reformat the volume.
>>
> Probably changing cluster size.
MFt. I asked about shrinking the MFT itself.
>> > Again I wonder about reading my question
>> I read your post just fine...
>> "...eliminate hundrads [sic], perhaps thousands of
>> obselete [sic] entries (...) eliminate obselete [sic] entries."
Nope - `eliminating'' just means overwriting the entries. This does not
>> "...eliminate hundrads [sic], perhaps thousands of
>> obselete [sic] entries (...) eliminate obselete [sic] entries."
compact or shrink the MFT. It it just stuffed with nonsense overwrites,
for security, so spyware and such can not read the names and pointers to
the locations of deleted files.
Yuhler G
Oct 19, 2011, 2:29:22 PM10/19/11
to
On article <Xns9F828C33...@178.63.61.145>, Howard Schwartz wrote:
>
> Yuhler G <rstrezn...@znvyahyy.invalid> wrote in
> news:MPG.29065ab3a...@news.eternal-september.org:
>
> >> To shrink the area reserved for Mft,
> >> you need to reformat the volume.
> >>
> > Probably changing cluster size.
>
> Of course, I said nothing about shrinking ``the area'' reserved for the
> MFt. I asked about shrinking the MFT itself.
>
it to wipe MFT free space (checkbox at Options » Settings, at bottommost), and
use any of its secure file deletion options.
> >> > Again I wonder about reading my question
> >> I read your post just fine...
> >> "...eliminate hundrads [sic], perhaps thousands of
> >> obselete [sic] entries (...) eliminate obselete [sic] entries."
>
> Nope - `eliminating'' just means overwriting the entries. This does not
> compact or shrink the MFT. It it just stuffed with nonsense overwrites,
> for security, so spyware and such can not read the names and pointers to
> the locations of deleted files.
nicely. <http://www.iobit.com/iobitsmartdefrag.html>
0 new messages