Moving the beginning of a Partition

[jaclaz]

I've just done the test again with a 100GB and a 1.7TB volume, with two different cluster sizes: 4KiB and 64KiB. The offset of the MFT and the size of the MFT zone are insensitive to cluster size; in UltraDefrag the MFT remains at a fixed position.

If the start location would be fixed at cluster #786432, then with increasing clustersize, the start location would shift closer to the "end" of the volume, but that is clearly not so in my case. I did the test in Win7.

Do you have the time and infrastructure to try to reproduce my findings, jaclaz?

johan

I guess there is a misunderstanding.

I am not saying that a same volume size with different cluster size will always hold the $MFT @#786432.

I am saying that the *normal*, default NT format will tend to create the $MFT @#786432, or, if you prefer, that *all* NTFS volumes/bootsectors I ever examined had the $MFT @#786432 in the bootsector field, starting form a certain size.

It is very possible that this "fixed address" behaviour is not cluster #786432 x 4 kb (default cluster size for a rather largish range of volume size):

http://support.microsoft.com/kb/140365/en-us

but rather offset 786432 x 4096=3,221,225,472 or sector 6,291,456

and that this is not affected by cluster size.

You can check this directly (instead of using Ultradefrag) by checking the 16 bytes @offset 0x30 in the bootsector and multiplying for cluster size (single byte @offset 0xD) or using (as an example) tiny hexer that has a built in Structure Viewer for NTFS bootrecord (and optionally using my INCOMPLETE - but working for theis NTFS fielsds - one):

http://reboot.pro/8734/

jaclaz

[DiracDeBroglie]

Aaahaaa. Ok then, now we're getting somewhere. It is not cluster #786432, but it should be DEFAULT cluster #786432, which disconnects the number #786432 from the user's choice of cluster size. So in my case 786432 X 4096 = 3.22GB(decimal), and that 3.2GB is what I saw all the time, whatever cluster size I took during formatting.

I am not sure, but I think I understand why the number #786432 was picked, and not any other number. The cluster sizes are 4KiB, 8, 16, 32, and 64KiB. Dividing those numbers by 4KiB gives you: 1, 2, 4, 8, and 16. Dividing 786432 by 1, 2, 4, 8, and 16 always gives you an integer; in other words, putting the beginning of the MFT at default cluster #786432 means means that the beginning of the MFT is always "aligned" with whatever the user's choice of cluster size. Hence the MFT will never start within a cluster, whatever the user's cluster size. Every number derived from 786432 by dividing (or multiplying) it by 2 would do the job too. When testing Partition Wizard I noticed PW puts the MFT at the very beginning of the volume (almost no offset), so at a default cluster number that was a lot smaller than #786432.

For *user* cluster sizes below the default cluster size, I think any number could be used, even if it cannot be divided by 2, because the issue of "alignment" doen't raise itself.

Still have to do some digging with tiny hexer.

Johan

[jaclaz]

I am not sure, but I think I understand why the number #786432 was picked, and not any other number. The cluster sizes are 4KiB, 8, 16, 32, and 64KiB. Dividing those numbers by 4KiB gives you: 1, 2, 4, 8, and 16. Dividing 786432 by 1, 2, 4, 8, and 16 always gives you an integer; in other words, putting the beginning of the MFT at default cluster #786432 means means that the beginning of the MFT is always "aligned" with whatever the user's choice of cluster size. Hence the MFT will never start within a cluster, whatever the user's cluster size. Every number derived from 786432 by dividing (or multiplying) it by 2 would do the job too.

Well, actually 786432 is a reather largish number to have those properties.

64x1024=65536 would do as well.

If I recall correctly (though not as low as the above) wWin2K used a much lower address for the $MFT.

As I posted earlier (corrected, there was a lapsus calami), on an 8 Gb volume in XP the MFT goes to

You will have 4Kb clusters and $MFT @cluster #786432

Re-format with 512 byte cluster and you will get $MFT @ cluster #6291456

Re-format with 1024 byte cluster and you will get $MFT @ cluster #3145728

Re-format with 2048 byte cluster and you will get $MFT @ cluster #1572864

And we have:

786432*8=6291456

6291456*1=6291456

3145728*2=6291456

1572864*4=6291456

Quick test just made:

Image   Bytes/  Sectors/     $MFT      $MFT Offset
size	Cluster	Cluster     Cluster     (sectors)
1 Gb    1024        2        349525	699050
2 Gb    2048        4        524288	2097152
3 Gb    4096        8        262144	2097152
4 Gb    4096        8        262144	2097152
5 Gb    4096        8        262144	2097152
6 Gb    4096        8        786432	6291456

The "switch" is between 5 and 6 Gb.

jaclaz

Edited February 14, 2012 by jaclaz