filentfsntfs-mft

Can a short file uses more MFT records than a longer file?


As we know, in NTFS we store our metadata in structures called MFT record (which contains some runs).

The book asks the next question

Can it be that a short file uses more MFT records than a longer file?

I think that the answer is no - because if we have a file, whose metadata is more than one MFT's size, then we have to use runs. Any other suggestions?


Solution

  • The answer is yes.

    MFT record (up to NT4 it had 4KB, now it has 1KB) contains file attributes (such as file name, security info, small file data, etc.); some of these attributes can be resident (= attribute header AND attribute data are both located in MFT record), or non-resident (only attrbite header is in MFT, attribute data are stored elsewhere on the disk - eg., data attribute is usually non-resident). Some attributes must remain resident - e.g., file name attribute; some attributes can be resident, or nonresidet - e.g., data attribute.

    If you have large file, it means that MFT record contains only attribute header of data attribute, but data are located elsewhere - so even if file is large, it only uses one MFT record; on the other hand, if you have even very small file, but this file has more file names (links), NTFS must allocate more MFT records to accomodate all file name attributes and it can span across many MFT records (using special attribute called attribute list).