Defragmentation of the $MFT is normal but you want to keep the fragment
count low. 2 is pretty low.
Don't know what is the "nfi.exe". Don't expect others to know a
utility, even a well-known one, by its filename. Is it the one included
in the OEM Support Tools package from Microsoft at:
https://support.microsoft.com/en-us/kb/253066
If so, you might want a newer tool that explicitly states support for
Windows XP. Win2000 tools often work okay on WinXP but with something
doing major surgery on the OS then I want something that says it works
with that OS; else, I would have to test using it on a test platform,
not a critical one or my only one. There are plenty of 3rd-party tools
to defrag the $MFT on Windows boot, such as:
SysInternals' Contig
https://technet.microsoft.com/en-us/sysinternals/bb897428.aspx
Hopefully it supports the NTFS version 3.1 in Windows XP; see
https://en.wikipedia.org/wiki/NTFS#Versions. I've read where some users
have noted NTFS V5.1 in Windows Server 2003 (spring 2003), NTFS V5.2 in
Windows Vista (mid-2005), and NTFS V6.0 in Windows Server 2008 & Windows
7 but I don't know where that get their info (users rarely cite their
sources). "fsutil fsinfo ntfsinfo c:" on my Windows 7 Home x64 SP-1
reports 3.1 for the NTFS version.
Piriform Defraggler
I've seen users claim this does $MFT defrag; however, Piriform says
otherwise; see THEIR list of what they defrag at boot time at
https://www.piriform.com/docs/defraggler/technical-information/boot-time-defrag.
Doesn't look like a boot-time defrag is required as noted at
https://www.piriform.com/docs/defraggler/using-defraggler/understanding-the-drive-map
("Defraggler can defragment the MFT as well, but it cannot move the
MFT's starting position."). The starting position of the MFT is fixed.
The OS has to know where to start looking for it (well, its bootloader
in the boot sector for the partition has to know where is the MFT) but
its extents (fragments) can be elsewhere. The first 16 elements of the
MFT are fixed; see
http://ntfs.com/ntfs-mft.htm and
http://www.easeus.com/resource/ntfs-disk-structure.htm under "MFT and
its structure". You can see the Mft Start Lcn by using "fsutil fsinfo
ntfsinfo <drive>". I have never tried to alter the start sector for the
MFT (so that's something you can research if you're curious).
The first cluster of the $MFT is non-movable. Some system files cannot
be moved, like for journaling ($Usn.Jrnl), so they may force
fragmentation. I hit that with huge video files that I could not get
into 1 fragment because there wasn't enough contiguous space between
journal files to fit the entire huge video file. I saved a backup,
reformatted the partition, and restored (which laid down the files
sequentially as each was copied to the partition). Later found I could
have deleted the journals (fsutil usn deletejounal /d <drive>) and then
done the defrag. However, immediately after deleting the journals they
start to get recreated.
https://msdn.microsoft.com/en-us/library/aa363798(v=VS.85).aspx
"... the NTFS file system maintains an update sequence number (USN)
change journal. When any change is made to a file or directory in a
volume, the USN change journal for that volume is updated with a
description of the change and the name of the file or directory."
https://msdn.microsoft.com/en-us/library/aa363877(v=vs.85).aspx
"To delete a change journal, use the FSCTL_DELETE_USN_JOURNAL control
code. When you use this operation, it walks through all of the files on
the volume and resets the USN for each file to zero. The operation then
deletes the existing change journal. This operation persists across
system restarts until it completes. Any attempt to read, create, or
modify the change journal during this process fails with the error code
ERROR_JOURNAL_DELETE_IN_PROGRESS."
and
"Change journals are not necessarily created at startup. To create a
change journal, an administrator may do so explicitly or start another
service that requires a change journal."
So that last part might give you time to do a defrag before the change
journals show up. However, that means disabling services (e.g.,
indexing) that affect journaling before you delete the journals.
https://www.microsoft.com/msj/0999/journal/journal.aspx
"A Change Journal can be disabled on a given volume, preventing the
system from logging file and directory changes. By default, an NTFS
volume will have its Change Journal disabled. Some application must
explicitly activate the journal. Also note that any application can
activate or disable the volume's journal at any time. An application
must be able to gracefully handle the situation when a journal is
disabled while the first application is still using the journal."
When you delete the journals, you had better hope that the OS doesn't
crash. There would be any change logs (files and folders) in the
journals because there are none. Journaling works by recording the
changes before committing the changes. For example, when you delete a
file, the file is not deleted immediately. Instead a change log for
that change gets recorded in the journal (like "file X is to be
deleted"). Only after that is recorded is the file deleted from the
file system (it's removed from the MFT and its clusters become available
for reallocation). If the OS crashes when the file is only partially
deleted, the OS can use the change journal to replay the commit to
finish the task.
https://en.wikipedia.org/wiki/Journaling_file_system
Some folks think journaling is not needed for SSDs. They want to
eliminate all those little writes when files or folders are modified
(created, deleted, changed). That's not what journaling is for.
Regardless of using an SSD, the state of file system update can still be
corrupted by an OS crash (like simply pulling the power - you kicked out
the cord or there was a power outage). SSDs are faster so the window of
opportunity is smaller but it still exists. You never mentioned the
type of your mass storage media (HDD or SDD). Is the state of the OS
(yes, it does file changes for itself) and the safety of your data worth
less than the endurance of the SSD? This is like folks that massively
into overclocking resulting in a less stable platform. I'd rather have
stability (of OS and data) over durablity (of hardware). If you backup
then hardware is replaceable, and you should expect it to eventually
fail, anyway.
Some folks will say defrag of SSDs is pointless. That depends on the
SSD device and the OS. Windows XP does not support the TRIM feature so
you may want to occasionally defrag an SSD used under that OS. Some 3rd
party defraggers, like Defraggler, will use the TRIM feature instead of
doing the old style of defrag instead of moving lots of files around
which incurs a lot of writes that would be superfluous on SSDs; see
http://www.piriform.com/docs/defraggler/technical-information/defraggler-and-ssds.
Although Windows XP has no TRIM support, most SSDs have their own
internal TRIM-on-idle function; i.e., their firmware handles the idle
garbage collection. That is retroactive TRIM (which can be slow). For
proactive TRIM, you need to upgrade to Windows 7+.