Hacker News new | ask | show | jobs
by jaclaz 1648 days ago
Not really.

First thing the middle of the volume/partition is not the middle of the disk in any multi-partitioned disk, then NTFS $MFT is not (and never has been) in the middle of the partition, its location varies depending on the size of the volume/partiton but above a certain size, around 5/6 GB it is at a fixed offset, usually on LCN #786432 which - on a normal 8 KB/cluster NTFS volume - amounts to offset 6,291,456 sectors or 6,442,450,944 bytes, rarely the middle of the volume, unless its size is around 13 GB.
1 comments
fuzzfactor 1647 days ago
Have you found the difference between formatting NTFS in older Windows versions compared to the recent releases?

Seems to me the MFT was in the middle of volumes commonly in older versions, and lately much closer to the beginning of the volume.

Could have something to do with the feature of shrinking a volume which became more common, and you can now more often shrink an NTFS volume by more than half, which was often impossible in earlier years.

link
jaclaz 1647 days ago
I have not enough data/experience for more recent Windows versions, but at least up to 7 (and starting from Windows 2000, the NTFS in NT 3.51 and 4.00 had some differences) the MFT start address is variable up to a certain volume size (as said if I recall correctly the switch to "fixed" is between 5 and 6 GB.

If you "think in hex" the address is in the PBR expressed in clusters (VCN) as "0xC0000" (at offset 0x30 or 48 dec you should find "00000C000000000"), which is a nice, round number.

Maybe you remember the "old" NTFS format (NT 3/4) where the mirror of the bootsector (aka $BootMirr, not the $MFT)was exactly in the middle of the volume, but since Windows 2000 this copy of the first sector of the PBR was moved in the "gray zone" at the end (inside the partition but outside the volume[1]).

As a side note (and JFYI) thanks to (from 7 onwards) NTFS resizing capabilities it is possible to "force" the $MFT to very early sectors, see this only seemingly unrelated thread here:

http://reboot.pro/index.php?showtopic=18022

[1] some info on the matter in this other, as well seemingly unrelated, thread:

http://reboot.pro/index.php?showtopic=18034

link
rzzzt 1645 days ago
HPFS definitely put the root directory in the "seek center": http://spider.seds.org/spider/OS2/HPFS/dirs.html

This now makes me wonder whether the middle disk block (numerically) is equal "seek times" away from disk edges.

link