Data Recovery Digest

NTFS stands for New Technology File System and is the current file system used on Windows operating systems. It superseded the FAT file system and has been in place since Windows NT 3.1 back in 1993. NTFS has a file within which is known as the master file table (MFT). Every attribute that is known about a file, such as its data content, size, permission and date stamps is all included in a MFT entry.
Whenever a file is added to the NTFS volume, the MFT will create an entry for it. However, when a file is deleted from the disk it is only removed from the MFT and not from the physical drive itself. This is because when a file is deleted the entry is simply marked as available – essentially telling the system that is allowed to rewrite over it should it need to. For instance, if you quick format a drive then you are not actually getting rid of the files on the drive. The MFT is removed and everything is then marked as free space, but files can still be retrieved.
These entries tell the system all the attributes it needs to know about a file. There are different ways that these can be stored. There is resident attributes, which is kept within the MFT records, and applies to required things like the name of the file and when it was created. There is also non-resident attributes, which are those that cannot fit within the MFT record. It is then placed in a data run. This basically means that the system points to elsewhere on the disk, outside of the record, where the information can be found.
The operating system will reserve space on the hard drive for the MFT to grow. This is known as the MFT zone. The size of the MFT zone is calculated by the system when the volume is mounted. You are able to increase the size of the zone should you so wish, but you cannot make it smaller. This may seem like a lot of space to take up, but it isn’t locked off. Normal files will still be allowed to use this space, but only if the rest of the hard drive is full up. Conversely, if the MFT exceeds its space then it will be allocated more from what is unreserved. Generally, volumes with a lot of small files will use the MFT zone first, while those with a few large files will use the unreserved space.
This fragmentation of the MFT could cause a drop in performance as it will increase how many times a file will need to be read in order to be accessed. As such, it is possible to defragment the MFT. Microsoft recommend leaving as much space at the beginning of the MFT zone as possible before defragmenting to lower the chance of the zone becoming fully allocated before the process is over. If you want to find out how much space the MFT takes up on your system, use the system tool Disk Defragmenter to check the NTFS file system. This will tell you, along with other information, how big the MFT is and how fragmented it is.