Microsoft MFT bug allows any user with write permissions to effectively destroy your entire NTFS volume, forcing you to reformat.
0a2ad46a467d9764ce3eb4ad8d020a9f43fe4a4b55cdf1e28b5a0e22c1a14b81
Date: Tue, 27 Apr 1999 18:26:54 +0400
From: Vladimir Dubrovin <vlad@sandy.ru>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: MFT problem
Hello NTBUGTRAQ,
Sorry for my bad English...
Some times ago it was noticed the problem with MFT. I don't know if
this problem was discussed in this list, so if it is - just discard
this message.
The problem is:
Then creating a very large number of empty files on NTFS partition and
then removing this files you loose a lot of space (up to 90% of
volume!) and you couldn't recover this space without reformatting the
NTFS volume. This problem occurs because NT allocates space in MFT
(Master File Table, an internal NTFS database). Then the MFT reserved
space ends NT allocates new space for MFT. The space allocated for MFT
will never be released. (information "How NTFS Reserves Space for its
Master File Table (MFT)" can be found in KB article Q174619).
Then creating empty file (with zero length) it takes disk space
olny in directory entry and MFT table. If you'll fill your NTFS volume
with such files and then delete them the MFT table will take the most
of your hard drive space (up to 90% as it was noticed before).
You can reproduce this problem next way:
It's better to use empty NTFS volume of small size - 50-100Mb - the
results will be more distinctive.
Check the free space on your NTFS volume.
md temp
for /L %i in (1,1,1000000) do type nul >temp/file.%i.tmp
then you fill all the partition with this files - abort the circle.
del /Q temp\*.*
del /Q temp
Now you can check free space on your hard drive. You've loosed it
almost completely...
By the way: it seems
dir /A $MFT
doesn't shows real MFT size, as it described in Microsoft
documentation. At least you will never find the space you've loosed in
any special file. But you can try some other utility, such as
defragmentation utilities - usually they shows MFT reserved space...
The problem is, that any user, who has "create" permition in any
directory on NTFS volume can bring this volume down.
It's specially interesting if your FTP server has "incoming"
directory, or you offer free HTML pages for your customers on NTFS
volume...
This problem isn't solvable with some kind of disk quotas,
because the files are empty...
I've contacted Vitaly Savenkov from Russian department of Microsoft,
russia@microsoft.com.
He forwarded me reply from developers:
<><><><><><><>
Dear ...,
I'm sorry that I have to tell you the following.
-
My investigations and the answers from our Secondary Response Group
confirmed, that the $MFT will never shrink.
The only way is to reformat the Partition.
This behavior is the drawback resulting from optimizing the
NTFS performance. The main goal was to avoid fragmentation.
-
Possibly the best resolution for your situation is to use a
single partition for the FTP Data. If the available space then
goes under an acceptable level you can backup this partition
and reformat it.
I checked this with our Escallation Team and so i can say that
this behavior of NTFS will not be changed.
best regards,
...
<><><><><><><>
So, now you can check it...
+=-=-=-=-=-=-=-=-=+
|Vladimir Dubrovin|
| CSS Coordinator |
| Sandy Info, ISP |
=+=-=-=-=-=-=-=-=-=+=-=