Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

700 MB missing hard disk space in $logfile: is that normal?


  • Please log in to reply
11 replies to this topic

#1 Cerberus™

Cerberus™

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:03:17 PM

Posted 22 March 2010 - 10:54 PM

This forum is great! I already posted this on another forum didn't get a reply after a few days; users on this forum seem very helpful and professional. I don't really have a problem: I hope just asking for information is OK. I also hope I am posting this in the right section.

My question:
I have a 320 GB hard drive, partitioned in two:
C:\ = 10 GB, Windows XP SP3 installed
D:\ = 288 GB, the rest
On C:\, there is about 700 MB unaccounted for if I compare disk size in My Computer with all files and folders together. I already emptied the System Volume Information.

In my Defragmentation program, I was able to see that C:\$logfile appears to be taking up a lot of space, might be 700 MB. Is this normal? Anything simple I can or should do about it? Or is this defragmentation program displaying the impossible?

I plan to clone my C:\ partition, so I'd like it to be as small as possible: I intend to put the cloned image on a DVD.

On my D:\ partition, I saw a huge area called "reserved for MFT", which looks like tens of GB. This MFT probably has something to do with the file system; however there is no space missing on D:\ (as there is on C:\). But, since my two partitions add up to only 298 GB as viewed in My Computer while my hard disk is supposed to be 320 GB, perhaps this MFT is needed as some kind of buffer when using partitions?

Edited by Cerberus™, 22 March 2010 - 10:59 PM.


BC AdBot (Login to Remove)

 


#2 Stang777

Stang777

    Just Hoping To Help


  • Members
  • 1,821 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:08:17 AM

Posted 23 March 2010 - 12:36 AM

Hi,

I have no info on the logfile thing but I did find an article from Microsoft about the MFT thing...

http://support.microsoft.com/kb/174619

Just want to add that I find that article from Microsoft rather confusing and I found something else that seems to explain it better....

http://www.eggheadcafe.com/software/aspnet...ed-for-mft.aspx

It's reserved space for the Master File Table. The MFT is one of the
most important files on your hard disk, each file on the disk is
recorded in the MFT, the operating system uses the MFT to find your
files and to record information about the files.

Because MFT fragmentation can degrade performance the file system
preemptively reserves a large contiguous block for the MFT when the
drive is formatted. This space isn't lost, it will be used if needed. If
the disk runs out of space for files the file system will relent and
yield space for the files from the MFT zone. The opposite is also true,
if the MFT zone fills up it will take space from the available (free)
disk space for its needs, the problem there is that in both instances
the MFT will become fragmented and the built in disk defragmenter will
not be able to defragment it. Also note that small files of 1KB or less
are stored in the MFT.

Edited by Stang777, 23 March 2010 - 12:48 AM.


#3 Bill1821

Bill1821

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:daytona
  • Local time:10:17 AM

Posted 23 March 2010 - 09:40 AM

Maybe you are not missing it- depends how you look at it- buyer or seller? (hdd manufacturer point of view- lol)

this is a cut and paste-

Hard Drive Size Discrepancy
Why does my new 500 GB hard drive report it only has 465 GB? Have I been ripped off?

No, you haven't been ripped off. 500 GB = 465 GB, strange as it seems.

The reason is that computers count a "kilo" something as 1024 (binary 2^10) while the rest of the world count a "kilo" as 1000 (decimal 10^3). A 'mega' in computer binary system is 1024 x 1024 = 1,048,576 (rather than decimal 1,000,000), and a 'giga' is 1024 x 1024 x 1024 = 1,073,741,824 rather than decimal 1,000,000,000

This creates a discrepancy of approximately 7% between the number of GB the computer reports, and what is advertised as the drive's capacity in GB. It is important to note that there is no difference in the number of actual bytes of storage - it is only a difference in reporting when the binary 'giga' terminology is used.

A 500 GB hard drive has about 500,000,000,000 bytes (it is never exact, commonly a drive is designed to have more bytes, to allow for a certain number of defective sectors to be mapped out). When counted on the computer, 500 Gb (decimal) = 500 billion bytes = 465.66 GB (binary).

Some propose using a different term, gibibyte (GiB) for the binary figure, however that is unlikely to catch on in the marketplace.

#4 Cerberus™

Cerberus™
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:03:17 PM

Posted 23 March 2010 - 09:25 PM

Thank you, stang: that will give me peace, while looking at that big yellow block.

Bill, thanks, that 1/(1.024^3) is exactly the factor by which my maximum space is lacking. I knew this about KB/MB/GB's not being exactly 10^3/6/9. I had no idea total disk space was advertised as though a GB were exactly 10^9 Bytes. It seems ridiculous to do so while KB means 1024 B etc. in all practical contexts.

I still don't know why this $logfile is taking up space and whether something can be done about it...

#5 Stang777

Stang777

    Just Hoping To Help


  • Members
  • 1,821 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:08:17 AM

Posted 23 March 2010 - 09:33 PM

You are welcome.

What extension does that logfile have?

If it has a .log or .txt extension, I would probably just open it in Notepad and see if it has any info in there that might help identify what put it there. If it has a .tmp extension, I would just delete it and let it sit in the recycle bin for a while to see if it was needed before deleting it from there.

If it were in the Windows folder I would be thinking it might have something to do with Windows updates but seeing that it is just on your C drive, not in a folder, I do not know

Edited by Stang777, 23 March 2010 - 09:35 PM.


#6 Cerberus™

Cerberus™
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:03:17 PM

Posted 24 March 2010 - 12:34 AM

Hmm no, it is invisible: it is not really a normal file, I think. I cannot see in by means of explorer: I can only see some grey "locked" blocks of data in my defragmenter, which display "$LogFile" when clicked upon (grey blocks are "locked). I have all system and hidden files set to visible. The programs I use to index my harddrive cannot see it either. It has no extension as far as I can tell; I have all extensions set to visible, even .lnk (shortcuts).
http://img641.imageshack.us/img641/5962/de...ewoensdag24.jpg
The white block on top is the one I was having selected; its label "$LogFile" can be seen at the lower left of the screen. Normally, when I click on a block, it is there that the program displays what file(s) are in the block.

Edit: oh, now I see that there is also a great number of blocks reserved for "$MFT": I didn't notice them before, because they are blue like normal (contiguous) files. I found out the amount of data per block is also displayed: this $LogFile is only 60-70 MB or so, while the $MFT is much larger. That is probably where most of the space has gone.

Edited by Cerberus™, 24 March 2010 - 12:40 AM.


#7 Stang777

Stang777

    Just Hoping To Help


  • Members
  • 1,821 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:08:17 AM

Posted 24 March 2010 - 03:12 AM

Hmmm, that is interesting but leaves me with absolutely no idea of what it is or why it is, sorry.

If it were on my system, I don't think I would be too worried about though. Heck, for all I know, since it is not visible, it is on my system. I have never done what you have that lets you see it is there.

#8 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:02:17 PM

Posted 24 March 2010 - 05:25 AM

Do you have show all files selected in Folder View Options?

#9 Cerberus™

Cerberus™
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:03:17 PM

Posted 24 March 2010 - 08:08 AM

Yes, crypto, that's the first thing I do on any new installation.

Stang, I agree, my interest was reduced to mere curiosity when I saw that $LogFile was not taking up that much space (it is $MFT, rather).

A bit hard to find because Google does not allow precise searches and ignores the dollar sign - from the Microsoft website:
http://74.125.77.132/search?q=cache:hLVGnS...=en&ct=clnk

"Master File Table (MFT) and NTFS System Files

When you format an NTFS volume, the format program creates a set of files that contains the metadata used to implement the file system structure. The NTFS file system reserves the first 16 records in the MFT for the information about these metadata files. The NTFS file system uses approximately 1 MB for the metadata files and the first 16 records in the MFT. The next table describes these records.

System file Filename - MFT record - Purpose of the file

- Master File Table $Mft 0 A list of all contents of the NTFS volume.

- Master File Table2 $MftMirr 1 A mirror of the first three records of the MFT, used to guarantee access to the MFT in the case of a single-sector failure.

- Log File $LogFile 2 A list of transaction steps used for NTFS recoverability.

- Volume $Volume 3 The volume name, NTFS version, and other information about the volume.

- Attribute Definition Table $AttrDef 4 A table of attribute names, numbers, and descriptions.

- Root Filename Index $. 5 Root folder.

- Cluster Bitmap $Bitmap 6 A representation of the volume, showing which clusters are in use.

- Partition Boot Sector $Boot 7 The bootstrap for the volume, if this is a bootable volume.

- Bad Cluster File $BadClus 8 A location where all the bad clusters in the volume are located.

- Quota Table $Quota 9 Disk quota usage for each user on a volume. Currently unused.

- Upcase Table $Upcase 10 Used for converting lowercase characters to the matching Unicode uppercase characters.
15-Nov Reserved for future use."

Edited by Cerberus™, 24 March 2010 - 08:09 AM.


#10 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:02:17 PM

Posted 24 March 2010 - 09:48 AM

I have never seen: $LogFile in the 15 years that I have been using Windows.

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:17 AM

Posted 24 March 2010 - 10:17 AM

More Info On These Files

Louis

#12 Cerberus™

Cerberus™
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:03:17 PM

Posted 24 March 2010 - 08:57 PM

Thanks, Louis.

Crypto, it's not really a file that's part of the file system.

Edited by Cerberus™, 24 March 2010 - 08:58 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users