Simplest way to view master file table (MFT) size in Windows 7?
I have yet to find a definitive answer that doesn't require third-party tools. Most of the search results were unrelated enough that they weren't useful, or dodgy-looking sites pushing even dodgier third-party tools.
I found this link https://msdn.microsoft.com/en-us/library/windows/desktop/aa365230%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
and the Analyze button doesn't generate a report.
Is there a built-in command line or other tool that reports the MFT size in Windows 7?
Solution 1:
You can use the fsutil utility that comes with Windows.
fsutil fsinfo ntfsinfo c:
In the output, look for the Mft Valid Data Length line. The value is hexadecimal; you can convert it to decimal using the Windows calculator or by simply running it (starting with 0x) in PowerShell as a command. That gives you the number of bytes, which when divided by 10242 = 1048576 gives you the MFT size in MiB.
It's even a tiny bit more precise than the value reported by Sysinternals' ntfsinfo. fsutil gives me 0x000000006c280000 = 1730.5 MiB, while the ntfsinfo tool reports 1730.
If you're on Windows 10, you can get the same info for any file with a different mode of the fsutil tool:
fsutil volume filelayout c:\$mft
Check the Size row under the ::$DATA stream.
Solution 2:
Is there a tool that reports the MFT size in Windows 7?
You can use NTFSInfo from Windows Sysinternals (Microsoft):
NTFSInfo is a little applet that shows you information about NTFS volumes. Its dump includes the size of a drive's allocation units, where key NTFS files are located, and the sizes of the NTFS metadata files on the volume.
Example output:
> ntfsinfo c:
NtfsInfo v1.2 - NTFS Information Dump
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
Volume Size
-----------
Volume size : 460241 MB
Total sectors : 942575615
Total clusters : 117821951
Free clusters : 15025676
Free space : 58694 MB (12% of drive)
Allocation Size
----------------
Bytes per sector : 512
Bytes per cluster : 4096
Bytes per MFT record : 0
Clusters per MFT record: 0
MFT Information
---------------
MFT size : 833 MB (0% of drive)
MFT start cluster : 786432
MFT zone clusters : 90400352 - 90451584
MFT zone size : 200 MB (0% of drive)
MFT mirror start : 2
Meta-Data files
---------------
I remember reading about some command line dir /a $mft Is that safe?
You will get a File Not Found error.
When I try to run dir /ah $mft, (or any other file such as $boot), I get "File Not Found". What am I doing wrong? I am running this from the c:> prompt ... is that not the NTFS root?
...
You're trying to view the NTFS metadata files. They are hidden from the Windows API (for very good reasons....). In fact the RKR webpage lists the inaccessible metadata filenames.
Source Windows Sysinternals Forum Topic: dir /ah $mft
It looks like dir /a $mft worked in Windows NT 4 Service Pack 4 and up until in Windows 2000 (NT 5.0, NTFS 3.0 aka NTFS 5.0) where access to the file was hidden from user and later removed completely from user space in and after Windows 7 (NT 6.1).