NTFS, broken by design? (was Re: [Full-disclosure] Is this a Virus?)



On Sat, 31 Dec 2005, Geo. wrote:

Actually not. If you fill an NTFS disk with files that are 1K or smaller it
forces the MFT to suck up the whole disk, small files are stored entirely in
the MFT instead of like larger files which have an MFT entry and a data
segment for storage area. Once that happens it's not possible to shrink the
MFT so the disk becomes useless for storing files larger than 1K even though
it shows as 90% empty and at the same time it allows the system to continue
running and spreading the virus.

I believe that the model for NTFS was DEC's ODS-2, used in VAX/VMS, right?

Did/does ODS-2 exhibit this same feature?  ODS-2 didn't store data of small
files in the file headers, as I recall.

Also, has Microsoft change the implementation of "DIR" or the MFT?  I seem
to recall that appropriate flags to DIR would show you $MFT and $MBR and things
like that, but I can't get that to work on the Windows XP boxes available to me.

Booting Knoppix doesn't show me the MFT either, so, what's the scoop?
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Harddisk Capacity in Explorer and Computer Management
    ... 4096 bytes in each allocation units ... 222807485 total allocation units on disk ... 38206405 allocation units available on disk ... Bytes per MFT record: 1024 ...
    (microsoft.public.windowsxp.general)
  • Re: What is "Reserved System Space" and what can I do with it?
    ... Because MFT fragmentation can degrade performance the file system ... preemptively reserves a large contiguous block for the MFT when the ... If the disk runs out of space for files the file system ... drives, or even my one 500 Gbyte drive. ...
    (microsoft.public.windowsxp.basics)
  • Re: "Reserved for MFT"?
    ... Don't forget that the Microsoft Disk Defragmenter is a cut down version ... That second bit of green in the middle of the disk is the MFT Mirror. ... You may have noticed that the MFT always has at least two fragments; ...
    (microsoft.public.windowsxp.newusers)
  • Re: "Reserved for MFT"?
    ... Don't forget that the Microsoft Disk Defragmenter is a cut down version of an earlier version of Diskeeper. ... The first dozen or so blocks of the MFT are critical; if you lose them, you lose everything on the drive. ... You may have noticed that the MFT always has at least two fragments; you can't get it to one fragment. ...
    (microsoft.public.windowsxp.newusers)
  • Re: defragmenting question
    ... $MFT is a special NTFS file called the Master File Table. ... > To optimize performance I defragment periodically with Norton Speed disk. ... > blocks start appearing again (after defragmenting!). ...
    (microsoft.public.win2000.general)