Master File Table (MFT)

[Guest]

A few True or False questions regarding the MFT in a NTFS formatted partition

(1) The MFT is created during the formatting of a NTFS partition

(2) The MFT is located in the Boot Sector of a NTFS partition

(3) Somewhere else in the NTFS partition there are some identical copy(s)
of the MFT which act as possible backups in case the main MFT becomes
corrupted. If so how many backup copies are there and where are they
generally located in the NTFS partition

(4) When Windows Error Checking tool (CHKDSK) is run, the program simply
compares the MFT (Table of Contents) with the actual files present on the
disk and corrects (updates) the MFT to match the actual files present - the
program does not delete files which were not listed in the MFT - instead the
MFT is updated to include any file ommisions

(5) A so called "Quick Erase" of an NTFS partition simply erases the Boot
Sector of the partition which contains the MFT and nothing else. A "Full
Erase" erases all the remaining data on the partition

(6) There is no way to view, print or copy a MFT using any Windows XP tool.

(7) What third party programs are available to view, print or copy a MFT ??

Thank you for your time

 

[Carey Frisch [MVP]]

MFT Zone
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prkc_fil_xhpo.asp

Master File Table and Metadata Files
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prkc_fil_rpjv.asp

NTFSInfo
http://www.sysinternals.com/ntw2k/source/ntfsinfo.shtml

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Get Windows XP Service Pack 2 with Advanced Security Technologies:
http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx

-------------------------------------------------------------------------------------------

"Howard" wrote:

|A few True or False questions regarding the MFT in a NTFS formatted partition
|
| (1) The MFT is created during the formatting of a NTFS partition
|
| (2) The MFT is located in the Boot Sector of a NTFS partition
|
| (3) Somewhere else in the NTFS partition there are some identical copy(s)
| of the MFT which act as possible backups in case the main MFT becomes
| corrupted. If so how many backup copies are there and where are they
| generally located in the NTFS partition
|
| (4) When Windows Error Checking tool (CHKDSK) is run, the program simply
| compares the MFT (Table of Contents) with the actual files present on the
| disk and corrects (updates) the MFT to match the actual files present - the
| program does not delete files which were not listed in the MFT - instead the
| MFT is updated to include any file ommisions
|
| (5) A so called "Quick Erase" of an NTFS partition simply erases the Boot
| Sector of the partition which contains the MFT and nothing else. A "Full
| Erase" erases all the remaining data on the partition
|
| (6) There is no way to view, print or copy a MFT using any Windows XP tool.
|
| (7) What third party programs are available to view, print or copy a MFT ??
|
| Thank you for your time

 

[Tom Porterfield]

A few True or False questions regarding the MFT in a NTFS formatted partition

(1) The MFT is created during the formatting of a NTFS partition
True.

(2) The MFT is located in the Boot Sector of a NTFS partition

False. It is in the root directory but can be located anywhere on the
partition.

(3) Somewhere else in the NTFS partition there are some identical copy(s)
of the MFT which act as possible backups in case the main MFT becomes
corrupted. If so how many backup copies are there and where are they
generally located in the NTFS partition

There is a mirror of the MFT used for recoverability. This file is also in
the root but can be located anywhere on the partition.

This tool (http://www.sysinternals.com/ntw2k/source/ntfsinfo.shtml) can
show you where the mft and mftmirr are located on the drive.

(4) When Windows Error Checking tool (CHKDSK) is run, the program simply
compares the MFT (Table of Contents) with the actual files present on the
disk and corrects (updates) the MFT to match the actual files present - the
program does not delete files which were not listed in the MFT - instead the
MFT is updated to include any file ommisions

This article (http://support.microsoft.com/?id=314835) describes what
chkdsk does as well as any I've seen.

(5) A so called "Quick Erase" of an NTFS partition simply erases the Boot
Sector of the partition which contains the MFT and nothing else. A "Full
Erase" erases all the remaining data on the partition

Do you mean a quick format? If so then no. The difference between a quick
and full format is that a quick format does not also scan the disk for bad
sectors.

(6) There is no way to view, print or copy a MFT using any Windows XP tool.

Not that I am aware of.

(7) What third party programs are available to view, print or copy a MFT ??

None that I am aware of.
--
Tom Porterfield
MS-MVP Windows
http://support.telop.org

Please post all follow-ups to the newsgroup only.