Date: Tue, 27 Apr 1999 18:26:54 +0400
From: Vladimir Dubrovin <vlad@sandy.ru>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: MFT problem

Hello NTBUGTRAQ,

Sorry for my bad English...

Some  times  ago  it was noticed the problem with MFT. I don't know if
this  problem  was  discussed in this list, so if it is - just discard
this message.

The problem is:

Then creating a very large number of empty files on NTFS partition and
then  removing  this  files  you  loose  a  lot of space (up to 90% of
volume!)  and you couldn't recover this space without reformatting the
NTFS  volume.  This  problem occurs because NT allocates space in MFT
(Master  File Table, an internal NTFS database). Then the MFT reserved
space ends NT allocates new space for MFT. The space allocated for MFT
will never be released. (information "How NTFS Reserves Space for its
Master File Table (MFT)" can be found in KB article Q174619).

Then   creating   empty  file  (with  zero length) it takes disk space
olny in directory entry and MFT table. If you'll fill your NTFS volume
with such  files and then delete them the MFT table will take the most
of your hard drive space (up to 90% as it was noticed before).

You can reproduce this problem next way:

It's  better  to  use empty NTFS volume of small size - 50-100Mb - the
results will be more distinctive.

Check the free space on your NTFS volume.

md temp
for /L %i in (1,1,1000000) do type nul >temp/file.%i.tmp

then you fill all the partition with this files - abort the circle.

del /Q temp\*.*
del /Q temp

Now  you  can  check  free  space on your hard drive. You've loosed it
almost completely...

By the way: it seems
dir /A $MFT
doesn't  shows   real   MFT   size,   as  it  described  in  Microsoft
documentation. At least you will never find the space you've loosed in
any  special  file.  But  you  can  try  some  other  utility, such as
defragmentation utilities - usually they shows MFT reserved space...

The  problem  is,  that  any  user,  who has "create" permition in any
directory  on  NTFS volume can bring this volume down.
It's specially interesting  if your FTP server has "incoming"
directory,  or  you  offer  free HTML pages for your customers on NTFS
volume...

  This problem isn't solvable with some kind of disk quotas,
because the files are empty...


I've  contacted  Vitaly Savenkov from Russian department of Microsoft,
russia@microsoft.com.
He forwarded me reply from developers:

<><><><><><><>
Dear ...,
I'm sorry that I have to tell you the following.
-
My investigations and the answers from our Secondary Response Group
confirmed, that the $MFT will never shrink.
The only way is to reformat the Partition.
This behavior is the drawback resulting from optimizing the
NTFS performance. The main goal was to avoid fragmentation.
-
Possibly the best resolution for your situation is to use a
single partition for the FTP Data. If the available space then
goes under an acceptable level you can backup this partition
and reformat it.

I checked this with our Escallation Team and so i can say that
this behavior of NTFS will not be changed.

best regards,
...
<><><><><><><>

So, now you can check it...


  +=-=-=-=-=-=-=-=-=+
  |Vladimir Dubrovin|
  | CSS Coordinator |
  | Sandy Info, ISP |
 =+=-=-=-=-=-=-=-=-=+=-=