How to put [Folder Entry] close to MFT (Master File Table)?

Defraggler
1

How to put [Folder Entry] close to MFT (Master File Table)?

Background:

Win XP SP3 and

Defraggler v 2.11.560 and

NTFS 931 GB drive

The Hard Disk has been completely defragged or said differently all files have a fragmentation = 1.

This is an archive disk and daily backup disk.

Archive disk means old data is defragged and place to inner tracks of drive, slow part of drive, via UltimateDefrag 4.

Backup disk means outer tracks are left free for faster daily backups.

An easily visually noticeable problem while using Defraggler is there are thousands of [Folder Entry] entries scattered about drive, like:

Filename = [Folder Entry]

Fragment = 1

Size = 5KB to 400KB

Path = E:\ _

This problem is not easily noticed with UltimateDefrag 4 but if you click on free space you can confirm there are directories [Folder Entry] entries scattered about the drive.

Question:

How to put [Folder Entry] close to MFT (Master File Table)?

Why?

To group like data and to have a continuous free space so there are no obstructions.

A continuous free space for large files like a 3 Gigabyte file can have a fragmentation = 1.

--

2

Would you please post a screen shot that displays

[Folder Entry]

I see no evidence when I analyze my backup partition which Windows Explorer shows as holding 8,815 Folders

3

Yes, there are such things. Maybe they are index entries for the MFT, i.e. when an MFT entry for a particular folder is too small to hold the details of all the files in that folder, an index record is created which is logically part of the MFT but physically separate. Very large folders will have correspondingly large index records. I don't know if they can be moved: my small change says no.

4

Hello Alan_B

You have 8,815 Folders but my guess is that most of your [Folder Entry] are inside your MFT.

Since my smallest [Folder Entry] is 5 KB my guess is that:

Small [Folder Entry]'s are inside MFT and

Large [Folder Entry]'s > 4096 bytes are outside MFT.

The NTFS 931 GB drive was formatted with default value of 4096 byte cluster.

Inside Defraggler you can do a Search of files less than 1 MB.

That is another way I found many

[Folder Entry]

Let me know if you found [Folder Entry] on your drive.

If you still need a screen shot to help me then let me know.

Cheers!

5

Please note that when I sort the File List in Filename order it starts with names commencing #,

followed by digits 0 through to 9

followed by _

followed by A through to z

followed by {

followed by ~

There is no evidence of any [ or $

@ Augeas

Thanks

I have configured Purple to denote Reserved MFT space in the drive map

This occupies two off 3mm by 3 mm square spots when I adjust the Drive Map area to a width of 460 mm and a height of 66 mm.

I have to dust off and deploy a ruler and abacus to determine that a display area of 30360 sq. mm. for a partition of 465 GB,

is using 65 sq. mm. per GB, or 15 MB per sq. mm. or 137 MB per square spot.

When I select the left square spot am told it holds 87 MB of $MFT in 3 fragments.

When I select the right square spot I am told it is my 408 MB image backup file E:\Images\v5\2FE769AFA97E71E8-17-17.inc_16.mrimg in 3 fragments.

N.B. This image backup file has more fragments present in the red spots just to the right of the purple MFT,

and strangely at the second spot to the right of MFT I can also see a file 318 MB file in 17 fragments named $UsnJrnl:$J in E:\Extend\

Strange that this file does NOT appear in the normal File List.

I bitterly regret that Defragger does not show me the size of one of its squares,

and I need to break out a ruler and abacus to determine the size

@Goddess01

Thanks for your response and guidance.

I found that "Search" for less than 1 MB was no help at all,

BUT I was successful when I searched for a Filename containing [

That found many [Folder Entry] items ranging from 9 KB up to 161 KB.

Then I again Analyzed and although File List does NOT show [Folder Entry],

when I selected the SEARCH Tab I found it presented [Folder Entry] between 9FF97d01 and _CACHE_001_

I now know that the File List Tab does NOT List all files, even though I have configured Windows Explorer for minimum concealement of information,

but the Search Tab will show me a lot more,

even including E:\Extend\$UsnJrnl:$J - although when I select to "Open Containing Folder" there is a "E:\Extend\ is Not accessible access is denied" prohibition.

I agree with Augeas that these variable sized [Folder Entry] are index files and not actual Folders, which is what I assumed you were trying to control.

6

Incidentally :-

When I select Drive E:\ the Drive Map shows 8 regions of White Empty, and above each a larger region of Grey.

In the grey zone I notice a few individual spots, and one double spot group, are slightly lighter grey than the others.

When I click Analyze the double spot becomes the purple Reserved MFT space.

Empty space seems to be empty and like Monty Python's Dead Parrot, is Bereft of Life, it rests in peace ,

with the sole exception that the extreme left/top corner of the second Empty zone holds two normal files plus one [Folder Entry] index file.

I firmly believe that these are NOT in the empty region, but that the BOUNDARIES of individual squares in the map correspond to a precise digitization of the sectors,

and the areas within each square denote the the nature of the MAJORITY of the sectors, whether empty, fragmented, or unfragmented.

When I use Search and choose to look for files containing [

there are far to many [Folder Entry] items to count.

When I select all the entries a "measles rash" of Red fragments appears in all the Red fragmented regions above each of the 8 white Empty regions.

N.B. E:\ is a GPT partition (not MBR) on my 960 GB Secondary HDD.

I believe this topic may have been started with the intention of using folder placement to govern the placement of the files which are held in a folder.

In case this might be of interest - whilst awaiting any response to my first reply I have investigated further :-

Ever since my first P.C. with a 20 MegaByte HDD that used DOS 3.3??,

I have known that folders do not constrain the boundaries of where a file is held on a FAT32 formatted partition.

Till now I have always assumed that the same applied to NTFS partitions.

I have now fully validated that assumption as below :-

After Defraggler analyzed E:\ I used the File List and chose a file held within E:\Images\OCZ and clicked on HighLight Folder and chose E:\Images\OCZ

This highlighted 1 or more spots on each of the 12 rows of squares on display.

Windows Explorer shows that this folder actually holds 77.4 GB (83,168,821,584 bytes) within 72 Files, 4 Folders.

Partition E:\ has a size of 465 GB, and 370 GB is used by 41,810 Files in 8816 Folders

The above shows that E:\Images\OCZ\ holds 22% of the 370 GB used space and is scattered across 90% of the complete area covered by the partition,

and that the remaining 78% of this area is occupied by the scattered contents of several thousand unrelated folders.

Partitions define the sector boundaries within a HDD for holding files.

Folders provide no such constraint on which sectors are used - they are just a convenience for designating a path to any file.

NB Partition E:\ grew an extra folder between my first and second replies when I was not looking - Windows does that :angry:

7

> Alan_B

> Please note that when I sort the File List in Filename order it starts with names commencing #,

> followed by digits 0 through to 9

> followed by _

> …

> There is no evidence of any [ or $

On my computer, when sorted by filename:

[Folder Entry] appears after 9 and before _

Search parameters:

+ are smaller than 1 MB

+ include non fragmented files

> That found many [Folder Entry] items ranging from 9 KB up to 161 KB.

OK, we are on the same page.

With Defraggler v 2.11.560:

When you click on White Square, it is usually empty, but, sometime an ‘empty’ white square does contain many

[Folder Entry]

Can Defraggler v 2.11.560 move all [Folder Entry] near the MFT?

Is the information in [Folder Entry] essential to normal operation?

Can [Folder Entry] be deleted?

I understand that Update Sequence Number (USN) are not essential like:

D:\$Extend\$UsnJrnl:$J is not essential, is my understanding.

So Pre Defrag, do:

Win-R

fsutil usn deletejournal /d e:

does the trick to delete things like D:\$Extend\$UsnJrnl:$J

If [Folder Entry] is essential, then:

How to put [Folder Entry] close to MFT (Master File Table)?

Instead of [Folder Entry]’s scattered all over the drive.

--

8

I am afraid I do not know the purpose of [Folder Entry] nor whether it is essential or can be deleted.

My suspicion is that if you are able to delete it then it might be rebuilt the next time a file is added to the corresponding folder.

You seem to have better access to and visibility of [Folder Entry] under Win XP + SP3 than I have under Win 7 + SP1

I would say that you can select the $MFT and move that to the End of the Disc.

You can also select all the [Folder Entry] items and right click and use the option to Move to the End of the Disc.

I do not know if Windows might severely punish you for such actions.

I wish you well and look forward to reading your exploits.

9

I have a solution and graphical explanation. Please check your PM.

10

[Folder Entry] = Standard directory as we all know and love them.

If you right-click the desktop and select NEW and then FOLDER, you will create a new directory, a new [Folder Entry] !! There is no mystery here. If you delete a [Folder Entry], you delete all the files within it. Delete [Windows] and, well, you wipe out your o/s. Delete [Test Folder], and you delete the test folder you just made. Makes sense, right?

For all practical purposes, a [Folder Entry] will take some space in the $MFT. It will also commandeer a small amount of clusters outside the $MFT. It is the positioning of the these outside clusters that is the topic of this thread.

Now. Moving the $MFT to the end of the disk is a no-no, in terms of performance loss only. You basically want the $MFT and its entourage of $Metafiles, including directories, to all be grouped together, preferably on the outer 25% of the tracks. And for bonus points, you place your Windows and Program Files (directories and files) in close proximity. Put all this somewhere near the outer edge and beginning of the disk. You get the highest linear velocity there and gain about 3 or 4 percent speed increase when doing directory operations.

For those of you with slow XP machines, you can absolutely see a big improvement in the responsiveness of the START menu by bringing all the shortcuts and icons and menu items together in one area of the disk. For each start menu icon, the disk head needs to visit the $MFT and its gang of metafiles, the program directory, the program itself, the icon file, time/date, permissions, and other attributes. Did I mention the registry too? I did now.. We're talking 20-25 head movements here. For bringing up ONE SINGLE start menu item to the screen. For true optimization you need to reduce those head movements as much as possible. And that means file placement! It's not good enough to just defrag the files. It's important to bring them close together in groups.

I tell many of my clients to treat the filing system as a black box. And rightfully so. Just put your data into the box. It will be there when you need it. Tons of engineering and thought has gone into putting your data on a disk and pulling it back. You'd be totally horrified and amazed at the amount of work that goes on behind the scenes.

Trivia fact #1 - Modern HDD records analog only. No such thing as 0's and 1's

Trivia fact #2 - TLC SSD can use as few as 10 single electrons, trapped in a well, to represent your data. 10 electrons!

For those of us that like to tweak and speed things up a couple of percent, I say have at it. All defragger utils today use built-into-windows API calls to command NTFS. And these are very well tested over 15 years by billions of users in the field, every single day. The only time you'll loose data is if your storage device craps out on you.

Having said all that - It is beyond the scope of this post to go into further explanations of how and why NTFS does what it does. So therefore I leave you with these links to read at leisure.

http://en.wikipedia.org/wiki/NTFS

http://en.wikipedia.org/wiki/NTFS#Metafiles

http://en.wikipedia.org/wiki/B%2B_tree

http://en.wikipedia.org/wiki/Journaling_file_system

http://technet.microsoft.com/en-us/library/cc758691%28v=ws.10%29.aspx

http://pcguide.com/ref/hdd/geom/dataPRML-c.html

11

Thank you Keatah for helping me pinpoint the problem and the answer.

The problem:

How to put [Folder Entry] close to MFT (Master File Table)?

The Answer:

I used Ultimate Defrag 4

7654321 is the MFT Starting cluster for Ultimate Defrag 4 on my system

The Particulars:

32 was my initial MFT Starting cluster

(and 32 does not work for my situation)

I had about 40000 clusters for [Folder Entry] for 400 Gbytes of data.

About 40000 folders!

So the tip I learned was Ultimate Defrag 4 does defrag [Folder Entry]

but it puts [Folder Entry] before the MFT or Left side of MFT.

Since MFT started at cluster 32

there was no room for 40000 clusters between 0-32

So UD left the [Folder Entry] scattered about the hard drive

(not desired)

After lots of calculations and to help others reading this,

Put start cluster in first 20% of drive.

But somewhere in the first 20% is too vague

This is what I did and works for me:

7654321 is the Starting cluster for Ultimate Defrag 4.

Why Starting cluster = 7654321 ?

Because 7654321 is:

- An easy number to remember

- Easy to type in the 7 (seven) digits

- An easy reference point for Ultimate Defrag 4 beginners to start experimenting

- Allow lots of room for [Folder Entry] directories; upon defrag, to be just before cluster 7654321

- Allows some room for regular high performance data, which is the data on the outer tracks, to be before MFT.

So the MFT is approximately in the middle of the high performance data, to increase drive performance.

- and cluster 7654321 is about 3% of my drive 1000GB = 1TB drive

In the above case MFT means:

(Folders [Folder Entry] + MFT in use + MFT reserve + $Logfile + $Bitmap + $AttrDat + $UpCase + $MFTmirr + $Secure + $Objid)

Again, Thank you Keatah for all your insights.

12

Thanks for the information Keatah.

[Folder Entry] = Standard directory as we all know and love them.

That was my suspicion yesterday, before my post #8,

but I tested and found it false, or at best inadequate.

Defraggler Analyzed partition H:\ and then searched for

Filename contains ; [

Include non-defragmented files

Innumerable [Folder Entry] files were displayed

I numbered them via right click and "Save List to Text File" and then loading the file into MetaPad.

There were 685 off [Folder Entry] files identified.

Using Windows Explorer I selected all the contents of partition H:\ and the result was

10,737 Files,1,272 Folders.

It has almost twice as many folders as it has [Folder Entry] files - not the result I was expecting.

I really do not believe my carefully composed collection of portable utilities and applications has almost 600 absolutely empty folders.

My H:\PortableApps suite contains 6,750 Files, 936 Folders,

and many of these folders contain no files themselves but do hold chains of sub-folders.

Does a Folder not qualify for its own [Folder Entry] if it holds no file of its own but it is only on a path to other folders,

or is there some other explanation for Folders without corresponding [Folder Entry] ?

13

If a [Folder Entry] can fit within the $MFT it will. And the only remaining part of it outside might take 1 cluster and not be fragmented. If a directory is too large, or becomes fragmented it might get pushed out of the $MFT entirely.

Each folder is associated with an entry, empty, full, half-full. It doesn't matter. I do not know what criteria defraggler uses to determine when or when not to display [folder entry]. probably when enough of it is outside the mft, just a guess on that. I'm far more familiar with Ultimate Defrag.

http://www.pcguide.com/ref/hdd/file/ntfs/archMFT-c.html

http://www.pcguide.com/ref/hdd/file/ntfs/files.htm

14

Thanks

15

As a side note:

With Defraggler v 2.11.560 I found a [Folder Entry] with:

1750 Fragments

0 KB

\system volume information\_restore{...

--

16

http://en.wikipedia....iki/Sparse_file

Or in this case, a sparse directory.

17

Side Bar:

I found 149 Gbytes in

E:\system volume information

I decided to delete it all versus defragging any of it.

But no access to E:\system volume information via windoze explorer.

How to unlock it?

Unlock E:\system volume information

Win-R

CMD

E:

cd\

cacls "e:\system volume information" /E /G John:F

How to find the current user "John", in Win XP?

Ctrl-Alt-Del = Windows Task Manager, click Users, note User name = _

_ = John

Use windoze explorer, goto, E:\system volume information

Delete files.

Warning: Deleting files may cause your computer to blow up plus 100 Mbytes!

:)

How to lock it? (Lock e:\system volume information)

cacls "e:\system volume information" /E /R John

reference:

http://support.microsoft.com/kb/309531

--

18

Hello Keatah, with UD4, win XP, NTSF disk I noticed a file:

E:\::$SECURITY_DESCRIPTOR

It appears to be an unmovable.

It prevents proper defragmentation of the disk.

Help.

--

19

How to lock it? (Lock e:\system volume information)

cacls "e:\system volume information" /E /R John

Why lock it , why not exterminate it ?

When I used XP on a laptop I found it essential to disable monitoring of all partitions other than C:\.

After using CALCLS to take ownership I would delete "D:\system volume information\" etc.

Upon a glitchy power-up XP would re-enable monitoring of all partitions.

Solution :-

Delete the folder "D:\system volume information\" and create a file by the name "D:\system volume information\".

20

> Why lock it , why not exterminate it ?

Because it is uncertain as to the consequences are if

"e:\system volume information" is exterminated.

And because I wanted to give future readers the information to undo what they did.

UnLock it:

cacls "e:\system volume information" /E /G John:F

Lock it:

cacls "e:\system volume information" /E /R John

--