Windows NT

Microsoft included five undocumented and unsupported functions in Windows NT 4.0 for doing disk defragmentation. The functions were added as a result of bad experiences with third party defragmenters written for Windows NT 3.5 and 3.51 (explained in section 5.4.2 on page ). [Rus97]

These functions are:

• GetVolumeBitmap returns a bitmap of free and allocated clusters on a drive. A bit is 1 when a cluster is allocated, or 0 when the cluster is free. [Rus97]
• GetRetrievalPointers returns an array of information about the clusters allocated to a file, specifically the starting cluster numbers and logical cluster numbers within the file. [Rus97]
• MoveFile given handles to a file and a drive, as well as source and destination cluster numbers, MoveFile moves a file from source to destination. [Rus97]
• GetVolumeData returns information about a NTFS drive, specifically the cluster size, the size of the drive, and the amount of free space in the drive.
• ReadMFTRecord returns a record from the master file table. [Rus97]

Mapping a drive requires three steps: [Rus97]

1.

Get map of free clusters with GetVolumeBitmap [Rus97]

2.

enumerate all files on the drive and obtain file cluster maps using the GetRetrievalPointers or the ReadMFTRecord functions [Rus97]

3.

display file mappings [Rus97]

In order to catch changes, defragmenters must repeat all three steps for each file it processes. Clusters are moved with MoveFile. [Rus97]

If there are any clusters in use but not allocated to a file, these clusters are system metadata, directories, or files opened exclusively by a process other than the defragmenter. There's also the MFT. Clusters of these types can not be moved. [Rus97]

The above is fine for FAT partitions. However, extra complications exist for NTFS partitions. The first problem is that NTFS performs compression on 16 cluster segments. As a result, MoveFile can not move individual clusters. Clusters must be moved in blocks of 16. The other problem is that deallocated clusters can't be used again until NTFS has checkpointed the drive, which occurs once every few seconds. [Rus97]