1

Over 1 month ago I started to have have problems with free space on drive C: as it's suddenly started to decrease every day.

External tools like TreeSize or Dirstat weren't able to show what is "eating" space.

Finally, it turned out that for some reason NTFS/MFT allocates enormous space, and it's freeing it up only after the server restart (to 0 but it's growing fast) or within few minutes after somebody is logon via RDP session to the server (this will decrease of reserved space significantly).

Reserved space is visible via cmd line and attribute "Total Reserved clusters". Total reserved size when somebody is logon is around 44gb, but if I logoff and wait couple of hours, space occupied by reservation will increase by another few GB's/.

I checked c: volume by running chkdsk, but is healthy. There are no quota settings on drive nor shadow copies set.

On the other Win2022 Server this NTFS occupying only around 1Gb, so where is the problem ?

Can you advise ??

This issue concerns: Windows Server 2022 Standard + Exchange 2019 (on-premise).

PS C:\Windows\system32> fsutil fsinfo ntfsinfo c:
NTFS Volume Serial Number : 0x0edc1ca0dc1c83dd
NTFS Version : 3.1
LFS Version : 2.0
Total Sectors : 429,705,215 (204.9 GB)
Total Clusters : 53,713,151 (204.9 GB)
Free Clusters : 27,462,030 (104.8 GB)
Total Reserved Clusters : 11,536,195 ( 44.0 GB)
Reserved For Storage Reserve : 0 ( 0.0 KB)
Bytes Per Sector : 512
Bytes Per Physical Sector : 512
Bytes Per Cluster : 4096 (4 KB)
Bytes Per FileRecord Segment : 1024
Clusters Per FileRecord Segment : 0
Mft Valid Data Length : 552.75 MB
Mft Start Lcn : 0x00000000000c0000
Mft2 Start Lcn : 0x0000000000000002
Mft Zone Start : 0x0000000002d20240
Mft Zone End : 0x0000000002d25180
MFT Zone Size : 79.25 MB
Max Device Trim Extent Count : 64
Max Device Trim Byte Count : 0x2000000
Max Volume Trim Extent Count : 62
Max Volume Trim Byte Count : 0x2000000
Resource Manager Identifier : 393C6EFA-7A42-11ED-BF42-AD3018B76F78
Amazon Dies In Darkness
  • 9,990
Maciejka666
  • 11

3 Answers3

1

First of all I think you're inventing a problem in the sense that your supposed free space problem has got nothing to do with MFT reserved space.

Run chkdsk and it will tell you size of an allocation unit and the amount of allocation block available. This is what the file system regards used vs. free space.

Second, MFT Reserved or MFT zone do not actually occupy any disk space. It's a zone the system will try to maintain for the MFT to expand into if needed. It's purely a measure to mitigate MFT fragmentation.

But if the reserved space is needed because you fill up the NTFS volume, it will be used to store 'normal' files. MFT reserved space =/= the size of the actual MFT.

If for some reason files are saved into the reserved zone, the system will simply look for another block of contiguous free space and reserve that for future MFT growth.

Third, you can set the amount of space that's used for MFT reserved zone.

Run Registry Editor (Regedt32.exe), and go to the following subkey:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem


From the Edit menu, click Add Value.


Type the following information in the dialog box:


Value Name: NtfsMftZoneReservation
Data Type: REG_DWORD
Data: (valid range is 1-4)
Quit Registry Editor and restart your computer.


Setting 1, the default, reserves approximately 12.5 percent of the volume.


Setting 2 reserves approximately 25 percent.


Setting 3 reserves approximately 37.5 percent.


Setting 4 reserves approximately 50 percent.
0

You have "Total Reserved Clusters" of 44 GB.

Seems like some program has created a gigantic number of files and caused the MFT to expand. The files were perhaps temporary and were never closed, so they were discarded with no trace left in the MFT after the program has terminated. The MFT is never shrunk when file entries are deleted.

I don't know of a way to reduce the MFT, except by formatting the partition.

harrymc
  • 498,455
0

So, I think that I know more or less what happened as finally I was managed to decreased reserved space to only 5,5 GB. I achieved it by turning off compression on several folders. As I mentioned servers has Exchange roles installed, therefore there are lots of logs stored on c:\ drive. Some logs I'm deleting automatically by powershell script, but still there are lot's of logs where compressions is enabled. Once I disabled compression, accupied space significally decreased.

PS C:\Windows\system32> fsutil fsinfo ntfsinfo c:
NTFS Volume Serial Number :        0x0edc1ca0dc1c83dd
NTFS Version      :                3.1
LFS Version       :                2.0
Total Sectors     :                429,705,215  (204.9 GB)
Total Clusters    :                 53,713,151  (204.9 GB)
Free Clusters     :                 28,127,049  (107.3 GB)
**Total Reserved Clusters :            1,449,010  (  5.5 GB)**
Reserved For Storage Reserve :               0  (  0.0 KB)
Bytes Per Sector  :                512
Bytes Per Physical Sector :        512
Bytes Per Cluster :                4096  (4 KB)
Bytes Per FileRecord Segment    :  1024
Clusters Per FileRecord Segment :  0
Mft Valid Data Length :            552.75 MB
Toto
  • 19,304
Maciejka666
  • 11