The Master File Table (MFT)
MFT stands for Master File Table. The MFT is the heart of the NTFSfile system. It is essentially an index to all of the files on an NTFS volume, containing the file name, a listof the file attributes, and pointers to the fragments. (A contiguous file is considered to have just one fragmentand the record in the MFT contains only one pointer.) The MFT stores data in the format of a relational database;that is, each attribute has a specific position within the record. Thus, NTFS can create indexes from the MFT recordsto sort files by attributes, although at this time, only the file names are indexed.
The data for each file is contained in one record in the MFT, calledthe "file record". Each file record is one to four KB in size, depending on how the volume was formatted.However, a file can have a large number of attributes, too many to fit in a single record, in which case an additionalrecord is needed. In that case, the first file record is called the "base file record" and it containsthe location of the other file record(s) associated with the file.
A file can also become very badly fragmented, filling the file recordwith pointers to the fragments of the file, in which case an additional record will also be needed. If a file becomes really badly fragmented, it may require many additional records and could eventually cause you to run outof records in the MFT, at which point you would not be able to create new files.
NTFS stores directories in the MFT as it stores any other files. Infact, everything stored on an NTFS volume is a file; the system was designed that way, and it does make the designsimpler. So, the directories are files, whose records are simply the names of the files which all sharethe same directory path.
When an NTFS volume is formatted, a large amount of space (over 10%of the volume capacity) is reserved for the MFT. You can see this area in the Diskeeper Graphic Analysis, usuallysomething over a full line, right at the start of the volume. In versions prior to Diskeeper 2.0.112 and DiskeeperLite 1.1.137, this reserved MFT space appeared as free space, in gray. To avoid confusion, we now display the reservedMFT space as diagonal green lines. Since there is so much space allocated to the MFT, often most of it is neverused. However, due to restrictions within Windows NT, Diskeeper will not attempt to move files into this reservedspace.
This reserved space doesn't necessarily fill with MFT records. Forexample, if you have 10,000 file records (one each for 10,000 files), and each record is 4 KB in size, then youhave a 40 MB MFT. But if those 10,000 files are on a 1 GB volume, the space reserved for the MFT is roughly 120MB in size. The actual MFT space used is displayed by the Diskeeper Graphic Display as solid green areas.
Another variable that comes into play is the fact that small files(typically less than 4 KB in size) are stored in their entirety in the MFT. So, in cases where a volume containsa large number of small files, the MFT can become quite large, and in fact can expand beyond the area thatis reserved for it. This is fairly unusual, however.
As mentioned earlier, most of the MFT is located at the beginningof the volume, but one section is placed in the middle of the volume. This part of the MFT duplicates the first16 records of the MFT, containing critical data that, if it were lost, could mean everything on the volume wouldbe lost. Storing this data in two widely separated places makes it very unlikely that you will lose the data.
The first nine records in the MFT are the index entries for:
- the MFT itself
- the second part of the MFT (duplicating the first 16 records)
- the log file (records disk activity, helps in reconstructing thedisk if necessary)
- the volume file (contains the volume name, NTFS version the diskwas formatted under, and a flag that is set when disk repair is needed)
- the attribute definition table
- the root directory
- the bitmap file (one bit for each cluster, set to indicate the clusteris allocated to some file)
- the boot file
- the bad cluster file (bad clusters on the disk are allocated to thisfile, so they won't be used by any other file)
The other seven records are apparently reserved for future use. Youcan see that it would indeed be a disaster if this data were lost!
The MFT plays a critical role on an NTFS volume and is crucial forthe implementation of the very aspects of NTFS that make it the recoverable, secure, reliable, and efficient filesystem for client-server and other high-end systems.
Executive Software Europe
