MFT Zone using NTFS in 2k over 650MB!
I have 2 boxes both with 2 bootable HDD's all running 2k that I just converted over from FAT32 to NTFS. After doing so I did a disc to disc copy using Drive Image from a bootable floppy (actually a partition to partition copy) and found the MFT Zone grew from less than 70 MB to over 600MB! To be acurate, 650MB and ...
I have 2 boxes both with 2 bootable HDD's all running 2k that I just converted over from FAT32 to NTFS.
After doing so I did a disc to disc copy using Drive Image from a bootable floppy (actually a partition to partition copy) and found the MFT Zone grew from less than 70 MB to over 600MB! To be acurate, 650MB and 1GB! I don't know if it is a DI issue or not. Powerquest has nothing I could find on this.
Any one else have this experiance or has copied a converted drive over to another?
There are no errors reported by chkdsk or chkntfs and all seems to work. BTW, the defrag program I use is from vCom (formerly Ontrack) called System Suite V4 Jet Defrag. It has the ability I just found out to display the MFT and the MFT Zone prior to doing a defrag that Norton doesn't/can't! It shows a one huge block after the first block of data (.exe's)
I looked at the M$'s KB and it doesn't tell you a whole lot and doesn't answer the question. I'm new to NTFS and didn't heard of this even existing untill now. I do have the latest updates to the program, though this new outfit hasn't done a thing to it since it was spun off 9 months ago.
After doing so I did a disc to disc copy using Drive Image from a bootable floppy (actually a partition to partition copy) and found the MFT Zone grew from less than 70 MB to over 600MB! To be acurate, 650MB and 1GB! I don't know if it is a DI issue or not. Powerquest has nothing I could find on this.
Any one else have this experiance or has copied a converted drive over to another?
There are no errors reported by chkdsk or chkntfs and all seems to work. BTW, the defrag program I use is from vCom (formerly Ontrack) called System Suite V4 Jet Defrag. It has the ability I just found out to display the MFT and the MFT Zone prior to doing a defrag that Norton doesn't/can't! It shows a one huge block after the first block of data (.exe's)
I looked at the M$'s KB and it doesn't tell you a whole lot and doesn't answer the question. I'm new to NTFS and didn't heard of this even existing untill now. I do have the latest updates to the program, though this new outfit hasn't done a thing to it since it was spun off 9 months ago.
Participate on our website and join the conversation
This topic is archived. New comments cannot be posted and votes cannot be cast.
Responses to this topic
None of that answers the question why it grew from less than 65MB to over 650MB when I copied the drive with a similar partition size!
I went back to JetDefrag today and that 1 GB disappeared and turned into a 50 or 60 MB MFT Zone!
WTF.......are there flying saucers hovering above my house spewing out gamma rays all over my puter? Or did the Computer Fairy stop by overnight and waved her magic wand.
WTF.......are there flying saucers hovering above my house spewing out gamma rays all over my puter? Or did the Computer Fairy stop by overnight and waved her magic wand.
Default cluster size and no compression.
Is the MFT Zone for the partition or the whole drive?
Each partiitioon has its own MFT. That is why m$ recomends whole partition disks if possible, as the entire mft is in one location for the whole disk.
\
As for the MFT shrinking, No it cannot, you are right. I could write a batch virus to fill the c volume with 0 byte files would require 1 line, probably couple lines in a programing language, and at least in the case of a batch file would not trigger any antivirus. it could be called Britney_nude.cmd.jpg or somethign.
Microsoft solution to this problem if it hapens to you is "Delete the partiiton and resotre from a good backup."
Any user with write access to a partition can do it, even over network share, and disk quota won't stop it because the filesize properties is technically Zero.
\
As for the MFT shrinking, No it cannot, you are right. I could write a batch virus to fill the c volume with 0 byte files would require 1 line, probably couple lines in a programing language, and at least in the case of a batch file would not trigger any antivirus. it could be called Britney_nude.cmd.jpg or somethign.
Microsoft solution to this problem if it hapens to you is "Delete the partiiton and resotre from a good backup."
Any user with write access to a partition can do it, even over network share, and disk quota won't stop it because the filesize properties is technically Zero.
I would like to toss in my own $0.02 on this thread
If you ever see the error "insufficent memory" in the middle of a CHKDSK then get out your restore tapes ... NTFS maintains several files, hidden from user access, which contain metadata about the file system -- $MFT and $BitMap are two of the most common, with $MFT being the Master File Table (as APK has so gone over) and $BitMap being the volume bitmap (a representation of which clusters on the disk are being used). CHKDSK has to have write access to the file system it's trying to repair (which is why the system volume has to be checked after a reboot to give CHKDSK access to system files which are normally locked). And one of the conditions of having write access is being able to read and write NTFS metadata properly. So if one or both of these files are damaged to the point where it is not possible to write new clusters to the disk safely, CHKDSK /F will not work and will abort with this misleading-sounding error.
EDIT
Duhmez is correct, the MFT is spread across logical volumes
If you ever see the error "insufficent memory" in the middle of a CHKDSK then get out your restore tapes ... NTFS maintains several files, hidden from user access, which contain metadata about the file system -- $MFT and $BitMap are two of the most common, with $MFT being the Master File Table (as APK has so gone over) and $BitMap being the volume bitmap (a representation of which clusters on the disk are being used). CHKDSK has to have write access to the file system it's trying to repair (which is why the system volume has to be checked after a reboot to give CHKDSK access to system files which are normally locked). And one of the conditions of having write access is being able to read and write NTFS metadata properly. So if one or both of these files are damaged to the point where it is not possible to write new clusters to the disk safely, CHKDSK /F will not work and will abort with this misleading-sounding error.
EDIT
Duhmez is correct, the MFT is spread across logical volumes
Funny you mention that;
I tried to run NTFSDOS Pro from SystemInternals and I got (I beleive) that same message before it even loaded. OK with chkdsk though.[/img]
I tried to run NTFSDOS Pro from SystemInternals and I got (I beleive) that same message before it even loaded. OK with chkdsk though.[/img]
