Found an NTFS meta data file that could be deleted

[pjlent]

I use Ccleaner to git rid of extraneous files prior to doing a defrag, as I suspect many other people do before defragging.

 

One nasty/annoying sometimes LARGE "file" that Winblows XP likes to sometimes have sitting around is something you can't normally see, unless you use tools like HDView, is the $Extend\$UsnJrnl NTFS meta file. I think it's used for indexing (who uses that waist of code?), and a few other things, but it essentially records data on each file that changes, and it is UNMOVABLE by MS Defrag API's.

 

I have two computers, and that file was hogging something like 67 to 69 GB (that's right, GIGABYTES), out of 120GB on both of them according to HDView. It can be gotten rid of via a FSUtil command (fsutil usn deletejournal /n c:), but file explorer won't show that you've saved much space (maybe a gig), as normally file exporer can't see that meta file to begin with. Something you could/should probably put in the "Advanced" section... If you have indexing turned off anyways, no problem, although it can take a while to delete on a highly fragmented drive. I think it will rebuild itself (probably much smaller though) after a reboot if you have indexing turned on (between which, I'd do a defrag so that sucka's in only one spot).

 

The reason for getting rid of it, is that because it is an unmovable file, that grows, and it gets fragmented into all sorts of odd places on your drive which causes the drive to be much slower (i.e. having it in and around where your $MFT should be contiguous, causes a major slow down). After deleting it from my computer, and then re-running mydefrag, I seen at least a 10 to 20% boot speed increase, as mydefrag did not have to sort around it, and there were no longer small chunks of it sitting in my $MFT zone and "boot load" zone anymore.

 

 

 

I do have a question, and possibly another good suggestion (depending on the answer to that question).... Can most/all of the files in the RSA\MACHINEKEYS directory be deleted without the OS (using winxp sp3) or other apps puking all over themselves? If they can be deleted, that would be another thing to clean up.

 

Here's the reason why... My kid's computer (almost identical to mine) is still slow after using MD (MyDefrag), because there are 1,594 - "unmovable" 2KB files (most of them with old dates) sitting all around where the $MFT should be in one contiguous spot at the front of the drive (causes MD to take 5+ hours just to sort the $MFT area). Their actual size is something like 2.2MB, but they take up 6.7MB of actual drive space (only uses 1.7kb of 4kb clusters). They also cause the $MFT to become very fragmented again within just a few days, again slowing the computer to a crawl. Cleaning these files up could possibly speed up both a defragmentation program, AND then every disk operation after doing that defrag.

 

If you have an answer to this question, please let me know.

 

Thank you for your time and consideration.

[Augeas]

Hmm. $Extend\$UsnJrnl appears to be an NTFS file that isn't used by Windows and is disabled by default in XP (but not in Vista), but can be enabled and accessed by applications. I don't seem to have one. It apparently logs file changes (when enabled) and is used by indexing and bizarrely by Windows Live Messenger (definitely not on my pc). It's also apparently a sparse file, which I haven't quite managed to grasp, perhaps having entries in the MFT but no actual space allocated. There are reports of applications showing huge space allocations falsely.

 

If it is enabled then applications such as defaraggers can cause it to grow, but it should return to a more modest size - a few mb - after a reboot. Although explorer doesn't show metafiles it certainly counts the space used in its reports.

 

I'll pass on part two this time in the evening.

[pjlent]

Hmm. $Extend\$UsnJrnl appears to be an NTFS file that isn't used by Windows and is disabled by default in XP (but not in Vista), but can be enabled and accessed by applications. I don't seem to have one. It apparently logs file changes (when enabled) and is used by indexing and bizarrely by Windows Live Messenger (definitely not on my pc). It's also apparently a sparse file, which I haven't quite managed to grasp, perhaps having entries in the MFT but no actual space allocated. There are reports of applications showing huge space allocations falsely.

 

If it is enabled then applications such as defaraggers can cause it to grow, but it should return to a more modest size - a few mb - after a reboot. Although explorer doesn't show metafiles it certainly counts the space used in its reports.

 

I'll pass on part two this time in the evening.

 

It's used for indexing, and I think disk quotas, among other things. WinXP had indexing turned on by default, at least on my machines (again, another failed MS idea). I think it shows up as an NTFS "Reserved" area, as I noticed that a big chunk of "Reserved area" in mydefrag on my kid's computer "disappeared" after running that fsutil command. I think it is also known as "MFT reserved area" (in HDView), which would explain why explorer didn't show any/much space cleared after deleting it, as the MFT "can" actually store a file inside itself when the disk is low on available room (kinda treats it like "free space" although nothing can actually use it until you run very low on disk space).

 

Well, after several reboots, that file was still there, large as ever (indexing was already off). It had probably been there for years now, until I deleted it

 

Aw, come on , I really need to know the answer to that question (RSA\Machinekeys deletion).