Windows MFT: Tips for Analysis and Optimization

If you are interested in file systems, you will find further information in the article linked below. Incidentally, MFT is not just MFT: The Windows abbreviation stands for something different from that of cameras (there are Micro Four Thirds lenses). »File systems under Windows: This is how you have your storage media under control

Free software for Windows MFT: »Recuva – usually reliably restores deleted files * »Everything – Fast, Lean Desktop Search Engine * »UltraSearch – fast desktop search engine including file content search * »Smart Defrag – defragmentation program, TRIM and MFT support * »PrivaZer – (portable) privacy tool including MFT cleanup »Sysinternals Suite – shows system information such as the MFT size * »Ashampoo WinOptimizer 17 – under” Customize Windows> Tweaking> Drives> MFT “you can adjust the reserved MFT size, for which the options” Reserve little storage space (standard) “,” Reserve medium amount of storage space “,” Large amount of Reserve space “and” Reserve maximum amount of space “there. As a rule, an intervention is not necessary here. The technical term for this tweak (setting change) is MFT zone (size).

Depending on which setting is active, the Ashampoo full version intervenes in the registry: under HKEY_LOCAL_MACHINE System CurrentControlSet Control FileSystem under the entry NtfsMftZoneReservation. In the second setting, the DWORD entry value is 2, in the third setting 3 and in the fourth 4. The values ​​correspond to a certain percentage of the storage space: 1 stands for 12.5 percent, 2 for 25 percent, 3 for 37.5 Percent and 4 for 45 percent. * Programs marked with an asterisk are described in more detail below.

Which Windows version to buy?

MFT: what is it? Master file table explained

The MFT is jointly responsible for ensuring that you can move files at lightning speed: If you move a file on the same partition into another folder, it is done in no time at all. Because Windows does not have to recreate the content, it just has to adapt the MFT (“bend the path”). It behaves differently when moving a file to another partition: The file also disappears at the original location, but it is slower to create it again. Copying files from one partition to another (and duplicating them within the same partition) is also slow; the MFT trick doesn’t work here.

Windows MFT analysis on the command line

Those interested in technical internals open a command line with administrator rights and execute a command to determine the NTFS version (for Windows 7 to Windows 10 each 3.1) – and to receive MFT information. You can start by opening the Start menu with the Windows key: Enter cmd and confirm with Ctrl-Shift-Enter and Alt-J. Now give fsutil fsinfo ntfsinfo c: and you will see information about “Mft Valid Data Length”, “Mft Start Lnc”, “Mft Zone Start”, Mft Zone End “and” MFT Zone Size “. The information appeared in the test under Windows 10 20H2 (October 2020 Update); In Windows 7 / 8.1, the “MFT zone size” is missing in particular.

Would you like a lot of technical information? A CMD command provides extensive information.

Determine MFT size using CMD

The MFT size is probably the most exciting: With the fsutil command, it is the same as the ntfsinfo tool from the Sysinternals Suite indicates. Interested parties download the Sysinternals Suite and extract the ntfsinfo.exe file from its ZIP archive. You copy their path into an administrator command line (right-click while holding down the shift key, “Copy as path”), add a space and as a parameter c: and confirm with the enter key. When you open it for the first time, agree to the license conditions with “Agree”. In the “MFT Information” area, to the right of “MFT size”, there should then be an identical size specification as for the fsutil “Mft Valid Data Length”. Furthermore, the megabyte information (again except for decimal places) is identical for “MFT zone size” (fsutil) and “MFT zone size” (ntfsinfo.exe). The “Mft Valid Data Length” is around 803.50 MB under Windows 10. You will also find this information after executing another command line command with CMD administrator rights: fsutil volume filelayout c: $ mft In the example, “842,530,816 (803.5 MB)” is written after “Size”, “Assigned size” and “Vdl”. Windows 10 shows two decimal places with the fsinfo command, with the filelayout it rounds and shows only one decimal place. Far more useful are free NTFS / MFT tools that you use for more productive work on the PC. We present these to you in the following four paragraphs.

Recuva: recover deleted files via MFT

If you delete a file and remove it from the trash or empty it, the item is not lost. Windows only marks the appropriate memory area for overwriting with new data. A deleted flag is used in the MFT for this purpose. It is uncertain when a new file will overwrite the contents of the drive. Until then, data recovery is possible. You should try this as soon as possible to avoid the risk of toxic write processes. Recommended is about Recuva: One of its two scan modes checks the MFT for deleted files and restores them. If that fails or you want a better chance of recovery from the outset, run the deep scan. In addition to the MFT, it scans the drive for bit patterns of known file formats: the tool scans cluster by cluster and thus determines JPG or DOC files, for example. The tool recognizes them based on their beginnings, the headers (file headers). The deep scan is time-consuming, as the much faster standard scan based on MFT usually delivers good results.

Recuva from the CCleaner makers helps in the event of data loss – in most cases confidently.

Everything: Find files quickly using the MFT index

Probably the fastest file search program is Everything: It is sufficient to type in the first letters of a file or folder in its search slot. Before you have completely entered the name, (mostly matching) search results appear. You can open one of them by double-clicking; context menus can be used. Everything works index-based like the Windows Start menu search, except that Everything builds the index at lightning speed: It accesses the MFT. That is also the reason why the tool does not work with FAT32 memories; these do not use MFT. Another disadvantage: the search for file contents is not possible. However, there are many handy sorting functions that you can use to keep track of a large number of files. Those who do not want to familiarize themselves with the professional functions can simply ignore them and benefit from fast file searches.

Everything does not record the files in the classic way, but indexes them using the MFT.

UltraSearch: Fast Everything Alternative

UltraSearch works similarly to Everything, but not only finds files by name: a content-based search is also possible. If you enter a phrase from a TXT file, the software will track it down. It happens very slowly; UltraSearch works faster if you are looking for file names that use the MFT Turbo. An anecdote: Everything can be installed under Windows XP, UltraSearch cannot (neither with Service Pack 1 nor with the latest Service Pack 3). Since Windows XP allows the system partition (C: ) to be formatted with FAT32 during installation, we installed the operating system in this way as a test. Since FAT32 has no MFT, Everything couldn’t find any files. In a second XP installation, in which NTFS was used for C: , the search for files worked with the search program; Because of the file system, an MFT is used here.

UltraSearch is likely to share the title “Fastest PC Search in the World” with Everything.

Smart Defrag: Defragment hard disk and MFT

The defragmenter tool Smart Defrag from IObit defragments entire hard disks and individual files, sends the TRIM command to SSDs and has MFT optimization. Go to the “Boot Time Defrag” area, where you will find the options “Defragment swap and hibernation files”, “Defragment MFT”, “Defragment system files” and the options “Defragment registry files” and “Certain files”, which are limited to the Pro version defragment “. If you check the box in front of “Defragment MFT”, this switches the switch at “Boot time defrag” to “On”. The tool promises to perform an MFT defragmentation as part of a restart. You will then find a new log entry in Smart Defrag in the boot time defrag area, where you can open a LOG report file in the editor by clicking on “Show report”. Smart Defrag may not work with an SSD PC: In the test, the tool partially recognized the flash boot drive and refused an MFT optimization on the “Boot time defrag” tab: “Your hard drives are SSDs that do not need any defragmentation”. The tuning operations mentioned above are then not available.