Empty MFT om NTFS Drive - how can I delete it?

[foxzzy]

I have nTFS drives that work properly, only whenever I re-boot, the MFT grows HUGE - and it completely empty.

How do i stop that from happening. i have used Revo Uninstaller, it will remove it , but the next time i reboot, the MFT is back to huge again.

Any one got a solution for me - Thank You..

[vinifera]

if those are more than 1 phisical drives, why not unplug the empty one
let the OS use occupied one, then turn off pc, end re-plug ?

 

[foxzzy]

I guess I should have said these drives are all on one disc - and only one of the drivesdoes that....

[vinifera]

i have seen this happen in past to me aswell
had 1 main partition and 2nd was just random stuff

but i think that 2nd mft is just reserved space, its not in use
and i think (not sure as it was quite long ago), but ithink OS does this when it has no space on system drive

 

[foxzzy]

I have no clue - my system drive has  a lot of free space, so, just do not know why.. Thanks

[jaclaz]

How big is the volume?

How big is the $MFT?

Have you tried defrafmenting the $mft with Sysinternal's contig?

Is that the System (or Boot) volume or just a data volume?

jaclaz

 

 

[foxzzy]

How big is the volume? - 232 GB

How big is the $MFT? - on disk 3 it is about 19 GB

Have you tried defrafmenting the $mft with Sysinternal's contig? - Yeah, I ran sysinternals, it gets rid of it - but when I reboot it is right back

Is that the System (or Boot) volume or just a data volume? - on the third Data volume

 

 

[jaclaz]

A tool that is often used to check that size is Sysinternals NTFSinfo.

Example data from a couple volumes of mine (NTFSinfo), same size 320 GB, this is a "system" volume with a zillion little files:

MFT Information
---------------
MFT size               : 546 MB (0% of drive)
MFT start cluster      : 786432
MFT zone clusters      : 59059648 - 68687552
MFT zone size          : 37609 MB (12% of drive)
MFT mirror start       : 39070076

And this is a "data only" volume:
 

MFT size               : 111 MB (0% of drive)
MFT start cluster      : 786432
MFT zone clusters      : 48915648 - 49332416
MFT zone size          : 1628 MB (0% of drive)
MFT mirror start       : 39070076

These are volumes of exactly the same size, on two identical disk drives, used in a very different manner for a few years, you can see the noticeable difference in $MFT size. 

What happened in your case, most probably , is that over time you wrote and deleted on that volume a large number of files, and most (if not all) $MFT defragmenter/cleaners do actually defragment/clean, but they do not "shrink" the $MFT, which remains "of increased size", see:
https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table?

Quote

As files are added to an NTFS file system volume, more entries are added to the MFT and the MFT increases in size. When files are deleted from an NTFS file system volume, their MFT entries are marked as free and may be reused. However, disk space that has been allocated for these entries is not reallocated, and the size of the MFT does not decrease.

AFAIK there is (or was) only a single (BTW commercial) tool from Paragon that allowed to "compact" the $MFT once the entries were emptied/cleaned, see page 21 here:

https://www.paragon-software.com/docs/TD2009_Manual.pdf

the tool (or its successors) does not exist anymore: 

https://kb.paragon-software.com/article/1807

but the function is in the hard disk manager:
https://www.paragon-software.com/home/hdm-windows/

no idea if the trial of the old thing allows that :
https://www.softpedia.com/get/System/Hard-Disk-Utils/Paragon-Total-Defrag.shtml

There are "rumours" that if you fill the disk up to the brim (adding a single or very few very large files), the NTFS will try to reduce the (unused) $MFT areas, but I have no real confirmation.

Since it is only a data volume, it might be worth a try to do that experiment (of course after having made a copy of the data), otherwise it would make sense to copy the data to an external disk, re-format the volume and copy back the data, a 232 GB volume, not completely filled should be all in all a matter of a few hours.

If you want to try the "fill up to the brim" experiment, get the dsfok toolkit:

https://web.archive.org/web/20190910101150/http://members.ozemail.com.au/~nulifetv/freezip/freeware/dsfok.zip

and use fsz:

Quote

3) fsz

fsz can be used to create a file or truncate/extend an existing one.
No file size limits (on NTFS).

Usage: fsz file size (in bytes, no limits - be careful)
Example: fsz data.fil 15773

jaclaz

[foxzzy]

I'm not gonna look at this anymore, too much of a hassle when all is working fine.

Thanks for your assist - it is appreciated..