NTFS Master File Table Overview

Summary

• NTFS stores file metadata and some data in the Master File Table (MFT).
• There is at least one MFT entry per file, including the MFT itself.
• File attributes (size, timestamps, permissions, data locations) are in MFT entries or in space described by those entries.
• MFT grows as files are added; deleted-file entries are marked free but reserved MFT space is not shrunk.
• NTFS reserves an MFT zone to keep the MFT contiguous as it grows.
• Allocation order between the MFT zone and unreserved space depends on file size distribution.
• MFT fragmentation occurs when either the MFT zone or unreserved space becomes fully allocated.
• The MFT can be defragmented; sufficient free space at the start of the MFT zone helps reduce fragmentation during defragmentation.
• The system computes a default MFT zone based on volume size; it can be increased via registry but not decreased below the calculated default.
• Current MFT size and fragment count can be obtained via Disk Defragmenter report or FSCTL_GET_NTFS_VOLUME_DATA control code.

Action Items

• (Owner: Admin) Review volume MFT usage before large defragmentation tasks.
• (Owner: Admin) Ensure free space remains at start of MFT zone prior to MFT defragmentation.
• (Owner: Windows Admin) Use Disk Defragmenter report or FSCTL_GET_NTFS_VOLUME_DATA to monitor MFT size and fragmentation.
• (Owner: Sysadmin) Consider increasing MFT zone via registry on volumes with many small files.

MFT Behavior And Allocation Details

• MFT entries: one per file; include MFT file itself.
• Deleted entries: marked free and reusable; allocated disk space for MFT does not shrink.
• MFT zone: reserved region to encourage contiguous growth of MFT.
• Allocation precedence:
  • Volumes with few large files often allocate unreserved space first.
  • Volumes with many small files often allocate MFT zone first.
• Fragmentation triggers:
  • Occurs when either MFT zone or unreserved space becomes fully allocated.
  • If unreserved space fills, user files allocate from MFT zone.
  • If MFT zone fills, new MFT entries allocate from unreserved space.

Defragmentation Guidance

• MFT defragmentation is possible.
• To reduce the chance MFT zone fills during defragmentation, leave maximum free space at beginning of MFT zone.
• If MFT zone fills before defragmentation completes, ensure there is unallocated space outside the zone.

Configuration And Tools

• Default MFT zone:
  • Calculated at mount time and based on volume size.
  • Can be increased via registry key referenced by Microsoft documentation.
  • Cannot be reduced below the system-calculated default.
• Monitoring tools:
  • Disk Defragmenter: run analysis, then click View Report for MFT size and fragment count.
  • Programmatic: FSCTL_GET_NTFS_VOLUME_DATA control code returns MFT size and related volume data.

Decisions

• System-calculated default MFT zone is authoritative and cannot be decreased.
• Increasing the MFT zone does not reduce usable disk space for user data.

Open Questions

• What specific registry key and values are required to increase the MFT zone on a given Windows version?
• What are recommended minimum free-space thresholds at the start of the MFT zone before defragmentation?
• How often should MFT fragmentation be monitored for different workload profiles?