Windows Server Troubleshooting - MFT Metadata

Click here to start saving with ING DIRECT!

Home | Up | Methodology | Architecture | Tools | Memory | Processor | Registry | Network | Active Directory | Contents

Get the Book

Major Topics
File System
Active Directory
Other Topics
Boot Records
Junction Point
Dynamic Disk
MFT Metadata
More Detail

eXpert Genealogy

Memory from

2003-2006 Team Approach Limited
All rights reserved

Master File Table and Metadata Files

When you format a volume using NTFS, Windows creates a master file table MFT and metadata files. The MFT is a relational database that consists of rows of file records and columns of file attributes. It contains at least one entry for every file on an NTFS volume, including the MFT itself.

Small files less than about 1.5 KB are stored completely inside the MFT resulting in the optimal one I/O operation to access the complete file with all attributes.

To determine the current size of the MFT on a Microsoft Windows 2000-based computer, use Disk Defragmenter to analyze the NTFS drive, and then click View Report This displays the drive statistics, including the current MFT size and number of fragments.

Master File Table (MFT) fragmentation
Total MFT size = 115 MB
MFT record count = 111,240
Percent MFT in use = 94 %
Total MFT fragments = 147

Disk Defragmenter displays system files in green. They consists of

  • PageFile.Sys
  • MTF
  • MFT zone, reserved space for MFT expansion

In Windows NT you can see the size of the MFT by using the command;  dir /a $mft

Because the MFT stores information about itself, NTFS reserves the first records of the MFT for metadata files. Metadata file names begin with a $ as shown in the following table. The remaining records of the MFT contain the file and folder records for each file and folder on the volume.

Metadata Files Stored in the Master File Table

System File Name Purpose of the File
Master file table $Mft Record for each file and folder on an NTFS volume.
Master file table mirror $MftMirr Guarantees access to the MFT in case of a single-sector failure. It is a duplicate image of the 1st 4 records of the MFT.
Log file $LogFile Contains a list of transaction steps used for NTFS recoverability.
Volume $Volume Contains information about the volume, such as the volume label and the volume version.
Attribute definitions $AttrDef Lists attribute names, numbers, and descriptions.
Root file name index . The root folder.
Cluster bitmap $Bitmap Represents the volume by showing free and unused clusters.
Boot sector $Boot Includes the BPB used to mount the volume and additional bootstrap loader code used if the volume is bootable.
Bad cluster file $BadClus Contains bad clusters for a volume.
Security file $Secure Contains unique security descriptors for all files within a volume.
Upcase table $Upcase Converts lowercase characters to matching Unicode uppercase characters.
NTFS extension file $Extend Used for various optional extensions such as quotas, reparse point data, and object identifiers.

MFT Zone - Windows XP

To prevent the MFT from becoming fragmented, NTFS reserves 12.5 percent of volume by default for exclusive use of the MFT. This space, known as the MFT zone, is not used to store data unless the remainder of the volume becomes full.

Depending on the average file size and other variables, as the disk fills to capacity, either the MFT zone or the unreserved space on the disk becomes full first.

  • Volumes that have a small number of large files exhaust the unreserved space first.
  • Volumes with a large number of small files exhaust the MFT zone space first.

In either case, fragmentation of the MFT occurs when one region or the other becomes full. You can change the size of the MFT zone for newly created volumes by using the fsutil behavior set mftzone command. This command uses four settings, 14, which correspond to a percentage of the disk to be used as the MFT zone. The MFT zone sizes follow:

  • Setting 1, the default, reserves approximately 12.5 percent of the disk.
  • Setting 2 reserves approximately 25 percent.
  • Setting 3 reserves approximately 37.5 percent.
  • Setting 4 reserves approximately 50 percent.

MFT Zone - Windows 2000

The default MFT Zone is calculated and reserved by Ntfs.sys when it mounts the volume, and is based on volume size. You can increase the MFT Zone by means of the registry entry documented below.

To add this value, perform the following steps:

  1. Run Registry Editor (Regedt32.exe), and go to the following subkey:
  2. Type the following information in the dialog box:
      Value Name: NtfsMftZoneReservation
    Data Type : REG_DWORD
    Data : (valid range is 1-4)

NOTE: This is a run-time parameter and does not affect the actual format of a volume. Rather, it affects the way NTFS allocates space on all volumes on a given system.