News for hackers. Stuff that matters.
Re:Defrag Like It's 1993 by ygra on Friday December 17, 2021 @06:35AM (#29590839)
I remember that being a reason why the MFT in NTFS is positioned in the middle of the drive so that on average the head has to travel less. And NTFS also supports putting small file contents directly into the MFT entry, which also cuts down on head movement. Nowadays all that probably is moot and a relic from ancient times (although I still have enough hard drives running at home).
Re:Defrag Like It's 1993 by jaclaz on Friday December 17, 2021 @07:53AM (#29591464)
Not really.

First thing the middle of the volume/partition is not the middle of the disk in any multi-partitioned disk, then NTFS $MFT is not (and never has been) in the middle of the partition, its location varies depending on the size of the volume/partiton but above a certain size, around 5/6 GB it is at a fixed offset, usually on LCN #786432 which - on a normal 8 KB/cluster NTFS volume - amounts to offset 6,291,456 sectors or 6,442,450,944 bytes, rarely the middle of the volume, unless its size is around 13 GB.

Re:Defrag Like It's 1993 by fuzzfactor on Saturday December 18, 2021 @01:57AM (#29602375)
Have you found the difference between formatting NTFS in older Windows versions compared to the recent releases?

Seems to me the MFT was in the middle of volumes commonly in older versions, and lately much closer to the beginning of the volume.

Could have something to do with the feature of shrinking a volume which became more common, and you can now more often shrink an NTFS volume by more than half, which was often impossible in earlier years.

Re:Defrag Like It's 1993 by jaclaz on Saturday December 18, 2021 @04:55AM (#29603278)
I have not enough data/experience for more recent Windows versions, but at least up to 7 (and starting from Windows 2000, the NTFS in NT 3.51 and 4.00 had some differences) the MFT start address is variable up to a certain volume size (as said if I recall correctly the switch to "fixed" is between 5 and 6 GB.

If you "think in hex" the address is in the PBR expressed in clusters (VCN) as "0xC0000" (at offset 0x30 or 48 dec you should find "00000C000000000"), which is a nice, round number.

Maybe you remember the "old" NTFS format (NT 3/4) where the mirror of the bootsector (aka $BootMirr, not the $MFT)was exactly in the middle of the volume, but since Windows 2000 this copy of the first sector of the PBR was moved in the "gray zone" at the end (inside the partition but outside the volume[1]).

As a side note (and JFYI) thanks to (from 7 onwards) NTFS resizing capabilities it is possible to "force" the $MFT to very early sectors, see this only seemingly unrelated thread here:

http://reboot.pro/index.php?showtopic=18022

[1] some info on the matter in this other, as well seemingly unrelated, thread:

http://reboot.pro/index.php?showtopic=18034

Re:Defrag Like It's 1993 by rzzzt on Monday December 20, 2021 @02:35AM (#29622308)
HPFS definitely put the root directory in the "seek center": http://spider.seds.org/spider/OS2/HPFS/dirs.html

This now makes me wonder whether the middle disk block (numerically) is equal "seek times" away from disk edges.