From SearchWindowsServer.com, Master File Table:
The master file table (MFT) is a database in which information about every file and directory on an NT File System (NTFS) volume is stored. There is at least one record for every file and directory on the NTFS logical volume. Each record contains attributes that tell the operating system (OS) how to deal with the file or directory associated with the record.
Detailed information about a file or directory such as the type, size, date/time of creation, date/time of most recent modification and author identity is either stored in MFT entries or in space external to the MFT but described by the MFT entries. For a complete list of MFT attributes, click on "View" (in Explorer aka My Computer) in an open folder containing at least one file or subfolder and then click on "Choose Details." You can select which attributes you want made visible by checking or unchecking the boxes in the left-hand column of the resulting pop-up window.
(click for better view)
MFT Zone, excerpt from PCGuide.com
As more files and directories are added to the file system, it becomes necessary for NTFS to add more records to the MFT. Since keeping the MFT contiguous on the disk improves performance, when an NTFS volume is first set up, the operating system reserves about 12.5% of the disk space immediately following the MFT; this is sometimes called the "MFT Zone". This is a substantial chunk of real estate to reserve, but bear in mind that it is still usable. Regular files and directories will not use this space until and unless the rest of the disk volume space is consumed, but if that occurs, the "MFT Zone" will be used. Eventually, if there are enough entries placed in the MFT, as it expands it will use up the "MFT Zone". When this happens, the operating system will automatically allocate more space elsewhere on the disk for the MFT. This allows the MFT to grow to a size limited only by the size of the volume, but this fragmentation of the MFT may reduce performance by increasing the number of reads required for some files, and the MFT cannot generally be defragmented.
WARNING: The main reason for posting this article has to do with a major problem that can occur (and did to me just the other day).
This has to do with the "Delayed Write" on hard drives. On modern hard drives data is not written to the drive real-time. The data is stored in a memory cache, sometimes the drive itself has a cache.
A major problem occurs when the copy of the drive's MFT kept is in memory cannot be written to the drive. You get a error dialog stating that "delayed write" failed and it lists "$MFT" which is the hidden filename. The dialog will also state that "data has been lost."
In my case, this happened when I tried to Restart/Reboot my system, and the error was for to my USB External Hard Drive and the usual tools could not fix (rebuild) the MFT. I suspect a USB hard drive interface hardware failure.
This will make the hard drive inaccessible. Your system may be able to see the hard drive, but it will show as NOT partitioned. Therefore ALL your data on the drive is lost/inaccessible.
This CAN happen to any hard drive, but External Hard Drives are especially susceptible if the interface (USB or Firewire) goes bad during actual operation. I believe that USB External Hard Drive are most susceptible because of all the other USB devices that you connect to your USB ports. A glitch in another USB device at a critical moment, causes a problem on the USB External Drive (like a Delay Write failure of the $MFT).
No comments:
Post a Comment