file extension MFT

File extension MFT description:

Probably the most important of the key system (metadata) files that define an NTFS volume, the Master File Table or MFT is the place where information about every file and directory on an NTFS volume is stored. The MFT is in essence a relational database table, containing various attributes about different files. It acts as the "starting point" and central management feature of an NTFS volume. It is somewhat analog to the file allocation table in a FAT partition, but is much more than just a list of used and available clusters.

When any file or directory is created on the NTFS volume, a record is created for it within the MFT. The size of each record in the MFT seems to be a matter of some controversy; the best that I can tell is that each record is equal to the cluster size of the volume, but with a minimum of 1,024 bytes and a maximum of 4,096. (Meaning that even if 512 byte clusters are used, each MFT record is still 1,024 bytes, and even if clusters greater than 4,096 bytes are used, each MFT record is limited to 4,096 bytes.) However, some sources say that the size of each MFT record is fixed at either 1,024 or 2,048 bytes.

The system uses these MFT records to store information about the file or directory; this information takes the form of attributes. Since the size of each MFT record is limited, there are different ways that NTFS can store a file's attributes: as either resident attributes that are stored within the MFT record, or non-resident attributes, stored either in additional MFT records or in extents that lie outside the MFT.

Remember that under NTFS, there is no special distinction between the data in a file and the attributes that describe the file. This has an interesting implication for small files. If the amount of space required for all of the attributes of a file, including the data it contains, is smaller than the size of the MFT record, the data attribute will be stored resident - within the MFT record itself. Thus, such files require no additional storage space on the volume, and also do not require separate accesses to the disk to check the MFT and then read the file, which improves performance.

Larger files get more complicated. As additional attributes are added to a file and as the existing attributes are expanded in size, they may no longer fit into the MFT record for the file. If this occurs, the attributes will be moved out of the MFT and be made non-resident by the file system. Large files will have their data stored as external attributes, and very large files may even get so large that the attributes containing pointers to the file data become external attributes themselves! I discuss this nested structuring of files on the page describing NTFS files and data storage.

As more files and directories are added to the file system, it becomes necessary for NTFS to add more records to the MFT. Since keeping the MFT contiguous on the disk improves performance, when an NTFS volume is first set up, the operating system reserves about 12.5% of the disk space immediately following the MFT; this is sometimes called the "MFT Zone". This is a substantial chunk of real estate to reserve, but bear in mind that it is still usable. Regular files and directories will not use this space until and unless the rest of the disk volume space is consumed, but if that occurs, the "MFT Zone" will be used. Eventually, if there are enough entries placed in the MFT, as it expands it will use up the "MFT Zone". When this happens, the operating system will automatically allocate more space elsewhere on the disk for the MFT. This allows the MFT to grow to a size limited only by the size of the volume, but this fragmentation of the MFT may reduce performance by increasing the number of reads required for some files, and the MFT cannot generally be defragmented.

Note: The first sixteen records in the MFT are always reserved for the volume's metadata files.