C:\$Mft can not be written data will be lost... Options

[TheSentinel]

Heya

during the last days one of my XP systems turned nuts. During the start up the system came up out of the blue with error messages like

C:\$Mft can not be written data will get lost...

I was rather astonished not knowing what has happen. I shut the system down, did start in safe mode, checking the system... everything seemed to be ok cause the computer did start without any erros after that.

Late in the evening same errors came up again. After having a closer look in the "Glass Goggle" I found the reason what my system has made sick ;)

This MFT collects all information of files, directories, folders being saved on the harddisks of a system.
That MFT file has a limited size (~ 12.5% of free HDD space by Windows default).
This file gets heavily fragmented with all file operations you're doing, so if this file has to handle more information it still can't handle it properly and starts to make alert messages. Another effect of this problem can be noticed that a system slows down more and more. So this file needs more space to handle more information more files, directories etc.

In times of large harddisks (f.e. 300 GB HDD space at one of my systems) I think it's worth to post what must be done to get rid of this problem.

1. Start regedit from the run command.
2. Check out for that key called

HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ FileSystem

3. Create a DWORD-variable with the name NtfsMftZoneReservation.
4. Add the value 1 = 12.5% (Windows default value) or 2 = 25%. This values are percent free Harddiskspace.
5. Reboot the system

More details:
http://support.microsoft.com/default.aspx?...b;en-us;Q174619

Note:
Please be careful when making changes in the registry of your system.

Greetz
B. Udo

[Hunter]

This Info also might help

:thumb:


Defragging, the MFT, and the MFT Reserved Zone


I have a couple of questions about how the MFT Reserved Zone is affected by defraggers and I hope to get back answers specific to some of the commonly used defraggers, such as O&O, SpeedDisk, DiskKeeper (intentional misspelling), and PerfectDisk.

1.) When a defragger IS NOT told to defrag the MFT, does it leave the unused portion of the MFT reserved zone alone ?

2.) When a defragger IS told to defrag the MFT, how is the unused portion of the MFT reserved zone affected ? In other words, is only the used portion (ie., the actual MFT) defragged or is the entire MFT reserved zone defragged ?



*******

Although I can answer your questions from the view of other defraggers, I think it appropriate to only speak how PerfectDisk performs in regards to your questions below.

1.) When a defragger IS NOT told to defrag the MFT, does it leave the unused portion of the MFT reserved zone alone?

PerfectDisk uses the MS defrag APIs. These APIs allow for defraggers to move files OUT OF the MFT Reserved Zone but not into. When PerfectDisk defragments a NTFS partition, even though a MFT defrag has not been specified, PerfectDisk will move files OUT OF the Reserved Zone to make sure that they are contiguous. Typically, the Reserved Zone only stores files when the partition gets into a low freespace condition.

2.) When a defragger IS told to defrag the MFT, how is the unused portion of the MFT reserved zone affected? In other words, is only the used portion (ie., the actual MFT) defragged or is the entire MFT reserved zone defragged?

When PerfectDisk is told to perform offline defrag in order to defragment system files (which means the $MFT and all of the related NTFS metadata - includes the $Bitmap, $Logfile, $Upcase, etc...), it does exactly that. It defrags the $MFT and places it at the beginning of the logical partition - the exact same place the file system places it on a clean format. It also places the remaining metadata in the middle of the logical partition - the same place the file system places it on a clean format. During the MFT defrag, PerfectDisk makes no attempt to defrag the files in the Reserved Zone as that is handled by the online defrag

- Greg/Raxco Software

Disclaimer: I work for Raxco Software, the maker of PerfectDisk 2000, as a systems engineer in the support department.

[Hunter]

Question

I have one machine that seems to have too big MFT. When running Diskeeper 6 almost 50% of disk is reserved by MFT (and this naturally slows the disk operations down quite a lot)...is there anyway to reduce the size of MFT?

Answer

As files are added to an NTFS volume, more entries are added to the MFT, and so the MFT grows. When files are deleted from an NTFS volume, their MFT entries are marked as free and may be reused, but the MFT does not shrink. This is described in the Microsoft KB article Q174619.

The tip at http://www.jsiinc.com/suba/tip0400/rh0487.htm is best done *before* formatting a volume. Moreover, that tip is quite risky if done on a system containing an already existing partition as you described. So in your severe case, the safest and most complete fix is to back up the partition, do the registry hack, reformat the partition, and then restore the data on the reformatted partition. Note that the reconstructed partition should have a cluster size of at least 1Kb, because the MFT records are 1Kb in size; a smaller cluster size will allow the MFT to fragment.

Prevent or minimize MFT fragmentation by :

1.Not converting FAT partitions to NTFS format. Instead delete and recreate the partitions.

2.Not using compressed files on an active partition

3.Not compressing and decompressing entire volumes or directory sub-trees

4.Not having unnecessary security lists

5.Not having extremely long (greater than 31 character) file and directory names


If you have a lot of free space in the MFTRZ and want to try to reduce the size of the MFTRZ, I suggest you take a look at the NT Reg Hacks section of www.jsiinc.com.





I hope you understand the distinction between the MFT and the MFT reserved zone (MFTRZ).

The MFT grows when it needs to - using the space provided in the MFTRZ - but it NEVER shrinks. Hence, if your MFT is taking up half of your hard drive, you are stuck with it even if most of the MFT is blank. If you have a lot of unused space in your MFT, you can reclaim the space by backing up, wiping the partition, then restoring the backup.

An MFT that takes up 50% of a partition is extremely unusual. The only time I have seen something like that is:
1.) Test situations where I deliberately forced extreme MFT sizes.
2.) After using a tool like Partition Magic to reduce a large partition with a "normal" MFT. Eg., if you reduce a 10 GB partition with a 1 GB MFT down to a 2 GB partition, the MFT will stay at 1 GB and hence take up half of the partition.

However, if the space you are talking about is really just unused space in the MFTRZ that is NOT part of the MFT, then after all other free space on your hard drive is used up, your system should be using the free space in the MFTRZ with no noticeable performance impact.

If you have a lot of free space in the MFTRZ and want to try to reduce the size of the MFTRZ, I suggest you take a look at the NT Reg Hacks section of www.jsiinc.com.

[Hunter]

Question

What happens when the MFT goes to 100% utilization? Does NT 4.0 crash, or does it allocate more space for the MFT. Diskeeper 3.0 reports that the C: partition is at 98% MFT utilization. There is still 665MB free on that 2GB NTFS partition.

Answer

NTFS will allocate more space, but not contiguous.

Diskeeper cannpt defragment the MFT, so NTFS reserves a percentage of the volume for MFT exclusive use in an attempt to keep it contiguous but, especially if you have a lot of small files (< 1kb) or complex attributes on files, it runs out of the pre-allocated space and has to get more. There is actually a registry parameter: HKLM\System\CurrentControlSet\Control\FileSystem\NtfsMftZoneReservation that controls this but I've never had the nerve to mess with it. Naturally, it only takes effect when you format the drive and create the initial MFT so it's of limited use.

You can see the size of the MFT by executing "dir /a:h $mft at the root of an NTFS formatted drive.

For best performance, you could consider backing up the drive, reformatting with a bigger Zone Resrvation and restoring but is it worth it?

[Hunter]

I work in a company with more than 170 NT 4.0 workstations. We uses PowerQuest Drive Image to set up new workstations. Now it appears that that the $Mft and $Badclus-files of the image has been located in an area with bad sectors on the HD of one particular workstation. On several occasions I have benn forced to run a CHKDSK by means of NTRecover to boot this workstation. I would like to know if it is possible in anyway to move the Master File Table and related files to another location on the hard disk.

A possibility is resize this partition and move it's begin up, (using f.e. PartitionMagic 4.0) but this MFT takes large space:

When a partition is created as NTFS, about 12% of the partition is pre-allocated as the MFT zone, which is expansion space for the MFT. The MFT is placed at the start of the MFT zone.

***************



As a follow-up, Diskeeper has been going for over 4 hours (and going, and going) to try to defrag my D partition, I guess because it thinks it can't use all that space "reserved for MFT".

Is this a Diskeeper bug? Has anyone else had/solved this problem?

According to the documentation that I've seen, Diskeeper nor supposedly anyone else except NT can write to the MFT area. Files can be moved from it but not into it.

NT will write files into the MFT area if it gets desperate enough for space. Diskeeper will not. Diskeeper will move files out of the MFT space if it can, which may fill up the remaining *free* space (as far as Diskeeper is concerned) and prevent Diskeeper from accomplishing much of anything.

An interesting glitch is that on NTFS partitions that were converted from FAT, NT reserves space for MFT expansion, then ignores the reserved space and puts tiny slivers of MFT in random locations all over the partition, everywhere *except* in the reserved MFT area. This is a weakness of NT. The Diskeeper technical mailing list once discussed how to prevent this, but the workaround is a nuisance and I prefer to just wipe out the partition and start over.

I find that Diskeeper cannot "pack" well. It defragments, performs elementary consolidation and leaves "gaps". Consquently, the next time you add files, they fragment (not all), requiring another defragment which leaves gaps etc. etc.

It will do *some* packing if you schedule it to run every night. Once it get the partition into good shape, it sometimes (apparently randomly) chooses to do a little packing the next time it is run. It never packs things as well as it should though.

[Hunter]

BASICS

When you create a file on NTFS there is always an MFT ( Master file table ) entry associated with it.


The NTFS file system allocates space for each of the MFT records based
upon the cluster size. The attributes of a file are written to the
allocated space in the MFT. Small files and folders, can be contained
entirely within a MFT record. All information for small folders reside
entirely within a MFT record. Large folders are organized into B-trees,
having records with pointers to external clusters containing folder
entries that can not be contained within the MFT structure. The NTFS
file system views each file or folder as a set of file attributes.
Elements such as the file(folder) name, its security info, and even its
data are all file attributes. Each attribute is identified by an
attribute type code and optionally, an attribute name. When a
file's(folder) attributes fit within the MFT file record, they are
called resident attributes.Information such as filename and timestamp
are always included in the MFT file record. When the information for a
file is too large to fit in the MFT record, some of its attributes are
nonresident. The nonresident attributes are allocated one or more
clusters of disk space elsewhere in the volume. NTFS creates the
Attribute List attribute to describe the location of all the rest of the
attribute records.


Horror Story


:)
MFT - Master File Table for NTFS.

Using Diskeeper 3, I checked statistical info on my 3.6GB NTFS
partition. the MFT is about 20 MB - seems acceptable.
There is a catch though. NTFS reserves an ammout of HD space to
be free to allow for the MFT to 'exapnd' The only problem is this
reserved space is TWENTY-FIVE times larger than the actual MFT file
itself.
Yes, NTFS feels it is necessary to allocate over 500 MEGABYTES in
case the 20 meg MFT file expands.
Why is this allocated space so huge?
Diskeeper labeled the region of the HD as 'reserved for MFT'.
Norton Speeddisk labeled the area as unwritable or reserved.
I did some research and appaarantly files can't be written to the
MFT region to prevent the MFT from becoming fragmented - a good
precaution, but 25 times larger than the file is a little extreme I think.

I don't know about other people, but the chief reason I switched
to NTFS was to avoid wasted space. I was sick of 300MG being wasted due
to the 64k cluster sizes. Now, I find out that the MFT is wasting even
more space than FAT ever was!

[Guest_Mtj_*]

Humh... i think i have a problem with the mft.... every time i boot, system gives a message prementioned in this post... not that i could not fix it if i could boot somehow... but I cant even get to safe mode or anything... my system is totally screwed... it just happened one night, had my comp staying on over night and in the morning it was extremely sluggish... when i booted it gave the mtf error and trying to boot in safe mode just crashes the computer after having black screen for 15-30mins. Is there anything which could help my problem?

[TheSentinel]

Heya Mtj

welcome to our forum and we hope you'll enjoy it like many other users, visitors and guests here.

Ok, your problem sounds little bit difficult cause you can't access the system via safe mode.
This error occured on my system when changing the graphics adapter from a NVIDIA card to an ATI one.

I assume your computer is on Win2K or XP. First try to get into the boot menu by pressing F8 during the startup of your system. If it's a fast system press this key frequentely until you see a black screen with white options.

Then chose "Last known working configuration" (or something like that) and wait whats coming up. If the system boots again try to find out what changes have been made. Check if you have installed any new devide drivers or software. Please check your system for viruses, trojans or worms with your installed AV, AT software.
Another possible solution would be defragmentating the HDDs then.

I'm sure we will get your computer back to life :)

Greetz
B. Udo

PS: Please check alll given links in this thread too. I'm sure that MS link will give you some hints to solve that problem too

[TheSentinel]

Hi it's me again

I've goggled a bit for you and could find some interessting links which may help you:

http://hardwareanalysis.com/content/topic/22061/

http://www.majorgeeks.com/vb/showthread.php?t=25433

Hardwareanalysis

Check this links out.... please :)

Greetz
B. Udo

[Guest_Mtj_*]

Thanks for all your answers. Got it fixed by hooking my hd to another comp and cleaning some 100k files from there and defragmenting / chkdisking.
Hardware analysis pages says that problem is probably related to ati radeons...? that is strange... i got my problem after I installed ms office 2k... and did no modifications in drivers, My system is XP. but anyways, thanks works like a dream now.

[TheSentinel]

Morning mtj

I'm glad to hear that your system works well again. But I agree, it sounds rather strange that an installation of Office2K had messed up your system.

You mentioned something about cleaning up 100k of files. Which files and where've them been located? Would be nice if you can give us some more details cause I'm sure there are other users looking for an answer when having the same problem you and I have had.

Sure, ATI device drivers are little bit tricky when being installed. Nearly 90% of all postings I could find (German Goggle searches) did report this. It depends that the Catalyst device driver(s) are making trouble during the installation.

Most reported links did say that it has to do with the memory management of the operating system which get in trouble with the memory allocation of the ATI Catalyst device drivers during the installation. The Catalyst devide drivers do not free the allocated memory after the install.

Oki doki, have a great day and til next time you're in here

Greeeeetz
B. Udo

[Guest_Mtj_*]

I've 120 gb hd and it is partitioned in 3 drives which are 20 g, 50g and 50g.
I had my image archive on drive d, one of 50g drives. the files each were something like 100kb-500kb. mmh what else you need to know... my system, xp2600+ 1g ram, ati radeon 9200 (has worked so far without any problems... though might be the newest drivers causing some problems... my brother downloaded the newest catalyst which after counter strike slowed down a lot and he's having some graphical glitches, he has radeon 9600 xt) epox 9k9ai...
That's all I think...
ta ta

[TheSentinel]

Hey ho mtj :thumb:

Hmm.. You mentioned that latest catalyst device driver for that ATI graphic adapter. I assume this driver has been installed so far. Keep an eye of this dev.-driver... I do not trust it :) and I know why saying this...

You can check the ATI Support for getting more answers !


Have a great day

Greetz
B. Udo

[Guest_Mtj_*]

Aww crap. My comp borke again. I thought I fixed the mft problem but it appeared again when I booted my comp yesterday.

Not much changed in my comp... my friend played gta for sometime and saved the game.... that's all files that were saved during that session.
I have some idea about the problem... maybe it is due my c drive is only 20 g and mft has hiddenly reserved a lot of space?... or so though there's 7g free on c...

And my catalyst drivers aren't the newest.... It's been quite a while when I last updated them. I probably try to uninstall office 2000 next, and report back if it is a success... I'll prolly report in .... 10 hours when my work's over.

[Mtj]

Oh well, I gave up and formatted/reinstalled xp and also partitioned my drives to be in one huge partition. Now a question.... when modifying the register.... which value should i put in NftsMftReseverZone?