Increase XP NTFS performance

by John Sheesley

Takeaway: Make the NTFS perform faster and more efficiently.

A lot of things go into making a workstation operate at peak performance. Much of it, such as the amount of RAM in the system, the CPU speed, or the speed of the system's hard drive, is hardware-controlled. However, there are other aspects of the operating system that can impact system performance as well.

One of the mechanisms that can greatly affect a workstation's efficiency is the file system used by the operating system to save files. If the file system is inefficient, then no matter how fast a CPU or hard drive is, the system will waste time retrieving data. XP's default file system, NTFS, is more efficient than Windows 9x's old FAT system under normal circumstances, but you can do more to make it even faster.

---

Danger!
This article discusses making changes to your server's registry. Before using any technique in this article, make sure you have a complete backup of your workstation. If you make a mistake when making changes to your workstation's registry, you may cause your server to become unbootable, which would require a reinstallation of Windows to correct. Proceed with extreme caution.

---

NTFS vs. FAT
NTFS has been around since Microsoft introduced the first version of Windows NT. Its goal was to overcome the limitations of the venerable FAT file system, which had been around since the first version of DOS in 1981. Some of the key benefits of NTFS over FAT include:

• Smaller cluster sizes on drives over 1 GB
• Added security through permissions
• Support for larger drive sizes
• Better fault tolerance through logging and striping

Windows XP supports both NTFS and FAT, as well as FAT's newer cousin, FAT32. Chances are that you'll never see an XP workstation running the FAT-related file systems. About the only time you'll find FAT on an XP workstation is if someone upgraded a Windows 9x workstation to Windows XP and didn't convert the file system.

Last access time stamps
XP automatically updates the date and time stamp with information about the last time you accessed a file. Not only does it mark the file, but it also updates the directory the file is located in as well as any directories above it. If you have a large hard drive with many subdirectories on it, this updating can slow down your system.

To disable the updating, start the Registry Editor by selecting Run from the Start menu, typing regedit in the Open text box, and clicking OK. When the Registry Editor window opens, navigate through the left pane until you get to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Filesystem

In the right pane, look for the value named NtfsDisableLastAccessUpdate. If the value exists, it's probably set to 0. To change the value, double-click it. You'll then see the Edit DWORD Value screen. Enter 1 in the Value Data field and click OK.

If the value doesn't exist, you'll need to add it. Select New | DWORD Value from the Edit menu. The new value will appear in the right pane, prompting you for a value name. Type NtfsDisableLastAccessUpdate and press [Enter]. Double-click the new value. You'll then see the Edit DWORD Value screen. Enter 1 in the Value Data field and click OK. When you're done, close Regedit. Your registry changes will be saved automatically. Reboot your workstation.

The Master File Table
The Master File Table (MFT) keeps track of files on disks. This file logs all the files that are stored on a given disk, including an entry for the MFT itself. It works like an index of everything on the hard disk in much the same way that a phone book stores phone numbers.

NTFS keeps a section of each disk just for the MFT. This allows the MFT to grow as the contents of a disk change without becoming overly fragmented. This is because Windows NT didn't provide for the defragmentation of the MFT. Windows 2000 and Windows XP's Disk Defragmenter will defragment the MFT only if there's enough space on the hard drive to locate all of the MFT segments together in one location.

As the MFT file grows, it can become fragmented. Fortunately, you can control the initial size of the MFT by making a change in the registry. Making the MFT file larger prevents it from fragmenting but does so at the cost of storage space. For every kilobyte that NTFS uses for MFT, the less it has for data storage.

To limit the size of the MFT, start the Registry Editor by selecting Run from the Start menu, typing regedit in the Open text box, and clicking OK. When the Registry Editor window opens, navigate through the left pane until you get to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Filesystem.

In the right pane, look for the value named NtfsMftZoneReservation. If the value doesn't exist, you'll need to add it. Select New | DWORD Value from the Edit menu. The new value will appear in the right pane, prompting you for a value name. Type NtfsMftZoneReservation and press [Enter]. Double-click the new value. You'll then see the Edit DWORD Value screen.

The default value for this key is 1. This is good for a drive that will contain relatively few large files. Other options include:

• 2—Medium file allocation
• 3—Larger file allocation
• 4—Maximum file allocation

To change the value, double-click it. When the Edit DWORD Value screen appears, enter the value you want and click OK. Unfortunately, Microsoft doesn't give any clear guidelines as to what distinguishes Medium from Larger and Maximum levels of files. Suffice it to say, if you plan to store lots of files on your workstation, you may want to consider a value of 3 or 4 instead of the default value of 1.

When you're done, close Regedit. Your registry changes will be saved automatically. Reboot your workstation. Unlike other registry changes, which take place immediately for maximum benefit, NtfsMftZoneReservation works best on freshly formatted hard drives. This is because XP will then create the MFT in one contiguous space. Otherwise, it will just modify the current size of the MFT, instantly fragmenting it. Therefore, it's best to use this if you plan to have one drive for data and another for applications.

Short filenames
Even though NTFS can support filenames with 256 characters in order to maintain backward compatibility with DOS and Windows 3.x workstations, Windows XP stores filenames in the old 8.3 file format as well as its native format. For example, if this article is named "Increase XP NTFS performance.doc," Windows XP will save this file under that filename as well as INCREA~1.DOC.

To change this in the registry, start the Registry Editor. When the Registry Editor window opens, navigate through the left pane until you get to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Filesystem

In the right pane, look for the value named NtfsDisable8dot3NameCreation. If the value exists, it's probably set to 0. To change the value, double-click it. In the Edit DWORD Value screen, enter 1 in the Value Data field and click OK.

If the value doesn't exist, you'll need to add it. Select New | DWORD Value from the Edit menu. The new value will appear in the right pane, prompting you for a value name. Type NtfsDisable8dot3NameCreation and press [Enter]. Double-click the new value. You'll then see the Edit DWORD Value screen. Enter 1 in the Value Data field and click OK. When you're done, close Regedit. Your registry changes will be saved automatically. Reboot your workstation.

Other ways to speed drive access
There are other ways to speed drive access that aren't NTFS-specific. These include:

• Caching—If your XP workstation has more than 256 MB of RAM, you might be able to increase hard drive access speeds by tweaking the amount of RAM cache that XP uses. For more information about how to do this, see the article "Squeeze more performance out of Windows XP with CachemanXP 1.1."
• Striping—If you have more than one hard drive on your system, you can use XP's striping feature to have the file system store data across multiple drives. This feature works best with SCSI drives, but it can work with multiple ATA drives as well. You'll make the change using the Logical Disk Management service in the Computer Management utility.
• Defragmenting—Even though NTFS is more resistant to fragmentation than FAT, it can and does still fragment. You can either use XP's built-in defragmenter or a third-party utility such as Diskeeper.
• Disable Compression—Compressing files may save space on your workstation's hard drive, but compressing and decompressing files can slow down your system. With the relative low cost of hard drives today, investing in an additional hard drive is better than compressing files on a workstation.

Recover lost data with Disk Commander

by Brien M. Posey MCSE

Takeaway: When a user mistakenly deletes a file, suffers a hard drive failure, or corrupts their OS, you need a tool to recover their data quickly and successfully. Find out why Disk Commander is one of the best data recovery tools available.

Disk Commander from Winternals Software is one of the most comprehensive data recovery products that I've ever used. Disk Commander helped me bail out myself and my end users in several tough situations. It allowed me to recover data I thought was lost forever. No help desk should be without this tool.

File recovery and a whole lot more
Unlike many disk recovery utilities, Disk Commander isn't a deleted file recovery utility (although it can recover deleted files). Instead, the utility actually reconstructs damaged files. It can also rebuild a corrupt partition and recover data from a formatted hard disk, even if the disk is unbootable. While many other disk recovery utilities limit you to recovering data from a single hard disk, Disk Commander allows you to recover data from stripe sets, mirror sets, and volume sets. The only prerequisite is that the hard disk must be physically functional. If the disk has a problem, such as a dead motor, Winternals recommends shipping the drive to a data recovery lab.

Disk Commander offers flexible installation. You can install it on a functioning hard disk, run it from a set of boot floppies, or run it from a floppy disk at a DOS prompt (Figure A).

Figure A

However, only running from a set of boot floppies gives you access to the product's full functionality. The hard disk installation and the DOS installation are both subject to restrictions of the underlying operating system. For example, when run from DOS, long filenames aren't supported and neither are normal RAID devices.

Using Disk Commander
Disk Commander is fairly simple and straightforward to use. The software wizard asks you several questions about your data recovery needs. You'll begin by selecting the drive letter associated with the damaged hard disk. You can then choose to try to salvage deleted files. If you need to perform any other type of repair on the volume, you must tell Disk Commander that no drive letter is associated with the hard disk.

Next you must tell Disk Commander whether you want to recover regular and damaged files or files that have been deleted from the partition. If you choose to salvage deleted files, Disk Commander scans the hard disk for anything that can be recovered. It will then present you with a directory tree style view of salvageable files (Figure B). You must then select which files you want to recover along with a location for Disk Commander to copy those files to.

Figure B

If you tell Disk Commander that the damaged hard disk (or partition) doesn't have a drive letter, Disk Commander performs a thorough scan of the hard drive. The scan might take a while to complete, but the results are worth the wait.

When the scan completes, Disk Commander will show you a report of the disk's partition scheme. The wizard then asks you whether the partition scheme accurately displays what should be on the disk. If you answer No, it will launch a more thorough scan, which can take an entire day to complete. At the end of the scan, Disk Commander will display a graphical representation of the partition table, including missing partitions and volumes.

You may then select an area of the partition table and an action, and then click Next to perform the action. For example, you could select a damaged partition and click the Recover Entry button. Or you could select a damaged master boot record (MBR) and click the Rewrite MBR button. Also, the software includes a Volume Details button that allows you to gain detailed information on a partition or volume you're about to repair, which is a nice touch.

Before executing any instruction that will modify the partition table, Disk Commander gives you the chance to copy the partition table to a floppy disk. That way, you can revert the system to its current state should you make a mistake that damages the partition table more than it was.

Well worth the cost
While there are plenty of other data recovery tools out there, each technique you use unsuccessfully decreases your chances of a successful recovery through another method. Most disk recovery utilities modify the data on the hard disk, and once a utility has modified the already damaged hard disk, it becomes that much tougher for another utility to pick up the pieces. So, if your data is important to you, I recommend spending a few bucks for Disk Commander instead of risking further damage to your data with a lower-budget data recovery utility.

Disk Commander is designed to work on a system with Windows 9x, NT, 2000, XP, or Me—although the operating system doesn't have to be functional. You can buy a copy of Disk Commander for $299 directly from Winternals Software. Volume licensing discounts are also available.