Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
As we know, in NTFS we store our metadata in structures called MFT record (which contains some runs).
The book asks the next question
Can it be that a short file uses more MFT records than a longer file?
I think that the answer is no – because if we have a file, whose metadata is more than one MFT’s size, then we have to use runs. Any other suggestions?
The answer is yes.
MFT record (up to NT4 it had 4KB, now it has 1KB) contains file attributes (such as file name, security info, small file data, etc.); some of these attributes can be resident (= attribute header AND attribute data are both located in MFT record), or non-resident (only attrbite header is in MFT, attribute data are stored elsewhere on the disk – eg., data attribute is usually non-resident). Some attributes must remain resident – e.g., file name attribute; some attributes can be resident, or nonresidet – e.g., data attribute.
If you have large file, it means that MFT record contains only attribute header of data attribute, but data are located elsewhere – so even if file is large, it only uses one MFT record; on the other hand, if you have even very small file, but this file has more file names (links), NTFS must allocate more MFT records to accomodate all file name attributes and it can span across many MFT records (using special attribute called attribute list).