NTFS: Any idea why ...
 
Notifications
Clear all

NTFS: Any idea why MFT records for big files get their data runs deleted during file delete, but not smaller files ?

6 Posts
3 Users
0 Likes
1,309 Views
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

I have been doing tests (NTFS, Windows10) and as also confirmed by a third party, when I delete a file bigger than let's say 5 GB the data runs in the MFT record are deleted as well (all zeroes).  When I delete a file considerably smaller the data runs stay intact during the delete.

This is for single extent files on a very clean freshly formatted HDD.

Since the complexity of both situation MFTs is practically the same, just more bytes for the single extent file I'm wondering why this is happening.

Perhaps this is one of those big unknowns of the NTFS file system and its drivers but if there is a known reason I'd like to understand. 

Thanks,

This topic was modified 4 years ago by CyberGonzo
 
Posted : 06/07/2020 10:29 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 
Posted by: @cybergonzo

I have been doing tests (NTFS, Windows10) and as also confirmed by a third party, when I delete a file bigger than let's say 5 GB the data runs in the MFT record are deleted as well (all zeroes).  When I delete a file considerably smaller the data runs stay intact during the delete.

This is for single extent files on a very clean freshly formatted HDD.

Since the complexity of both situation MFTs is practically the same, just more bytes for the single extent file I'm wondering why this is happening.

Perhaps this is one of those big unknowns of the NTFS file system and its drivers but if there is a known reason I'd like to understand. 

Thanks,

Isn't this the "switch" that happen around 4 GB?

See here:

http://kcall.co.uk/ntfs/index.html

search for:

"With a larger file, with multiple dataruns, things are different."

and for:

"NTFS treats deletion of files over 4 gb in size in a different way from smaller files, with significant changes to data values."

to find the relevant part on the page.

jaclaz

 
Posted : 07/07/2020 9:46 am
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

Thanks @jaclaz

It involves files with just one data run, so the first search string is less relevant.  The second search string you copied is spot on and it appears the author of the article basically asks the same question I did:

"Why does NTFS do more 'tidying up' on MFT records for large files? I really don't know"

So .. it appears we collectively don't know then.
Thanks for responding.

 
Posted : 07/07/2020 11:17 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Sure :-), the points were:

1) the switch behaviour is around 4 GB[1] (not 5 GB)
2) the behaviour is not an unknown (and it is not "new" to windows 10)

BUT:

3) you are right, the reason why is not known

Let's say that it is a known unknown.

jaclaz

[1] for *some* (different) reasons "changes" in "behaviours" of filesystems et similia tend to occur at even multiples, and 4 GB-1=4294967296-1=4294967295=FFFFFFFF being the max value in 32 bit addressing makes it a common value for such a switch

 
Posted : 07/07/2020 1:58 pm
CyberGonzo
(@cybergonzo)
Posts: 100
Estimable Member
Topic starter
 

@jaclaz

4 GB is indeed an obvious value for the reasons you mention and it is indeed likely the switch.
I wasn't looking for that exact boundary btw, I made my life easy and tested with both 1GB and 5GB files and noticed the 5GB files were deleted in a different manner is all.

 
Posted : 07/07/2020 2:13 pm
(@thefuf)
Posts: 262
Reputable Member
 

When a small file is deleted, its mapping pairs are removed together with the nonresident attribute but without being logged. This is why there is no separate operation to purge mapping pairs.

When a large file is deleted, its mapping pairs are removed in chunks and every operation gets logged and committed. Thus, existing mapping pairs are purged.

Why? It seems that the developers tried to split the work being done (like unsetting bits in the bitmap) when deleting a large file.

 
Posted : 07/07/2020 9:54 pm
Share: