MFT

[Bill Cunningham[_2_]]

I am wondering that when files are deleted does XP x86 or x64 "compres"
the MFT? Say many files are deleted enough that some size can be saved with
the MFT. Are the file entries simply removed and the space wasted? If so are
there any MFT compression utilites out there? I have never seen any.

Bill

[Paul[_32_]]

Bill Cunningham wrote:
> I am wondering that when files are deleted does XP x86 or x64 "compres"
> the MFT? Say many files are deleted enough that some size can be saved with
> the MFT. Are the file entries simply removed and the space wasted? If so are
> there any MFT compression utilites out there? I have never seen any.
>
> Bill

If you use nfi.exe, you can see what happens
to them.

The empty filenum are re-used so the slots
get filled in again. This is why you can spot
newly created files on the partition sitting
in relatively low filenum slots.

I've not seen any software do an impressive
job of tidying up the MFT. You can use Sysinternals
Sdelete, if you actually want to clean them.

I tested it a few days ago on a big disk, and it
took a bit more than nine hours to complete. So that's
the sort of thing you start before bed, and just
leave it running overnight. The pass count may say
it is doing one pass, but the timing info says
it did two passes in my case. (I was using the -z
option to zero out the disk white space. So it's
easier to compress.)

A more intelligent approach, is to use Heidi Eraser,
if you want any private info to be cleaned up immediately.
But if you need a bulk cleaning, give Sdelete a try.

And as you write more and more data to a partition,
the MFT Reserved area starts to shrink. And eventually,
every bit of the available space gets used. Yes, there
will be some empty MFT slots left... If a file is
small enough, it can actually be written into one
of those slots. So if you absolutely want to fill
an NTFS partition "to the max", then beat the crap
out of it with 899 byte files :-)

https://en.wikipedia.org/wiki/Ntfs

"Files less than 900 bytes or so are stored
within the directory entry at the MFT."

HTH,
Paul

[Bill Cunningham[_2_]]

"Paul" > wrote in message
...
> Bill Cunningham wrote:
>> I am wondering that when files are deleted does XP x86 or x64
>> "compres" the MFT? Say many files are deleted enough that some size can
>> be saved with the MFT. Are the file entries simply removed and the space
>> wasted? If so are there any MFT compression utilites out there? I have
>> never seen any.
>>
>> Bill
>
> If you use nfi.exe, you can see what happens
> to them.
>
> The empty filenum are re-used so the slots
> get filled in again. This is why you can spot
> newly created files on the partition sitting
> in relatively low filenum slots.
>
> I've not seen any software do an impressive
> job of tidying up the MFT. You can use Sysinternals
> Sdelete, if you actually want to clean them.
>
> I tested it a few days ago on a big disk, and it
> took a bit more than nine hours to complete. So that's
> the sort of thing you start before bed, and just
> leave it running overnight. The pass count may say
> it is doing one pass, but the timing info says
> it did two passes in my case. (I was using the -z
> option to zero out the disk white space. So it's
> easier to compress.)
>
> A more intelligent approach, is to use Heidi Eraser,
> if you want any private info to be cleaned up immediately.
> But if you need a bulk cleaning, give Sdelete a try.
>
> And as you write more and more data to a partition,
> the MFT Reserved area starts to shrink. And eventually,
> every bit of the available space gets used. Yes, there
> will be some empty MFT slots left... If a file is
> small enough, it can actually be written into one
> of those slots. So if you absolutely want to fill
> an NTFS partition "to the max", then beat the crap
> out of it with 899 byte files :-)
>
> https://en.wikipedia.org/wiki/Ntfs
>
> "Files less than 900 bytes or so are stored
> within the directory entry at the MFT."
>
> HTH,
> Paul

I didn't know you could clean the MFT with sdelete. Hum I'll look closely.

Bill

[Kerr Mudd-John]

On Fri, 28 Oct 2016 23:10:13 +0100, Paul > wrote:

> Bill Cunningham wrote:
>> I am wondering that when files are deleted does XP x86 or x64
>> "compres" the MFT? Say many files are deleted enough that some size can
>> be saved with the MFT. Are the file entries simply removed and the
>> space wasted? If so are there any MFT compression utilites out there? I
>> have never seen any.
>> Bill
>
> If you use nfi.exe, you can see what happens
> to them.

https://support.microsoft.com/en-us/kb/253066

oem3sr2.zip seems to be missing - well a 1.3kb file is there, but it ain't
the tool.

--
Bah, and indeed, Humbug

[Paul[_32_]]

Kerr Mudd-John wrote:
> On Fri, 28 Oct 2016 23:10:13 +0100, Paul > wrote:
>
>> Bill Cunningham wrote:
>>> I am wondering that when files are deleted does XP x86 or x64
>>> "compres" the MFT? Say many files are deleted enough that some size
>>> can be saved with the MFT. Are the file entries simply removed and
>>> the space wasted? If so are there any MFT compression utilites out
>>> there? I have never seen any.
>>> Bill
>>
>> If you use nfi.exe, you can see what happens
>> to them.
>
> https://support.microsoft.com/en-us/kb/253066
>
> oem3sr2.zip seems to be missing - well a 1.3kb file is there, but it
> ain't the tool.
>

3.6MB

https://web.archive.org/web/20150329185738/http://download.microsoft.com/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip

( https://web.archive.org/web/20150329185738/http://support.microsoft.com/en-us/kb/253066 )

Paul

[Bill Cunningham[_2_]]

"Paul" > wrote in message
...
> Bill Cunningham wrote:
[...]

Ok I used nfi.exe and got the logical sector numbers of a file. sdelete.exe
actually. Then I ran nfi on that sector number and got a file number. How to
view that IDK. IDK if nfi can show that or not. Are you talking about
sdelete's zero out free space option? For cleaning? I tried sdelete -c
c:$MFT and that didn't work. The only way I could see to use it was
'sdelete -c c:' and that began to work. I wanted a specific area of the NTFS
like the MFT. I know you can set reserve space too. But I don't mess a lot
with that. I have a 200GB HD and split that into a couple of 30 GB
partitions for fat32 and linux. So I don't fill up a lot.

I remember soething you said about a registry key cleaning of the apge
file too was very interesting. I lost that reg key. I will search for it. It
was a nice little registry hack. But I liked that days of saving the
registry header and deleteing user.dat and gdi.dat was it? Anyway that was
98. Those days are gone. :)

Bill

[Kerr Mudd-John]

On Sat, 29 Oct 2016 13:20:22 +0100, Paul > wrote:

> Kerr Mudd-John wrote:
>> On Fri, 28 Oct 2016 23:10:13 +0100, Paul > wrote:
>>
>>> Bill Cunningham wrote:
>>>> I am wondering that when files are deleted does XP x86 or x64
>>>> "compres" the MFT? Say many files are deleted enough that some size
>>>> can be saved with the MFT. Are the file entries simply removed and
>>>> the space wasted? If so are there any MFT compression utilites out
>>>> there? I have never seen any.
>>>> Bill
>>>
>>> If you use nfi.exe, you can see what happens
>>> to them.
>> https://support.microsoft.com/en-us/kb/253066
>> oem3sr2.zip seems to be missing - well a 1.3kb file is there, but it
>> ain't the tool.
>>
>
> 3.6MB
>
> https://web.archive.org/web/20150329185738/http://download.microsoft.com/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip
>
> (
> https://web.archive.org/web/20150329185738/http://support.microsoft.com/en-us/kb/253066
> )
>
> Paul

Thanks.


--
Bah, and indeed, Humbug