How Defragmenters Work

---

Usually, defragmentation programs check each file on a disk to determine which files should be defragmented and which files should be moved to another location to provide more contiguous free space. If a file is to be moved online, then the defragmenter uses special applications programming interfaces (APIs), known as IOCTLs (input/output controls), that work in harmony with the file system to accomplish defragmentation safely. This special MoveFile API makes a contiguous copy of the file on the disk to the location specified by the defragmenter. Next, the MoveFile API changes the pointers to that file to point to the new contiguous copy of the file. Finally, the disk space of the original fragmented file is deallocated, but only after successful completion of the prior cycles. All this is conducted online by current-day defragmenters; files can be defragmented in the background, usually running at low priority so as not to tax overhead. As a result, the system does not have to be shut down.

Two file types in the operating system cannot be defragmented online using the special APIs. These are the paging file and, on NTFS, the MFT. On Windows NT 4.0, the directories also cannot be defragmented online. In Windows 2000, though, the APIs have been enhanced to move directories safely online during defragmentation. On XP, the APIs have been further enhanced to also permit online defragmentation of the MFT.

---