Disk Defragmenter

When an operating system stores data on a hard disk, it places that information in the first available "hole" it can find that isn't already occupied by another file. If the disk already contains several other files, however, that location might not be large enough for the complete file. When this happens, the operating system places as much of the file as it can in the space available and then searches for another open hole for the balance of the file. This process continues until the entire file has been written to disk. Any files not written to a contiguous disk location are considered "fragmented."

The problem with fragmentation is that it slows down the rate at which your hard disk can retrieve information and supply it to the requesting program. Hard disks remain largely mechanical devices and are governed by the laws of physics. To access files stored on a disk, the drive must physically move a small arm to the correct location on a spinning platter. These movements are measured in milliseconds, but milliseconds add up, especially when a file is spread over a hundred unique locations.

Fragmentation is not always a bad thing. If an operating system had to find a contiguous section of disk space for each and every file it stored, as your drive filled, your system would slow. Eventually, your system would reach a point where the disk still had ample free space, but none of this space would be in contiguous blocks big enough to hold a file.

Disk Defragmenter addresses this fragmentation problem by reorganizing all the files on your hard disk so that they are stored as complete units on a single area of the disk. To do so, it identifies any remaining free areas, moves small files there to open up more space, and uses this newly opened space to consolidate larger files. This shuffling process repeats until all the files are shuffled around in this manner and the entire disk is defragmented.

The MFT

NTFS contains, at its core, a file called the master file table (MFT). It is similar to the file allocation table in the FAT system. At least one entry exists in the MFT for every file on an NTFS volume, including the MFT itself. The MFT also contains extended information about each file, such as its size, time and date stamps, permissions, data content, and so forth.

As you add more files to an NTFS volume, the number of entries to the MFT grows. When files are deleted from an NTFS volume, their MFT entries are marked as free and may be reused, but the MFT does not shrink. Thus, space used by these entries is not reclaimed from the disk.

NTFS preallocates a specific amount of the volume for storage of the MFT and, in an effort to ensure high performance, tries not to fragment it. NTFS also does its best to allocate free space on the disk intelligently. If you are running low on disk space, it relinquishes reserved and unused MFT areas for your files. If the MFT is running low, it grabs space from the file area for more entries. As you would expect, if you have a large number of files, the MFT becomes larger. If you have a small number of files, the MFT is smaller.

Here's the rub: If you try to pack a zillion files onto an NTFS volume (I can't give you an exact number because it will vary based on volume and file size), and you run out of disk space, you could exhaust the MFT, which can result in a major bummer when the directory table for the volume blows up. You get no warning. If you intend to store a huge number of small files on an NTFS partition, and you think you might unexpectedly run out of room on the volume, you should consider a Registry hack that preallocates more room for the MFT by adding a value to the Registry.

Caution: This procedure modifies the Registry. Do I have to remind you to back up the Registry first? If you aren't a Registry whiz already, be sure to read Chapter 32, "The Registry," before trying this operation.

To add this value, perform the following steps:

1.	Run the Registry Editor (Regedt32.exe), and go to the following subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem
2.	From the Edit menu, choose New, DWORD value.
3.	Type the name of the new value entry as NtfsMftZoneReservation.
4.	Double-click on this new value entry to open the Edit DWORD Value dialog box. Provide value data for this new value entry. NtfsMftZoneReservation is a REG_DWORD value that can take on a value between 1 and 4, where 1 corresponds to the minimum MFT zone size and 4 corresponds to the maximum. The sizes are not absolute. You might have to experiment with the sizing to determine what is best for you. Microsoft supplies no specific details about the number of file entries available under each size.
5.	Close the Registry Editor, and restart your computer.

Keep in mind that this is a runtime parameter and it does not affect the format of a volume. Rather, it affects the way NTFS allocates space on all volumes on a given system. Therefore, to be completely effective, the parameter must be in effect from the time a volume is formatted throughout the life of the volume.

For more information, check the following URL:

http://support.microsoft.com/support/kb/articles/Q174/6/19.ASP

Or, search the Microsoft Knowledgebase for article 174619.

TIP

Defragmenting a large drive with many files on it can take a lot of time. Let the Task Scheduler handle it because it can run at night when you're not around and don't need access to your hard disk drive. However, the defragmenter included with Windows XP cannot be automated. You'll need to purchase a full-blown commercial defragmenter to take advantage of automated scheduling. I've had great success with Symantec's Norton Speed Disk, which is a part of SystemWorks (www.symantec.com) and Executive Software's Disk Keeper (www.execsoft.com). By the way, the native Windows XP defragmenter is a limited version of Disk Keeper.

When should you defragment your drive? In reality, because today's drives are so fast, you're not likely to notice slowdowns unless you're using very large data files, or you use the same files and/or applications regularly, which can fragment them. For typical users who are hopping around between programs, creating new files, and deleting files on a regular basis, the average access times they experience with a drive will be acceptable, even when fragmented.

If you start to notice a general hard disk access slowdown, the first thing to suspect is a RAM shortage, or that you have too many files open and your drive's pagefile is being hit too much (that is, swapping is going on). After ruling that out, however, take a trip down defrag lane. Run the program, and it will tell you whether your drive is fragmented enough to make it worth your time to defragment.

Running Defrag

To run Disk Defragmenter, follow these steps:

1.	Select Disk Defragmenter from the Storage section of Computer Management.
2.	Click to select a drive in the list of volumes.
3.	Click the Analyze button. In a few minutes, the result of the analysis will appear. You'll see a screen like the one shown in Figure 29.5. Figure 29.5. Running Defrag's analysis on a drive indicates whether you would net any advantage from defragmenting.
4.	Click the View Report button if you're the curious type. You can really get into the numbers here, viewing statistics about the drive, and checking to see where the maximum fragmentation is occurring, the number of fragments, the file sizes, and so on. Figure 29.6 shows an example from my hard disk. You can save the report or print it, if you like. Figure 29.6. Details of a defrag analysis can be helpful in determining where most of your fragmentation is occurring. Scroll the top pane, and check to see whether your pagefile is fragmented. Typically, it won't be, but if it is, this is a good reason to defragment.
5.	If you decide to go ahead and defragment, click the Defragment button and get ready to wait. As the defragmenting progresses, you'll see the progress reported across the bottom graph in the window. The graphic display slowly becomes primarily blue, indicating that most files are now contiguous. You will see some areas of green, indicating system files (possibly a large area if a pagefile is on the drive). You might have some small areas of fragmentation left over as well. The leftover fragmentation is due to this being a free defragmentation tool, which does not include high-level defragmentation techniques, or due to the files being open and locked, thus unable to be moved by the tool.